A data protection impact assessment (DPIA) should be completed at the outset of any project, or change to an existing system or process, that involves the collection or handling of personal ...