In which scenario should a Data Privacy Impact Assessment (DPIA) be conducted?

• A. Only after a data breach occurs.
• B. When launching a new data initiative that processes personal data.
• C. Only if required by regulators.
• D. Never; DPIA is optional.

Answer: (B)

A DPIA is used to proactively identify and mitigate privacy risks in new data processing projects. When you’re planning a new data initiative that handles personal data, a DPIA helps you map what data will be collected, how it will be used, who will access it, and what safeguards are needed to protect individuals’ privacy. Doing this at the design stage allows you to justify the processing as necessary and proportional, set appropriate data minimization and retention limits, implement access controls and security measures, and address potential impacts before anything launches. This is why the scenario of launching a new data initiative that processes personal data is the right time for a DPIA—it embeds privacy by design and reduces the chance of regulatory issues or unexpected risks later on. Reactive DPIAs after a breach are too late, and DPIAs are not merely optional or solely regulator-driven you may still need them in many contexts when the processing is high risk.