Data Protection Impact Assessment (DSFA)

A data protection impact assessment (DSFA, Article 35 GDPR) is a mandatory risk analysis for processing operations that are likely to result in a high risk to the rights and freedoms of the people concerned, such as extensive tracking or certain AI systems. In English-language practice it is usually called a DPIA.

In practice

Most ordinary company websites do not need one; an assessment becomes relevant above all for large-scale, systematic profiling, sensitive categories of data or novel technologies whose risk is hard to judge. If you are unsure, the checklist published by your national data protection authority helps with the decision.

Sources

← Back to the glossary