Law No. 13.709/2018, the General Data Protection Law (LGPD), which came into force in September 2020, as well as the European legislation on which it was inspired, the General Data Protection Regulation – GDPR (EU), established new rules on the collection, storage, processing and sharing of personal data, imposing greater protection and rights on the holders of this data.

Thus, the law establishes the need for certain documents to demonstrate the Data Controller's compliance with current regulations. Among these, we can find the Data Protection Impact Assessment Report (DPIA).

This article aims to demonstrate that the need for prior preparation of a Data Protection Impact Assessment (DPIA) before requesting one is still, in some cases, unclear. To this end, we will delve into the following topics: 1. What is a Data Protection Impact Assessment? 2. Regarding the identification of High-Risk Processing. 3. Legitimate interest as a synonym for High Risk.

What is a Data Protection Impact Assessment Report?

The RIPD, as defined in Article 5, XXVII of the LGPD, is "documentation from the controller containing a description of the personal data processing activities that may generate risks to civil liberties and fundamental rights, as well as measures, safeguards, and risk mitigation mechanisms."

In other words, it is a document that must be prepared by the controller (that is, the entity that makes decisions regarding the processing of personal data) that describes the process of processing personal data that may generate risks to civil liberties and fundamental rights.

Its main purpose is to demonstrate the measures, safeguards, and risk mitigation mechanisms adopted to guarantee the protection of personal data, ensuring compliance of data processing with the principles and rules set forth in the LGPD (Brazilian General Data Protection Law).

The report must include, at a minimum:

1. A description of the types of data collected;
2. The methodology used for collecting and ensuring the security of information;
3. The controller's analysis regarding the measures, safeguards, and risk mitigation mechanisms adopted;
4. The controller's assessment of the measures to ensure data protection.

The creation of a Data Protection Impact Assessment (DPIA) is a tool that helps organizations identify risks in data processing and adopt preventive measures, thus ensuring greater compliance with the LGPD (Brazilian General Data Protection Law). Furthermore, it is a way to demonstrate commitment and responsibility to the protection of the personal data of data subjects.

The need for its preparation will be determined by the National Data Protection Authority (ANPD). It is generally requested in data processing situations that may pose a risk to the privacy of data subjects.

Regarding the identification of High-Risk Treatment

In this regard, it is worth highlighting the provisions of Article 10, II, § 3, of the LGPD, which affirms the possibility of the National Data Protection Authority (ANPD) requesting a Data Protection Impact Assessment (RIPD) in cases of data processing based on legitimate interest. 

Likewise, the Authority has a duty to determine this requirement in cases where the processing represents a high risk to guaranteeing the general principles of personal data protection provided for by law (Article 55-J, XIII, of Law No. 13.709/2018).

It is important to point out that, in April 2023, the ANPD (National Data Protection Authority) published on its website, Questions and Answers about the Personal Data Protection Impact Assessment Report , where it highlights the Authority's understanding regarding the need to prepare the document.

As a result, in item 3 of the questions and answers, it is evident that regardless of the hypothesis for carrying out the RIPD preparation process, it will first be necessary to verify the existence of High Risk in the data processing activity, namely:

3. In what context does the ANPD recommend that the RIPD be prepared?

As a general rule, it is recommended to prepare the RIPD (Data Protection Impact Assessment) in any context where personal data processing operations may generate a high risk to the guarantee of the general principles of personal data protection provided for in the LGPD (Brazilian General Data Protection Law) and to the civil liberties and fundamental rights of the data subject, as per article 5, item XVII, and article 55-J, item XIII, of the LGPD, which should be evaluated by the data controller.

Therefore, it is evident that there is a need to clarify the ANPD's understanding of what constitutes "High Risk". In order to answer this question, in the previously mentioned Questions and Answers, the Authority clarifies that the definition found in Article 4 of the LGPD's application regulations for small data processing agents, Resolution No. 2/2020, should be used.

