What is a data privacy impact assessment (DPIA) and when is it used?

• A. A retrospective audit of data breaches after implement.
• B. A general risk assessment for financial impact.
• C. A patient safety risk assessment for clinical processes.
• D. A systematic assessment of how a project or system may affect privacy and data protection, used before implementation.

Answer: (D)

A data privacy impact assessment is a proactive, structured analysis conducted before launching a project or system to examine how it could affect individuals’ privacy and the protection of their data. It looks at what data will be collected, for what purposes, who will access it, how long it will be kept, and what safeguards are needed, then evaluates potential harms and their likelihood and outlines steps to mitigate those risks. This assessment helps ensure privacy-by-design by addressing risks early and aligning the project with data protection laws and best practices. It’s done before implementation because the goal is to identify and reduce privacy risks before data processing begins. The other options describe activities that are retrospective, focus on financial risk, or address patient safety—areas that aren’t about proactively safeguarding privacy in new systems. In many places, DPIAs are required for high-risk processing, making this the appropriate, privacy-centered pre-implementation evaluation.