Data Protection Impact Assessment (DPIA) is used as a tool for minimizing risks relating to privacy and security of personal information during data processing activities. Typically, DPIAs are used to investigate, recognize, and mitigate potential risks to data before launching a new business endeavor or project. GDPR, under Article 35, puts emphasis on the relatively high risk to the rights and freedoms of individuals when new processes or new technology is being engaged for data processing for the first time.
These assessments take the shape of flexible processes aimed at systematically recognizing, analyzing and managing the risk potential of any data processing operation. While such assessments are necessary for compliance, they also effectively allows an organization or entity to assess the kinds and levels of risk posed by a proposed plan and whether it falls within acceptable limits of risk that can be further managed and minimized. This saves a company from potential security breaches that may expose them to fines and penalties.
Salient features of DPIA
The processors of data are required to include within the assessment detailed description of the proposed operation, its purpose, necessity and proportionality along with an assessment of the risks to the rights and freedoms of data subjects and mitigating measures. These assessments take the shape of flexible processes aimed at systematically recognizing, analyzing and managing the risk potential of any data processing operation.
The primary aim of DPIA is to:
- assess the risks potentially involved in processing data
- reduce the potential risks in processing data
- make decisions over what is an acceptable level of risk weighed against the desired results.
- allow organizations to identify and fix problems at an early stage, reducing the associated costs and damage to reputation which might otherwise occur.
Key Considerations
Need of DPIA (When is it required)
DPIA is required where data processing is likely to result in a high risk to data protection and privacy and the rights and freedoms of natural persons. This is particularly relevant when a new data processing technology is being introduced. Hence, data controllers embracing new technologies that are likely to infringe on the rights and freedoms of data subjects must, prior to any data processing, conduct a thorough assessment of the impact on data protection that such activity is likely to have. Alternatively, a DPIA may also be conducted to demonstrate compliance with the applicable data protection law. However, because of the many advantages associated with DPIAs, it is generally best practice to undertake a DPIA regardless of the circumstances
Who Conducts the DPIA
- Project managers and other managers without specialist data protection knowledge should be able to use the screening checklist to help them focus on privacy issues.
- An effective DPIA must include consultation with others who will each be able to identify different privacy risks and solutions.
- Data Protection Officer available may assist conducting PIAs and in advising those signing off DPIAs on privacy matters.
The Assessment
DPIA should include:
- A detailed description of the project as well as the purpose of the project
- An assessment of the necessity of the data processing involved and on what scale
- An assessment of all possible risks to data protection and consumer privacy
- An explanation as to how those risks will be mitigated and how the project will adhere to GDPR policies
Steps for conducting DPIA
- Identify the need for conducting a DPIA
- Describe the processing activity
- Consult stakeholders and concerned individuals if required
- Assess necessity and proportionality
- Identify and assess potential risks in the processing activity
- Derive a mitigation plan
- Signoff and record outcomes
While such assessments are necessary for compliance, they also effectively allows an organization or entity to assess the kinds and levels of risk posed by a proposed plan and whether it falls within acceptable limits of risk that can be further managed and minimized. This operations help to prevent potential security breaches that may subject the organization to fines and penalties.
