What Are LIA and DPIA in Data Protection?

Under the General Data Protection Regulation (GDPR) and, in Spain, the LOPDGDD, it is not enough to “mean well” or to “use public data”. If you process personal data, you must be able to justify why you do it, what for, what impact it may have on people and what measures you apply to protect their rights.

Two common tools for documenting that analysis are the LIA (Legitimate Interest Assessment) and the DPIA (Data Protection Impact Assessment).

What is a LIA (Legitimate Interest Assessment)

A LIA is an analysis used when an organization intends to base a data processing activity on the legal basis of legitimate interest. Its purpose is to show, in writing, that this interest can override the rights and freedoms of the people affected, and that the processing is reasonable and proportionate.

What a LIA is for

A LIA helps you answer, in a documented way, questions such as:

• What specific legitimate interest is being pursued?
• Is it really necessary to process personal data to achieve that goal?
• How does the processing affect people, and what reasonable expectations might they have?
• What safeguards are applied to reduce the impact (clear information, right to object, data minimization, etc.)?

When a LIA is usually needed

A LIA is usually relevant when the processing is not based on consent or on a contract and you want to justify it by legitimate interest. In practice, it often comes up in activities such as B2B commercial prospecting, the use of professional contact details or the use of information published in publicly accessible sources, provided there is a justification and appropriate measures in place.

Important: legitimate interest is not automatic. It depends on the context, the type of data, the purpose, the relationship with the data subject and the mitigation measures you apply.

What is a DPIA (Data Protection Impact Assessment)

A DPIA (Data Protection Impact Assessment) is a deeper analysis carried out when a processing activity may entail a high risk to people's rights and freedoms. Its goal is to identify risks, assess their severity and likelihood, and define concrete measures to reduce them before the processing begins.

What a DPIA is for

A DPIA helps you to:

• Describe the processing clearly (data, purpose, flows, recipients, retention periods, etc.).
• Assess the necessity and proportionality of the processing.
• Detect risks for individuals (loss of control, discrimination, exposure, impersonation, etc.).
• Define technical and organizational measures to mitigate those risks.
• Determine the residual risk after applying those measures.

When a DPIA may be mandatory

A DPIA may be mandatory when the processing is especially intrusive or intensive, for example (as a guide only):

• Large-scale processing.
• Profiling or systematic evaluation of individuals with significant effects.
• Use of new technologies with uncertain impacts.
• Combining large volumes of data or multiple sources.
• Systematic observation or monitoring.

Important: there is no universal rule that fits every case. The obligation to carry out a DPIA depends on the context and the level of risk, and usually requires a specific analysis.

Key differences between LIA and DPIA

• LIA: focuses on justifying the use of legitimate interest as a legal basis.
• DPIA: focuses on identifying and mitigating high risks of the processing.

In some projects you may need both: a LIA to justify the legal basis and a DPIA to document risk management when the processing is more sensitive or intensive.

A practical note on “templates”

Even if models or guideline frameworks exist, neither the LIA nor the DPIA should be treated as a mere formality. For them to have real value (and to be defensible before a DPO or a supervisory authority), they must reflect the specific processing, its purposes, the data involved and the measures applied.

This content is for informational purposes only and does not constitute personalized legal advice.

If your case is cold email

If your activity includes commercial prospecting by email (for example, cold email), it is especially important to properly document the applicable legal basis and the measures for transparency, minimization and respect for the right to object. And if you want to run cold email campaigns, you can do it with Mailerfind.