PIA and DPIA name two versions of the same exercise: thinking about the privacy consequences of something before you build it. The privacy impact assessment is the older, general practice. The data protection impact assessment is the specific form the European regulation requires in named circumstances, with named contents and a consequence if the risk cannot be reduced.
The difference that matters
A PIA is a method. You can run one on anything, at any depth, and nobody checks. A DPIA is an obligation that bites where processing is likely to result in a high risk to people's rights and freedoms, and the regulation names the contents: a systematic description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks, and the measures planned to address them. If the residual risk is still high after the measures, the supervisory authority has to be consulted before you start.
When a DPIA is required
The text names three cases: systematic and extensive automated evaluation producing legal or similarly significant effects, large scale processing of special category or criminal offence data, and systematic monitoring of a publicly accessible area on a large scale. Supervisory authorities publish their own lists of operations requiring one. For most small companies none of these applies, which is worth establishing once and writing down rather than re-litigating with every new feature.
What a useful one contains at small scale
Even where none is required, the short version is cheap and genuinely useful before a new tool or feature: what personal data does this involve, why is it necessary, who gets access, what is the worst realistic outcome for a person, what reduces it, and what is left. Half a page, written before the build, filed with the register. It is the same thinking that produces a good retention period and a correct legal basis, done once at the point where changing the design is still free.
Questions people ask about pia dpia
Does a small company ever need a DPIA?
Rarely, but check the criteria against anything new that profiles people, tracks location or handles health data. The exercise of checking is short; the consequence of not checking is discovering it after launch.
Who signs it off?
The controller. Where a data protection officer exists, their advice is sought and recorded. At small scale the named privacy owner signs and files it with the register.
Is a PIA the same thing in the US?
The term is used in US federal practice for agency assessments and in private sector practice as a general method. Neither is the specific European obligation, though the content overlaps heavily.