A DPIA (data protection impact assessment) is required if a process is likely to result in a high risk to the rights and freedoms of data subjects – any natural person (i.e. a living individual) whose personal data is processed by the organisation. Data subjects might be employees, contractors, etc., as well as customers.