Digital Advertising Guidance: DPIAs under the GDPR

IAB UK & IAB Europe

Data protection impact assessments: When are they required? And what does a good DPIA process look like for the digital advertising industry?

As part of our work to address the ICO’s concerns about ad tech and real-time bidding, we have worked jointly with IAB Europe to develop this practical guide to carrying out data protection impact assessments (DPIAs). This is in the context of processing data for digital advertising generally, and for real-time bidding, in order to help companies understand their obligations and how to comply with them in practice. It explains how to incorporate the DPIA process into a company’s normal course of product design and development.

Our aim is to provide an accepted, widely adopted standard for evaluating and managing risks associated with personal data processing in the industry. 

The guidance covers:

  • What a DPIA is, as defined in the GDPR, and its purpose
  • When you must carry out a DPIA
  • How to go about a DPIA, including what the DPIA process looks like and who is involved
  • Guidance on how to assess risk and identify appropriate mitigations in the context of typical digital advertising data types and processing activities

If you have any questions about this work, please email [email protected].

DOWNLOAD THE GUIDE

Written by

IAB UK & IAB Europe

Topics

ICO report
DPIA
GDPR
Policy
ICO

Related content

""

CAP issues updated LHF guidance for consultation

Government confirms brand ads exemption in LHF ad ban

IAB UK responds to ICO call for views on regulatory approach to low-risk advertising

Reshuffle embeds digital and advertising expertise across government 

Fast forward to 2030 with Futurescape

An in-depth exploration of the attitudes, innovations and media shifts that will shape the years ahead and redefine how we advertise by the turn of the decade

Find out more