The General Data Protection Regulation (GDPR) contains a number of provisions that are there to ensure a reliable, secure and confidential processing of personal data by the data controller and processor. Personal data processing activities should ensure the systematic protection of personal data and the real possibility of exercising the rights that data subjects have according to the GDPR. These tasks are carried out in accordance with the provisions of the Regulation, which regulate the obligations of the controller and processors. Among such provisions, the role of data protection impact assessment stands out as an institute. Its task is a systematic analysis of the nature of personal data processing from the perspective of security and confidentiality risks of processing data. The purpose of the impact assessment is to document the risks for the security of personal data processing, and the activities of the controller and processor, in order to eliminate or reduce these risks to an acceptable level. The implementation of an impact assessment on data protection is a legally defined obligation for controllers in the case of new, particularly risky processing, or in the case when the nature of the risk for existing processing changes. In practice, data controllers are guided by the impact assessment guidelines prepared by the competent European and national supervisory authorities. Also, specialized digital solutions are available in order to achieve uniform, high-quality implementation of these procedures.The paper provides an overview of the practical issues and challenges of implementing the data protection impact assessment procedure, with a review of some of the available digital tools and their applicability. Also, recommendations are given for improvements for better compliance with the General Regulation in terms of data protection impact assessment requirements.