What is a DPIA (Data Protection Impact Assessment)?

Definition

RIPD is the Personal Data Protection Impact Assessment Report. LGPD Article 5, item XVII, defines it as the controller's documentation containing a description of the personal data processing activities that may generate risks to civil liberties and fundamental rights, as well as measures, safeguards, and risk mitigation mechanisms. It is the Brazilian equivalent of the DPIA (Data Protection Impact Assessment).Data Protection Impact Assessment) Of the GDPR.

When it is required

The ANPD (Brazilian National Data Protection Authority) may require the controller to prepare a report, including on sensitive data, regarding its processing operations (article 38). In processing based on legitimate interest, the authority may request the report when there is a risk (article 10, § 3). In practice, mature programs produce the RIPD (Data Protection Impact Assessment) whenever processing is high-risk: large-scale sensitive data processing, systematic monitoring, automated decisions, new technologies, or data of children and adolescents.

What the report contains

• A description of the types of data collected and the processing performed;
• The methodology used for data collection and to ensure the security of information.
• The controller's analysis of the measures, safeguards, and risk mitigation mechanisms adopted;
• the necessity and proportionality of the treatment in relation to its purpose;
• The residual risks and the action plan to address them.

Relationship with ROPA

RIPD starts from ROPAThis is a record of activities that shows what treatments exist, what data is involved, and where the risks lie. Without an updated inventory, the impact report is incomplete from the start.

How Privacy Tools supports RIPD

in the module Data MappingThe processing activities already carry risks, legal bases, and controls; the generation of impact reports (DPIA/RIPD) uses this information and maintains a history of versions. The identified risks are then transferred to action plans in the module. Risk management.

Related terms

ROPA · LIA · DSAR · Back to glossary

Updated October 3th, 2026.