A DPA is an assessment that identifies and weighs the benefits versus potential risks to consumers that result from certain processing of personal data. Under VCDPA, a DPA must be conducted for the following activities: the sale of personal data, when processing sensitive personal data, when processing personal data for targeted advertising, when processing personal data for certain profiling purposes, and instances where processing presents a heightened risk of harm to consumers. To learn how to utilize Microsoft products, services, and administrative tools to conduct a DPA, see Data Protection Impact Assessment for the GDPR.