What is a DPIA?
A Data Protection Impact Assessment (DPIA) is a process designed to help organizations identify and minimize the data protection risks of a project or plan. It is required under Article 35 for processing operations that are likely to result in a high risk to the rights and freedoms of individuals.
When is a DPIA Required?
A DPIA must be carried out when processing is likely to result in a high risk, particularly when:
- Using new technologies
- Systematic and extensive evaluation or scoring, including profiling with legal or similarly significant effects
- Large scale processing of special categories of data or data relating to criminal convictions
- Systematic monitoring of publicly accessible areas on a large scale (e.g., CCTV)
Supervisory authorities must publish lists of processing operations requiring a DPIA. Organizations should also conduct a DPIA for other high-risk processing operations.
Contents of a DPIA
According to Article 35(7), a DPIA must contain:
- A systematic description of the envisaged processing operations and purposes
- An assessment of the necessity and proportionality of the processing
- An assessment of the risks to the rights and freedoms of data subjects
- Measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure protection of personal data
Consultation with DPO and Data Subjects
Organizations must consult their DPO when carrying out a DPIA. Where appropriate, they should also seek the views of data subjects or their representatives.
Prior Consultation with Supervisory Authority
Under Article 36, if a DPIA indicates that processing would result in a high risk if the controller does not take measures to mitigate the risk, the organization must consult the supervisory authority before processing begins.
Review and Update
DPIAs should be kept under review and updated when there is a change to the risk presented by the processing operation.