A data protection impact assessment (DPIA) records how a proposed use of data might affect individuals. Begin once the project hypothesis is clear, while requirements and risks can still be challenged. Treat the assessment as a project artifact, not as a claim that legal compliance alone settles the ethical questions. section 3.5 section 2.6
Write an initial assessment that:
- Describes the nature, scope, context, and purpose of the data use, including what is new about the proposed processing. section 3.5
- Checks whether people know about the proposed use and whether consent is in question. section 3.5
- Reviews possible effects on individuals, such as loss of control, restricted access to services, inability to exercise rights, or financial loss. section 3.5
- Documents ethical and regulatory requirements, challenges project assumptions, and checks applicable jurisdictional and domain-specific law. section 2.6
Customer purchasing model
A retailer proposes scoring millions of customers for likelihood of stopping purchases, with people—not the model—making decisions from the scores. The data stays under the retailer’s control, and retention and security will not change. Yet using purchasing history to build the model is novel processing. The assessment asks whether customers expect or have consented to that use, and whether offers based on the scores could exclude some customers and cause financial loss. section 3.5
