With five new state privacy laws taking effect in 2025, enforcement teams are already requesting Data Protection Impact Assessments (DPIAs) in response to consumer complaints and attorney general investigations. If your team is involved in targeted advertising, collecting precise geolocation, or processing sensitive data, you need a documented DPIA on file before the next inquiry lands in your inbox.
This guide will help you build your first DPIA from scratch. You'll document processing operations, assess proportionality, evaluate risks, and establish safeguards that meet state requirements.
The Problem: You're Processing High-Risk Data Without Documentation
Many compliance teams realize they need a DPIA only when an AG's office sends a data request. By then, you're scrambling to draft under pressure instead of conducting a proper risk assessment.
State privacy laws now require DPIAs for activities your team likely performs daily: browser-based targeted advertising through cookies and pixels, CRM-based targeting via custom and lookalike audiences, server-side implementations using Conversion API, SDK-based app advertising, precise geolocation collection for store locators, and processing sensitive categories like health or ethnicity. New Jersey's statute adds credit card number collection to that list.
Without a completed DPIA, you can't demonstrate that you've assessed necessity, evaluated risks to consumer rights, or implemented proportionate safeguards. You're operating on assumptions instead of documented analysis.
What You Need Before Starting
Gather these materials before you begin:
Processing inventory: A current list of every activity that triggers DPIA requirements. Don't rely on what marketing says they're doing. Pull your Tag Manager container export, review your CMP configuration, audit your SDK implementations, and check your data warehouse ingestion logs.
Data flow diagrams: Map where personal data enters your systems, which vendors receive it, and how long you retain it. If you're using server-side tagging, document every endpoint that receives hashed email identifiers or Mobile Advertising IDs.
Vendor contracts: You'll need Data Processing Agreements and security documentation from every third party that processes personal data on your behalf. If a vendor can't provide their security controls, that's a finding for your risk assessment.
Legal basis documentation: Know which legal basis for processing you're relying on for each activity. If you're claiming legitimate interest for targeted advertising, you'll need to document your balancing test.
Stakeholder access: Schedule time with your engineering lead, marketing operations manager, and information security officer. You can't assess technical controls or business necessity without their input.
Step-by-Step Implementation
Document Processing Operations
Start with a systematic description of what you're actually doing. For each DPIA-triggering activity, write:
- Purpose: "We collect precise geolocation to display the nearest retail location when users click 'Find a Store.'"
- Data elements: List exactly what you're collecting. "Latitude and longitude coordinates accurate to within 10 meters" is more defensible than "location data."
- Processing operations: Describe the technical flow. "User grants browser location permission, coordinates sent to our API, matched against store database, nearest three locations returned, coordinates discarded after 24 hours."
- Recipients: Name every entity that receives this data, including your CDN, analytics vendor, and mapping service provider.
If you're documenting targeted advertising, break it down by implementation method. Your browser-based pixel tracking has different risk characteristics than your server-side Conversion API setup, even if they serve the same campaign.
Assess Necessity and Proportionality
For each processing operation, answer two questions:
Is this necessary to achieve the stated purpose? If you're collecting precise geolocation for a store locator, could you achieve the same result with ZIP code or city-level data? If precise coordinates don't materially improve the user experience, you're processing more data than necessary.
Is the processing proportionate to the purpose? Retaining geolocation coordinates for 90 days to analyze foot traffic patterns might be proportionate. Retaining them indefinitely for undefined "business intelligence" isn't.
Document your reasoning. "We require precise coordinates because our stores are located in dense urban areas where city-level data would return 40+ locations. We retain coordinates for 24 hours to enable session replay for customer service inquiries, then aggregate to ZIP code level for analytics."
Evaluate Risks to Consumer Rights
Identify specific harms that could result from this processing:
- Discrimination: Could this data be used to deny services or charge different prices based on protected characteristics?
- Surveillance: Does continuous tracking create a detailed profile of user behavior across contexts?
- Security: What happens if this data is breached? Precise geolocation reveals home addresses. Hashed Email Identifiers can be reverse-engineered with sufficient computing resources.
- Autonomy: Does the processing manipulate behavior or limit genuine choice?
Rate each risk's likelihood and severity. A low-severity, high-likelihood risk (like Consent Fatigue from excessive re-consent prompts) still requires mitigation. A high-severity, low-likelihood risk (like a targeted attack on your geolocation database) demands stronger controls.
Define Safeguards and Controls
For each identified risk, document your mitigation measures:
Technical controls: Encryption at rest and in transit, access logging, automated data deletion, Partitioned Cookies to prevent cross-site tracking, SameSite Attribute configuration to limit cookie scope.
Organizational controls: Staff training on data minimization, vendor security assessments, incident response procedures, regular access reviews.
Transparency measures: Clear Purpose Disclosure in your consent notice, granular consent controls in your CMP, accessible Withdrawal of Consent mechanisms.
Be specific. "We encrypt data" doesn't tell you anything. "We use AES-256 encryption for data at rest, TLS 1.3 for data in transit, and rotate encryption keys quarterly" demonstrates actual security posture.
Document Your Legitimate Interest Balancing Test
If you're relying on legitimate interest rather than consent, document your three-part test:
- Legitimate interest: What business need does this processing serve? "We use Behavioural Advertising to fund free content" is a recognized legitimate interest.
- Necessity: Could you achieve this interest through less intrusive means? If contextual advertising generates 80% of the revenue with zero tracking, behavioral targeting might not be necessary.
- Balancing: Do consumer rights override your business interest? Processing children's data for Behavioural Advertising fails this test in most jurisdictions.
Validation: Verify Your DPIA Works
Your DPIA should answer these questions without additional research:
- Can you produce a complete list of processing activities that require DPIAs within 24 hours of an AG request?
- Can you explain why each processing operation is necessary and proportionate?
- Can you demonstrate that you've implemented the safeguards you documented?
- Can you show that you've reviewed and updated your risk assessment when processing operations change?
Test your documentation by having someone outside your team read it. If they can't understand what you're doing, why you're doing it, and how you're protecting consumer data, revise until it's clear.
Check that your technical controls match your documentation. If your DPIA says you delete geolocation data after 24 hours, verify that your data retention policy actually enforces that deletion.
Maintenance: Keep Your DPIAs Current
Set quarterly reviews for every DPIA. Processing operations change when marketing launches new campaigns, engineering deploys new tracking implementations, or vendors update their data handling practices.
When you add a new vendor, update the relevant DPIA before you send them data. When you expand into a new advertising channel, complete a DPIA before you activate the first campaign. When you discover shadow IT (marketing teams deploying tags without engineering review), document it in your DPIA and implement controls to prevent recurrence.
Archive superseded versions with timestamps. If an AG asks about your processing practices in Q2 2024, you need the DPIA that was current at that time, not your current version.
State enforcement teams are building their investigative playbooks now. They're requesting DPIAs because documented risk assessments reveal whether you're making deliberate compliance decisions or running operations on autopilot. Build your documentation before they ask for it.
