When should a DPIA be performed?

• A. After data processing has begun.
• B. Only during post-implementation.
• C. Never required if data is anonymized.
• D. At project initiation and for high-risk processing activities.

Answer: (D)

A DPIA is used to identify and address privacy risks before processing begins, so safeguards can be built into the project from the start. It should be done at project initiation to ensure privacy considerations shape the design and implementation. It’s also required for activities that are high risk to individuals’ rights and freedoms, such as large-scale processing, processing of sensitive data, or systems that enable extensive monitoring. Even if data is anonymized, a DPIA may still be needed if there are residual risks, re-identification concerns, or the way data could be combined with other information introduces potential harm. So, perform the DPIA early in the project and whenever the processing is high risk; don’t wait until after processing has begun.