Data Protection Impact Assessment

A process required under GDPR Article 35 for assessing and mitigating risks to individuals' rights and freedoms before undertaking high-risk data processing. DPIAs are mandatory when processing is "likely to result in a high risk," including large-scale processing of special category data (such as disability status) or systematic automated decision-making with significant effects. A DPIA must describe the processing, assess necessity and proportionality, identify risks, and outline mitigation measures. For AI systems affecting people with disabilities, DPIAs provide a proactive mechanism to identify potential discrimination before deployment, complementing the reactive nature of equality law enforcement.