Data Protection Impact Assessments and the GDPR
What is a DPIA (data protection impact assessment)?
The GDPR (General Data Protection Regulation) and DPA (Data Protection Act) 2018 require you to carry out a DPIA before certain types of processing. This ensures that you can mitigate data protection risks.
For instance, if processing personal information is likely to result in a high risk to data subjects’ rights and freedoms, you should carry out a DPIA.
You should also conduct one when introducing new data processing processes, systems or technologies.
Looking for comprehensive guidance and practical advice on complying with the GDPR? Read our bestselling Implementation and Compliance Guide.
Why are DPIAs important?
A risk-based approach ensures you do not waste resources attempting to mitigate threats that are unlikely to occur or will have little effect.
When required, not carrying out a DPIA could leave you open to enforcement action from the ICO (Information Commissioner’s Office) – the UK’s data protection authority. This could include a fine of up to 2% of your organisation’s annual global turnover or €10 million – whichever is greater.
Regular data privacy impact assessments also support the GDPR’s accountability principle. This helps your organisation prove its compliance with the Regulation – both to the supervisory authority and other stakeholders.
When must you conduct a DPIA?
- Use systematic and extensive profiling with significant effects.
- Process special category or criminal offence data on a large scale.
- Systematically monitor publicly accessible places on a large scale.
The ICO’s screening checklist will help you decide whether to carry out a DPIA.
European data protection impact assessment guidelines
DPIAs and privacy by design
- Potential problems are identified at an early stage.
- Addressing issues early will often be easier and cheaper.
- Awareness of privacy and data protection will be increased across the organisation.
- Organisations will be less likely to breach the GDPR.
- Actions are less likely to have a negative impact on individuals.
How to conduct a DPIA
- Consult your DPO (data protection officer) if you have one.
- Check whether your processing requires a DPIA.
- Use the ICO screening checklist.
- If you decide a DPIA is not necessary, record your decision and the reasons for it.
- If you decide a DPIA is required, proceed to step 2.
Document the nature, scope, context and purpose of the processing, including:
- How you collect, store and use the data.
- Who the data is shared with.
- Security measures you will use to protect the data.
- The nature, volume, variety and sensitivity of the data.
- The extent, frequency and duration of the processing.
- The number of data subjects involved.
- Where you obtained their data.
- Whether any of the data subjects are children or other vulnerable people.
- Your legitimate interests, where relevant.
- Obtain and record the views of individuals or their representatives unless there is a good reason not to. This might include a general public consultation.
- Ask data processors for assistance, where necessary.
- Consult relevant internal stakeholders, such as security teams.
- Seek independent external advice, such as legal advice, where appropriate.
Consider and record:
- Whether your plans help achieve your purpose; and
- If the same result could be achieved any other way.
Include details of how you will ensure compliance with the GDPR’s data processing principles, including:
- Your lawful basis for processing;
- How you will provide data subjects with privacy information.
- How you will enable data subjects’ rights.
- Any measures to ensure data processors comply with the law.
Consider how data subjects will be affected by your data processing. The impacts of processing might include:
- Financial loss or economic disadvantage.
- Restrictions on the data subject’s ability to access services or opportunities. or
- Social impacts.
Also think about how they might be affected by different types of data breaches, such as:
- Illegitimate access to personal data.
- Loss or modification of personal data.
Evaluate the likelihood and severity of security risks and whether they fall within acceptable levels.
For each risk you have identified, record its source and consider options for reducing it. For instance:
- Reducing the data retention period.
- Implementing additional technical security measures.
- Anonymising or pseudonymising data.
- Record how each risk has been treated and the level of residual risk.
- If there are still high risks you cannot mitigate, you should consult the ICO before you start processing.
After signing off, you should integrate the DPIA’s outcomes into your project plan and monitor its ongoing performance.
Who should conduct a DPIA?
The DPIA should be conducted by those with appropriate expertise and knowledge of the project, usually the project team.
Under the GDPR, it is necessary for any organisation with a designated DPO (data protection officer) to seek their advice. This advice and the decisions taken should be documented as a part of the DPIA process.