Data Protection Impact Assessment (DPIA)
In practice, for a UK buyer
The paragraph above is the neutral answer. This is the part a vendor glossary leaves out.
Named here for completeness and for one honest disclosure: no completed impact assessment exists for AdBuyMCP's exposure ledger, and it is listed on our own checklist as outstanding rather than done. The machinery that would feed one — per-source lawful basis, per-key legal grading, a documented retention rule — exists; the assessment itself does not.
Goes deeper: What is not held
What this one connects to
Most confusion in media buying comes from two adjacent terms being used interchangeably, so these are the neighbours worth reading next.
Legitimate Interests Assessment (LIA)
The documented three-part test of purpose, necessity and balancing that underpins any reliance on legitimate interests. It must be completed and retained before an organisation may rely on legitimate interests as its lawful basis for processing personal data.
UK GDPR
The United Kingdom's data protection regime, retaining the structure of the EU General Data Protection Regulation. Requires a lawful basis for processing personal data and gives individuals rights over data about them.
Lawful basis
The legal ground relied on to process personal data, of which six exist under UK GDPR and at least one must be identified before processing begins. In advertising the two that matter are consent and legitimate interests, and the basis has to be settled before the processing, not after.
Identity resolution
The process of deciding that two different identifiers refer to the same person or household, so that behaviour seen under one can be joined to the other.
More on compliance and clearance
UK data protection and UK advertising clearance: what has to be true before an ad runs.
45 minutes. Bring a real brief and we compile it live. You describe one audience and watch it compile into seven targeting specifications, each with the score for how much of the definition survived.
Talk it through