A DPIA is required under GDPR regulations when there is a high risk of harm to an individual if their personal data were breached. The DPIA assesses many areas including how an why the personal data is being processed, legal basis for processing, data minimisation controls, sharing with 3rd parties and other areas.