The DPIA, in Plain English

DPIA stands for Data Protection Impact Assessment. In plain English: before a risky project, sit down and think through what could go wrong with people's data.

That's really all it is. What data is involved? Who could be harmed if it leaks or gets misused? How likely is that, and how bad would it be? What are we doing to prevent it? Write it down while you can still change the plan.

It's the privacy review's bigger sibling: same spirit, more structure, used when the stakes are higher.

The EU AI Act, in force since August 2024, expects this kind of thinking for higher-risk AI systems. But you don't need a regulation to tell you it's wise. Thinking before building is just good practice with a fancy name.

Assess the impact before you become the impact.

I explain frameworks; I don't give legal counsel.