A Data Protection Impact Assessment (DPIA) is a process to help you identify and minimize the data protection risks of a project. The DPIA is an ongoing process, regularly applied to personal data processing, identifying, and mitigating risks. The DPIA is a part of the European Union (EU) General Data Protection Regulation (GDPR) compliance activities.

What is a DPIA?

A DPIA is a way for you to systematically and comprehensively analyze your processing and help you identify and minimize data protection risks.

DPIAs should consider compliance risks and broader threats to individuals’ rights and freedoms, including the potential for any significant social or economic disadvantage. The focus is on the potential for harm – to individuals or society at large, whether physical, material, or non-material.

To assess the level of risk, a DPIA must consider both the likelihood and severity of individuals’ impact. A DPIA does not have to indicate that all risks have been eradicated. But it should help you document them and assess whether or not any remaining risks are justified.

DPIAs are a legal requirement for processing that is likely to be high risk. But an effective DPIA can also bring broader compliance, financial and reputational benefits, helping you demonstrate accountability and building trust and engagement with individuals.

A DPIA may cover a single processing operation or a group of similar processing operations. A group of controllers can do a joint DPIA.

It’s essential to embed DPIAs into your organizational processes and ensure the outcome can influence your plans. A DPIA is not a one-off exercise. You should see it as an ongoing process that is subject to regular review.

Benefits of completing a DPIA include:

• Building trust and transparency with data subjects and stakeholders
• An essential tool in minimizing privacy and security risk
• Ensuring practical implementation of privacy for businesses
• Vital to increasing awareness of privacy across organizations
• Supporting the identification of any data use concerns early in a project
• Actions and project decisions are less likely to be privacy intrusive or have any negative impacts on individuals
• Increasing compliance with the GDPR and other privacy regulations

When is a DPIA required under GDPR?

All activities related to handling personally identifiable data belong to high-risk operations. This can broadly include any automated monitoring, collection, and evaluation of personal data, massive processing specific information like an individual’s healthcare or criminal records, etc.

Article 29 of the EU Working Party Guidelines for GDPR lists activities, which, if misused or compromised, can have a negative impact.

Some EU member states (and the UK) create national ‘Blacklists’ and ‘Whitelists’ to guide which processes do and do not require DPIA.

When in a project lifecycle should a DPIA be conducted?

The DPIA should be carried out “prior to the processing” (GDPR Articles 35(1) and 35(10), recitals 90 and 93). It is generally good to carry out a DPIA as early as practical in the processing operation design. It may not be possible to conduct a DPIA at the inception of the project. Project goals and understanding of how the project will operate must be identified before assessing the data protection risks involved.

For some projects, the DPIA may need to be a continuous process and be updated as the project moves forward. A DPIA may need to be updated once processing has started is not valid for postponing or not carrying out a DPIA.

What is required to complete a DPIA?

A DPIA should provide specific information about the intended processing. That information includes:

• Assessment of the necessity and proportionality of data processing in relation to the purpose of the DPIA.
• Assessment of the risks to the rights and freedoms of natural persons.
• Intended measures to address the risks, including safeguards, security measures, and mechanisms to ensure personal data protection and demonstrate compliance with the GDPR.
• Purposes of processing
• Categories of personal data processed
• Data retention
• Location and transfers of personal data
• Data sharing with third-party subprocessors
• Data sharing with independent third-parties
• Data subject rights

As part of our GDPR service portfolio, our experienced consultants can support you in implementing all aspects of your organization’s DPIA requirements.

While many organizations are dreading GDPR compliance, in the end, it will be a net positive for everyone. The GDPR will force companies to closely examine their data governance policies and controls and enact proactive cyber security measures to prevent breaches.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.