Some modern data privacy statutes require organizations to consider and document privacy-related risks regarding certain types of processing activities. These assessments are sometimes referred to as “data protection assessments” or “data protection impact assessments” (generically a DPIA). For example, several state data privacy statutes mandate that a DPIA be conducted if an organization intends to sell personal data or use it for targeted advertising. The following chart provides a breakdown of the situations in which a DPIA is mandated under state privacy laws:
| Processing Activities That Require a DPIA |
California 2022 CCPA[1] |
California 2023 CPRA[2] |
Colorado 2023 CPA |
Conn. 2023 CTDPA |
Utah 2023 UCPA |
Virginia 2023 VCDPA |
| Targeted advertising. A DPIA is required if an organization engages in targeted advertising. | X | X | ✔[3] | ✔[4] | X | ✔[5] |
| Sale of data. A DPIA is required if an organization sells personal data. | X | X | ✔[6] | ✔[7] | X | ✔[8] |
| Sensitive data. A DPIA is required if an organization processes sensitive data. | X | X | ✔[9] | ✔[10] | X | ✔[11] |
| Profiling with risk of unfair treatment/ discrimination. A DPIA is required if an organization engages in profiling that has a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact. | X | X | ✔[12] | ✔[13] | X | ✔[14] |
| Profiling with risk of physical injury. A DPIA is required if an organization engages in profiling that has a reasonably foreseeable risk of physical injury. | X | X | ✔[15] | ✔[16] | X | ✔[17] |
| Profiling with risk of financial injury. A DPIA is required if an organization engages in profiling that has a reasonably foreseeable risk of financial injury. | X | X | ✔[18] | ✔[19] | X | ✔[20] |
| Profiling with risk of reputational injury. A DPIA is required if an organization engages in profiling that has a reasonably foreseeable risk of reputational injury. | X | X | X | ✔[21] | X | ✔[22] |
| Profiling with a risk of privacy intrusion. A DPIA is required if an organization engages in profiling that has a reasonably foreseeable risk of a physical or other intrusion upon solitude or seclusion that would be offensive to a reasonable person. | X | X | ✔[23] | ✔[24] | X | ✔[25] |
| Other processing that has a heightened risk of harm. A DPIA is required if an organization processes data that presents a “heightened risk of harm.” | X[26] | X[27] | ✔[28] | ✔[29] | X | ✔[30] |
[1] While the CPRA does not directly require that companies create a DPIA, it empowers the CPPA to issue regulations that might require companies to submit to the agency a risk assessment with respect to certain forms of processing activities. To date the CPPA has not proposed such regulations. Cal. Civ. Code § 1798.185(a)(15)(B) (West 2022).
[2] While the CPRA does not directly require that companies create a DPIA, it empowers the CPPA to issue regulations that might require companies to submit to the agency a risk assessment with respect to certain forms of processing activities. To date the CPPA has not proposed such regulations. Cal. Civ. Code § 1798.185(a)(15)(B) (West 2022).
[3] C.R.S. § 6-1-1309(1), (2)(a) (2022).
[4] Conn. Sub. Bill No. 6, § 8(a)(1) (2022).
[5] Va. Code Ann. 59.1-576(A)(1) (2022).
[6] C.R.S. § 6-1-1309(1), (2)(b) (2022).
[7] Conn. Sub. Bill No. 6, § 8(a)(2) (2022).
[8] Va. Code Ann. 59.1-576(A)(2) (2022).
[9] C.R.S. § 6-1-1309(1), (2)(c) (2022).
[10] Conn. Sub. Bill No. 6, § 8(a)(4) (2022).
[11] Va. Code Ann. 59.1-576(A)(4) (2022).
[12] C.R.S. § 6-1-1309(1), (2)(a)(I) (2022).
[13] Conn. Sub. Bill No. 6, § 8(a)(3)(A) (2022).
[14] Va. Code Ann. 59.1-576(A)(3)(i) (2022).
[15] C.R.S. § 6-1-1309(1), (2)(a)(II) (2022).
[16] Conn. Sub. Bill No. 6, § 8(a)(3)(B) (2022).
[17] Va. Code Ann. 59.1-576(A)(3)(ii) (2022).
[18] C.R.S. § 6-1-1309(1), (2)(a)(II) (2022).
[19] Conn. Sub. Bill No. 6, § 8(a)(3)(B) (2022).
[20] Va. Code Ann. 59.1-576(A)(3)(ii) (2022).
[21] Conn. Sub. Bill No. 6, § 8(a)(3)(B) (2022).
[22] Va. Code Ann. 59.1-576(A)(3)(ii) (2022).
[23] C.R.S. § 6-1-1309(1), (2)(a)(III) (2022).
[24] Conn. Sub. Bill No. 6, § 8(a)(3)(C) (2022).
[25] Va. Code Ann. 59.1-576(A)(3)(iii) (2022).
[26] While the CPRA does not directly require that companies create a DPIA, it empowers the CPPA to issue regulations that might require companies to submit to the agency a risk assessment with respect to certain forms of processing activities. To-date the CPPA has not proposed such regulations. Cal. Civ. Code § 1798.185(a)(15)(B) (West 2022).
[27] While the CPRA does not directly require that companies create a DPIA, it empowers the CPPA to issue regulations that might require companies to submit to the agency a risk assessment with respect to certain forms of processing activities. To-date the CPPA has not proposed such regulations. Cal. Civ. Code § 1798.185(a)(15)(B) (West 2022).
[28] C.R.S. § 6-1-1309(1), (2)(a)(IV) (2022).
[29] Conn. Sub. Bill No. 6, § 8(a) (2022).
[30] Va. Code Ann. 59.1-576(A)(5) (2022).