Data protection impact assessment
DPIA
Other languages: Deutsch · Français · Español
Prior assessment of the risks of data processing for the persons concerned; mandatory where a high risk is likely (Art. 35 GDPR, Art. 22 Swiss FADP).
It describes the processing, assesses the risks and sets out measures. For family offices, it may be required where sensitive data is processed on a large scale.
In practice
Family offices process particularly sensitive data: financial circumstances, health and family information, copies of identity documents. Before introducing new systems – such as cloud document storage, AI functions or a client portal – a data protection impact assessment is therefore part of the project. It describes the purpose, data categories, risks and safeguards such as encryption, access rights and storage location. It is updated whenever significant changes are made and forms part of the documentation for supervisors and the family.
Distinctions and common mistakes
A data protection impact assessment is not the same as the record of processing activities: the record describes all processing, the assessment only processing with a likely high risk, but in greater depth. Typical mistakes are assessments written only after a system has been introduced, residual risks left unassessed and the overlooked obligation to consult the Swiss FDPIC or the competent supervisory authority where a high risk remains.
Relevant in: Switzerland · EU-wide
Related terms
- Politically exposed person
- A person who holds or has held a prominent public function, as well as their family members and persons known to be close associates.