Privacy risk has to be assessed before you build, not after
Technology projects, new digital services, AI and analytics tools, biometric systems, CCTV deployments, employee monitoring and loyalty programmes all process personal data in ways that carry elevated risk. Without a DPIA you are entering legally regulated territory without the required safeguards, and without the documentation to demonstrate due diligence if something goes wrong.
- Legal non-compliance
- Starting high-risk processing without a DPIA is a direct breach of the CDPA and exposes you to POTRAZ enforcement.
- Unidentified risks
- Privacy risks found late in a project are expensive to fix, and may force you to redesign or halt it entirely.
- No audit trail
- Without a DPIA you cannot show regulators, auditors or partners that you considered privacy risk before processing.
The DPIA is your privacy-by-design mechanism
The CDPA requires organisations to build privacy considerations into systems and processes from the outset. A DPIA is the practical mechanism for doing that: it forces a structured conversation about what data you are collecting, who can access it, what could go wrong, and how you will mitigate it. Done properly it protects your organisation, your data subjects and your project.
- Mandatory before high-risk processing under the CDPA
- Required for new technologies, large-scale surveillance and sensitive data
- Demonstrates privacy by design to regulators and partners
- Identifies privacy risks before they become costly incidents
- Provides board-level assurance on new project privacy governance
What the DPIA covers
A structured, documented assessment that satisfies CDPA requirements, supports your project and stands up to regulatory scrutiny.
Processing description
A clear account of the proposed activity, the data involved, the people affected and the intended purposes.
Necessity and proportionality
Whether the processing is necessary, proportionate and limited to what the stated purpose actually requires.
Risk identification
Systematic identification of risks to data subjects, including unauthorised access, misuse, discrimination and harm.
Mitigation measures
Documented measures to eliminate, reduce or manage each identified risk to an acceptable level.
Stakeholder consultation
Where required, we facilitate consultation with affected data subjects or their representatives.
POTRAZ referral advice
Where high residual risk remains after mitigation, we advise on whether prior consultation with POTRAZ is required.
How the assessment runs
A structured methodology that integrates with your project timeline rather than interrupting it.
- 1
Assessment
We understand the processing activity, the project context and the personal data involved.
- 2
Gap identification
We identify the privacy risks, the affected data subjects and the areas needing mitigation.
- 3
Structure
We document the assessment, the risk register and the proposed mitigation measures.
- 4
Alignment
We validate the DPIA with stakeholders, incorporate feedback and finalise the report.
- 5
Support
We advise on POTRAZ consultation if required and support implementation of the mitigations.
Who needs a DPIA
Any organisation introducing processing activities that involve significant personal data use. Typical projects include:
- Technology startups building data apps
- Banks adding new digital services
- Health systems digitalising patient records
- HR implementing monitoring tools
- Retailers launching loyalty programmes
- Schools deploying student management systems
- Government e-services projects
- Fintechs processing financial data
- Security firms deploying CCTV
- Insurers building risk scoring systems
- Telecoms launching analytics products
- NGOs collecting beneficiary data
Get a DPIA before you go live
We work alongside your project team to deliver a thorough, CDPA-compliant DPIA that protects both your timeline and your organisation's legal standing.