How to conduct an impact assessment?

elsiesilver4

Data protection impact assessment ( DPIA ) is a process of estimating the impact of processing activities undertaken on the protection of personal data.


The results of the assessment are to serve the controller to determine the appropriate measures to be applied in order to process personal data in accordance with the GDPR.


This process should be carried out before the processing of personal data begins - at the planning and design stage.


GDPR does not indicate exactly how the data protection impact assessment should look like, leaving it to the administrator's decision. The regulations only indicate minimum requirements as to its content, according to which the DPIA should include :

a systematic description of the planned processing operations and the purposes of processing, including, where applicable, the legitimate interests pursued by the controller;
assessing whether processing operations are necessary and proportionate to the purposes;
assessment of the risk of violations of the rights or freedoms of data subjects;
the measures planned to address the risk, including safeguards and security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation, taking into account the rights and legitimate interests of data subjects and other persons concerned.

Some of these elements may also be developed at the risk b2c email database analysis preparation stage.


However, a data protection impact assessment is more extensive and detailed and is more focused on minimising the undesirable effects of the processing.


It is worth remembering that the data protection impact assessment must be documented - in the event of a possible Office inspection, we must be able to prove that we have carried it out reliably (of course, if we are obliged to do so).

Interestingly, in some cases the administrator has the option to seek the opinion of the people whose data is being processed or their representatives. Using this option may be helpful if we want to learn the perspective of people on the activities related to the processing of their data and we consider that these opinions may have a significant impact on the assessment of the effects.