RIPD: what the Personal Data Protection Impact Report is and how to prepare it

RIPD stands for Relatório de Impacto à Proteção de Dados Pessoais (Personal Data Protection Impact Report), the document the LGPD (Brazil's General Data Protection Law) provides for situations where data processing may create risk to the civil liberties and fundamental rights of data subjects. In practice, it is the report that shows the company stopped, looked carefully at what it is doing with people's data and assessed the risks before rolling out a system, a campaign or an artificial intelligence project. Anyone who has taken part in a data project knows this kind of pause rarely happens on its own. It usually comes after a scare, an audit or a customer requirement.

What the RIPD is and where it appears in the LGPD

The RIPD is provided for in Article 5, item XVII, and Article 38 of the General Data Protection Law. The law defines the report as the documentation that describes the personal data processing activities capable of creating risk to civil liberties and fundamental rights, as well as the measures, safeguards and risk mitigation mechanisms adopted by the company.

In practice, the RIPD answers three simple questions. What personal data is being processed. Why that processing may create risk. And what the company is doing to reduce that risk. Written like that it looks simple, but most companies get stuck on the very first question, because they don't know precisely what personal data they have, in how many systems it appears and who has access to it.

When the company is required to prepare the RIPD

The LGPD does not require every company to produce a RIPD all the time. The report is required when the National Data Protection Authority requests it, and it is recommended whenever the processing involves a high volume of sensitive data, the use of new technology, behavioral profiling, automated decisions about people or the combination of datasets that increases the risk of re-identification.

A common example appears in artificial intelligence projects applied to customers. The company wants to train a model to predict purchase behavior, combining CRM data, service history and third-party data. That is exactly the kind of processing that calls for a RIPD before going into production, because it involves profiling and automated decision-making on personal data. The mistake I see often is the technology area treating it as a legal detail and only calling the privacy team after the model is already running.

How to prepare a RIPD in practice

Producing a RIPD that really works as protection, and not just paper to file away, goes through four steps.

The first is mapping the personal data involved in the process. What data is collected, where it comes from, in which system it is stored and for how long. This is where most RIPD projects hit a wall, because this step depends on an up-to-date inventory of personal data, which in turn depends on an organized data catalog. Without knowing where the data is, there is no impact report that holds up.

The second step is identifying the legal basis of each processing activity, and here it is worth revisiting the ten legal bases provided in the LGPD to make sure the processing is properly supported, not just justified after the fact.

The third is the risk analysis itself. What harm can happen if that data leaks, is misused or leads to an unfair decision about the person. This is where the company's data classification comes in, because the risk level of a CPF (Brazil's individual taxpayer ID) is different from the risk of geolocation data or health data.

The fourth is defining the mitigation measures, which range from encryption and access control to mandatory human review of automated decisions. The RIPD does not eliminate risk, it documents that the company knows the risk and did something about it.

Who is responsible for the RIPD inside the company

The data protection officer (DPO) normally leads the preparation of the RIPD, but cannot do it alone, and that is a common trap. I have seen RIPDs turn into a generic document, copied from a ready-made template, because the DPO tried to fill everything in without involving the people who actually operate the data day to day.

A RIPD that works is born from a conversation among the DPO, the legal team, the technology area that supports the systems and the data steward or data owner from the business area involved. That combination is what actually knows where the data originates, where it travels and who makes decisions based on it. Without that team together, the RIPD becomes a writing exercise, and not a risk management instrument.

What is the relationship between the RIPD and master data governance

Here is the point few people connect. The RIPD is, in essence, a data governance exercise applied to privacy. It requires data lineage, to know the path the data takes between systems. It requires a data dictionary, so everyone understands the same field the same way. And it requires organized master data, because a duplicated or poorly standardized customer master makes it practically impossible to say with confidence how many people have their data processed and where.

Companies that already have a mature data governance program do the RIPD in a fraction of the time, because much of the mapping work is already done. Companies that treat privacy as a topic isolated in legal, with no connection to the data program, end up redoing the mapping for every request, and the RIPD is never really up to date.

Which tools help with the RIPD

There is no specific tool on the market called RIPD, but the document relies on data cataloging and mapping tools, such as Collibra, Alation and Microsoft Purview, which help locate where personal data is spread across the company. On the privacy side, privacy management and GRC solutions, such as OneTrust and equivalent platforms, help document processing activities, keep the RIPD versioned and connect each process to its legal basis. The important point is that the tool organizes the information, but whoever decides what counts as a relevant risk is still the data and privacy team working together.

How to learn to prepare a RIPD

For those who want to go deeper, the path goes through understanding the LGPD in practice, not just the text of the law, and through knowing the data management body of knowledge described in the DAMA-DMBOK, which treats privacy and governance as connected disciplines. DAMA's CDMP certification is a good reference for those who want to formalize that knowledge, as are courses geared toward training data protection officers. The most valuable learning, however, usually comes from really taking part in the preparation of a RIPD inside a company, sitting with legal, IT and the business at the same table.

The career opportunities tied to the RIPD

Demand for professionals who can move between privacy and data governance only grows. Companies of all sizes need people who understand both the text of the LGPD and the real architecture of the systems, able to translate a legal requirement into an executable data process. That profile, which mixes legal, technical and business knowledge, tends to evolve toward positions such as data protection officer, governance analyst and, in larger companies, toward leadership roles in data and privacy.

Main questions about the RIPD

Is the RIPD mandatory for every company? No. It is mandatory when the ANPD (Brazil's data protection authority) requests it and is recommended whenever data processing involves high risk, such as profiling, automated decisions or a large volume of sensitive data.

Who can require a RIPD from a company? The National Data Protection Authority can request the report at any time, and corporate customers also often require evidence of a RIPD in contracts and due diligence processes.

Does the RIPD have to be published? There is no general obligation to publish it, but the company must be able to present it if requested by the ANPD or by a data subject, under Article 38 of the LGPD.

What is the difference between the RIPD and the personal data inventory? The personal data inventory is the survey of what data exists and where it is. The RIPD uses that inventory as a basis, but goes further, assessing the risk of each processing activity and the mitigation measures adopted.

How often should the RIPD be updated? Whenever data processing changes in a relevant way, such as the arrival of a new technology, a new data supplier or a change in the purpose of collection. Mature companies review the RIPD periodically, not only when something changes.

MDM Academy

This kind of connection between privacy, governance and master data is exactly what we teach at MDM Academy, 4MDG's school of governance and master data. The goal is not to train only those who write policy, but those who know how to turn a legal requirement into a data process that works in practice, with real examples from purchasing, master record, SAP and AI projects that I lived through over more than twenty-five years of career. If you work with data, privacy, master records or governance and want to move beyond theory, it is worth getting to know MDM Academy or joining the Data Club, our community of professionals who discuss these topics every day.

Conclusion

The RIPD is not bureaucracy isolated in legal. It is a portrait of how well the company really knows its own data. A company that doesn't know where its customer, supplier and employee data is cannot write an honest RIPD, only a facade document. And that should worry managers more than it does today, because the risk doesn't disappear when the report looks good on paper. It disappears when the data governance behind it is real.