Data Protection Impact Assessment (DPIA)
A risk assessment of processing operations for the rights and freedoms of individuals. Required under Art. 35 GDPR when processing is likely to result in high risk.
A DPIA is required whenever processing is likely to result in a high risk to individuals. The practical test is the 10 criteria set out by the EDPB (WP248): profiling, large-scale processing, sensitive data, monitoring of publicly accessible areas, and several others. The rule of thumb is: two or more criteria means you carry out a DPIA.
In Poland an additional list issued by the Polish DPA (M.P. 2019 item 666) specifies types of processing that require a DPIA by default. These are two separate tests running in parallel; meeting either one of them is sufficient to trigger the obligation.
A DPIA is a process with a decision and a residual risk outcome, not a form to file away in a drawer. If the risk remains high after all mitigating measures have been applied, you consult the Polish DPA before starting the processing. A well-executed DPIA inherits data directly from the record of processing activities rather than duplicating it from scratch.
In practice: see the relevant RealSec module.
A register of all personal data processing operations carried out by a controller. Required under Art. 30 GDPR.
Fundamental Rights Impact Assessment: an assessment required by the AI Act for high-risk AI systems.
The EU General Data Protection Regulation (2016/679). In force since 25 May 2018.
Compliance that connects.
Terms are the map. RealSec ties them to processes, systems and vendors in one engine.