Accordingly, high-risk treatment will be identified when the treatment involves at least one general criterion and one specific criterion, as follows:

• General Criteria

1. Large-Scale Treatment:
   1. "When the processing involves a significant number of data subjects, taking into account the volume of data involved, as well as the duration, frequency and geographical extent of the processing carried out."
2. Treatment that may significantly affect the interests and rights of data subjects:
   1. "When the processing may prevent the exercise of rights or the use of a service, as well as cause material or moral damage to the data subjects, such as discrimination, violation of physical integrity, the right to image and reputation, financial fraud or identity theft."

• Specific Criteria

1. Surveillance or control of areas accessible to the public;
2. Automated processing;
3. Emerging or innovative technologies;
4. Sensitive data or data concerning children, adolescents, and the elderly.

As we can see, the criteria seem to be both definitive and comprehensive at the same time, considering the wide range of definitions that can be given to the types of criteria.

Legitimate interest as a synonym for High Risk

The question regarding the need to prepare a Data Protection Impact Assessment (DPIA) prior to requesting it from the National Data Protection Authority (ANPD), when the processing is based on legitimate interest, arises due to the publication of the Preliminary Study on legitimate interest by the authority and the option to request it presented in article 10, II, §3 of the LGPD (Brazilian General Data Protection Law).

As expertly presented by Professor Matheus Sturari, paragraph 57 of the study seems to corroborate the thesis of the need to identify high risk:

57. The Data Protection Impact Assessment (DPIA) must also be included in the registration if the processing involves high risk. The DPIA may incorporate a balancing test, also containing a broader and more detailed analysis of the risks and mitigation measures adopted in the case. Furthermore, the ANPD may request the controller to prepare a Data Protection Impact Assessment (DPIA), observing commercial and industrial secrets, as provided for in Article 10, II, § 3, of the LGPD.

According to Sturari, the obligation to prepare a Data Protection Impact Assessment (DPIA) for any and all processing involving legitimate interest would raise two assumptions: “(i) the justification based on the legal basis of legitimate interest is equivalent to the identification of high risk; or (ii) the justification based on the legal basis of legitimate interest is an element that, by itself, constitutes the presence of high risk.”

Despite the above, the professor himself does not find the situation coherent, considering that equating the legal basis with High Risk would trivialize the very reason for defining legitimate interest.

Thus, it points out that in the Questions and Answers document, the ANPD also addresses "specific situations" in which it may require the preparation of a Data Protection Impact Assessment (DPIA): 

The LGPD also lists specific situations in which the ANPD may require a Data Protection Impact Assessment (DPIA), such as:

• in processing operations carried out exclusively for purposes of public security, national defense, state security, or activities related to the investigation and repression of criminal offenses (Article 4, § 3);

• when the treatment is based on the hypothesis of legitimate interest (art. 10, § 3º);

• for public officials, including a requirement regarding the publication of the RIPD (art. 32); and

• for controllers in general, regarding their processing operations, including those involving sensitive personal data (art. 38).

It is clear, then, that the possibility of preparing the document arises at various stages. However, it is important to pay attention to what will be considered mandatory to prepare prior to the request and what will only be required after the request from the Authority.

Conclusion

Understanding the need for complex and difficult-to-prepare documents such as the Data Protection Impact Assessment Report is of paramount importance for professionals working in the field, whether providing legal advice, drafting documents, or defending clients who control their data.

The continuous study of law, of new perspectives from both the empirical and ideal world, is what distinguishes a good professional from the rest. 

In order to prepare for the constant evolution of topics, especially those related to the data-driven world of the information society, IDP offers a Postgraduate Program in Digital Law and Data Protection , with professionals who work daily with the issues presented in this work.

References

STURARI, MATHEUS. RIPD for Legitimate Interest and Preliminary Study by the ANPD. Available at: Accessed on: October 23, 2023.

BRAZIL, National Authority for the Protection of Personal Data. Questions and Answers about the Personal Data Protection Impact Assessment Report. Available at: Accessed on: October 23, 2023

BRAZIL, National Authority for the Protection of Personal Data. Preliminary Study: Legal Hypotheses for the Processing of Personal Data - Legitimate Interest. Available at: Accessed on: October 23, 2023.

BRAZIL. Federal Law No. 13.709/2018. General Data Protection Law.