IrelandWhat is a Data Protection Impact Assessment?
A Data Protection Impact Assessment (DPIA) is a process required under Irish and EU law to identify and minimise data protection risks before launching a high-risk processing activity.
What the Law Says
Under Irish law, a Data Protection Impact Assessment (DPIA) is a formal requirement for certain types of personal data processing that are likely to result in a high risk to individuals’ rights and freedoms.
The Data Protection Act 2018 gives effect to the EU General Data Protection Regulation (GDPR) in Ireland. Section 84 of the Act specifically addresses DPIAs and confirms that controllers must carry out an assessment before beginning any processing operation that is likely to result in a high risk to the rights and freedoms of individuals.
A DPIA is not needed for every data processing activity — only those that meet the 'high risk' threshold. Examples include large-scale monitoring of public areas, systematic profiling, or processing of sensitive personal data on a large scale.
The assessment must describe the processing, assess necessity and proportionality, identify risks, and set out measures to address those risks. It must also involve consultation with the Data Protection Commission where necessary.
Statutory TextA controller shall, prior to undertaking any processing which is likely to result in a high risk to the rights and freedoms of natural persons, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
— Data Protection Act 2018, s. 84 — Duty to carry out data protection impact assessment
What to Do
Identify whether your planned processing is likely to result in a high risk to individuals’ rights and freedoms.
If yes, carry out a DPIA before starting the processing.
Document the DPIA thoroughly, including risk analysis and mitigation measures.
Consult the Data Protection Commission if the residual risk remains high after mitigation.
Review and update the DPIA if the nature, scope, context or purposes of the processing change significantly.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.