Data Protection Impact Assessment: What It Is For and When to Prepare One

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The data protection impact assessment has become a centerpiece of companies’ defense strategy when the National Data Protection Authority (ANPD) comes knocking. More than a formality under Brazil’s General Data Protection Law (LGPD), this document organizes risks, records decisions, and shows that the organization acted with due diligence before handling sensitive information.

What a data protection impact assessment is

Law 13.709/2018, in Article 5, item XVII, defines the data protection impact assessment as the controller’s documentation describing the processing operations that may create risks to civil liberties and fundamental rights, together with the measures, safeguards, and risk-mitigation mechanisms adopted.

In practical terms, it is a structured diagnosis. The company maps which data it collects, for what purpose, how long it keeps the data, with whom it shares it, and what threats each stage of the data flow poses to the data subject. Using that map, it records the steps taken to reduce both the likelihood and the severity of each risk identified.

This is not a generic compliance report. It focuses on assessing the risk of specific operations, especially those involving sensitive personal data, automated decisions, continuous monitoring, or large-scale processing. For that reason, the assessment must be technical, dated, and open to revision. It is not a corporate statement of commitment to principles.

When a company should prepare the document

The law sets out situations in which the National Data Protection Authority may order the assessment to be prepared. Article 38 allows the agency to require the controller to submit an impact assessment covering its operations, including those involving sensitive data. Article 10, paragraph 3, provides for such a request when the processing is based on the controller’s legitimate interest.

Reading the law only literally, however, leads to a strategic mistake. If a company waits for the authority’s notice before drafting the assessment, it ends up improvising a document under pressure, with no time to properly justify decisions it has already made. The better approach is the opposite: prepare the assessment proactively, before starting higher-risk operations.

Some situations are clear triggers for preparing it in advance. Processing health, biometric, or genetic data, or data on racial origin, religious belief, or political opinion calls for extra care, because the law itself classifies these as sensitive. Using facial recognition technology, building consumer profiles, and making automated decisions that affect the data subject’s interests also call for a prior assessment.

The same applies to projects that significantly expand the volume of data processed, such as merging databases, adopting new business intelligence platforms, or entering partnerships that involve sharing data with third parties. In these scenarios, the assessment is no longer a future requirement. It becomes a governance tool for the present.

How the assessment strengthens your defense in an inspection

In an enforcement proceeding, the authority does not look only at whether an incident occurred. It looks at whether the company adopted technical and administrative measures capable of protecting the data. An impact assessment that is prepared consistently and on time is the documentary proof of that diligence.

The effect is twofold. First, the document shows that the organization identified the risks before processing the data and chose proportionate safeguards, which undercuts any claim of negligence. Second, it records the chain of decision-making, showing who approved each measure and on what grounds. That lets the company answer the authority’s questions precisely, without reconstructing events after the fact.

Those who document the risk before taking it on build a defense; those who improvise an assessment after the incident merely confess their omission.

When a penalty is being calibrated, a consistent risk assessment policy counts in the controller’s favor. The law itself treats good practices and governance programs as a relevant factor. A well-constructed assessment turns a preventive stance into a concrete argument rather than an abstract claim.

Not having the document has the opposite effect. After an incident, a company that cannot produce a prior risk assessment gives the impression that it processed sensitive data without thinking through the consequences. Both the administrative authority and data subjects seeking compensation in court tend to exploit that gap in the evidence.

One point is often overlooked: the assessment must be a living document. One that is prepared once and never revised loses force when the operation changes. A robust defense comes from an assessment that is updated whenever there is a relevant change in purpose, technology, or legal basis.

Minimum structure and best practices for preparing it

Although the law does not impose a fixed template, practice and the authority’s guidance converge on a set of essential elements. The assessment should describe the processing operation, state its purpose and necessity, identify the types of data involved, and define the life cycle of the information, from the moment of collection to deletion.

The core of the document is the risk analysis itself. It should evaluate how likely each threat is to materialize and what impact it would have on the data subject, ranking the risks by severity. Each relevant risk should be matched with a technical or organizational mitigation measure, with the person responsible and the implementation deadline identified.

A few best practices raise the quality of the document. Involving the technology, legal, and business teams ensures that the assessment reflects the actual operation rather than an idealized version. Dating each version and keeping a revision history preserves traceability. Linking the assessment to the other components of the governance program, such as the record of processing operations and the retention policy, avoids internal contradictions that weaken your defense.

Finally, it makes sense to match the depth of the assessment to the level of risk. Low-impact operations can be covered by leaner assessments, while large-scale processing of sensitive data demands a thorough analysis. That proportionality is itself a sign of maturity that the authority tends to recognize.

Frequently Asked Questions

Is an impact assessment mandatory for every company?

Not across the board. The law provides that the authority may require the document in specific situations, such as risky operations based on legitimate interest or involving sensitive data. In practice, though, any organization that handles high-risk information has a strong interest in preparing it proactively, because the assessment serves as proof of diligence and reduces exposure in an inspection.

How long does a company have to submit the document if the authority requests it?

The authority sets the deadline in its notice. Companies that already keep an up-to-date assessment can respond quickly and with confidence, simply tailoring the content to the scope requested. Those that start preparing the document only after being served face a tight deadline and a greater risk of inconsistencies, which tends to worsen the perception that they have lost control over their data processing.

Does the assessment need to be revised once it is finished?

Yes. The document must keep pace with the operation as it evolves. A change of purpose, the adoption of new technologies, an increase in the volume of data, or a change in the legal basis all require a revision. A static assessment, prepared once and never updated, loses its value as evidence and can even hurt your defense by showing that the company stopped tracking the real risks of its activities over time.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.