7 principles of the GDPR.
Lawfulness, Fairness, and Transparency; Purpose Limitation; Data
Minimisation; Accuracy; Storage Limitations; Integrity and
Confidentiality; and Accountability.
Links:
[Link]
gdpr-a-comparison/
[Link]
[Link]
[Link]
%20Protection%20Act%[Link]
[Link]
9010-6657a9351496
DPIA and GDPR
Implementation of a Data Protection Impact Assessment (DPIA) is an
important aspect of the General Data Protection Regulation
(GDPR) accountability obligations of an organization.
Under the GDPR, DPIA is a legal requirement if a data controller envisages
a processing activity that is “likely to result in a high risk to the rights and
freedoms of natural persons” (GDPR, Article 35).
First Steps of a DPIA
A DPIA should be performed after the details of a new data processing
project have been established and planned out, but before the project is
actually launched. The GDPR lays out some specific instructions as to what
a DPIA should include:
A detailed description of the project as well as the purpose of the
project
An assessment of the necessity of the data processing involved
and on what scale
An assessment of all possible risks to data protection and
consumer privacy
An explanation as to how those risks will be mitigated and how the
project will adhere to GDPR policies
1. Describe Data Flows
Start by describing how data will be handled throughout the project. Detail is key here,
so be as thorough as possible in examining your data processing activities from start to finish.
Here are some questions to ask as you compile this section:
How will the data be collected?
How will the data be used?
Where and how will it be stored?
What is the source of the data?
Will it be shared with any third party and if so, why?
2. Data Scope
Next, outline the scope of data processing. Here you will need to delve
deeply into the data itself, describing the types of data that will be
collected, the quantity of data, and so on. This section will differ according
the company and project involved, but may cover the following points:
What categories of data will be collected?
Will it involve special or sensitive categories of data?
What quantity of data will be collected and how many consumers will
be affected?
Is the data processing localized to a specific area?
How long will the data be retained?
3. Purposes of Data Processing
Describe what the project is expected to achieve through data
processing. What are the benefits for the data controller and how will
consumers be affected?
4. Context of the Processing and Data Subjects
Here is where you start asking some of the more difficult questions. Think
about the consumers who will be affected and how this data
processing may affect them. This is also a good time to consider the
context of the data processing project itself and its position in the industry.
Here are some questions to ask and answer during this phase:
What is your legal basis for collecting user data? Do you have
appropriate consent measures in place?
Is your consumer base vulnerable in any way, such as in the case of
children or mentally ill individuals?
Has this type of processing been performed before? Are there similar
technologies already in place?
Have any security flaws been identified in similar projects?
5. Document Proper Consultation
Where appropriate and possible, data controllers are required to consult
with consumers on their views about the new project. It may also be
necessary to consult with your Data Protection Officer, data processors, or
information security experts to understand the full implications and risks of
the project.
If such consultations are appropriate and possible, you will need to
document them in this section.
6. Specific Compliance Measures
Any major data processing project will need to address GDPR compliance
from the outset. After all, that's one reason you are conducting a DPIA in
the first place. In this section, you will analyze whether or not data
processing activities are compliant with the GDPR and other
international privacy laws.
This is also a good place to describe what measures the business will be
taking to ensure compliance at each phase of the project. Some topics
that will need to be approached include:
What are the legal bases for the data processing? Will these bases
remain valid throughout the duration of the project?
Is data processing necessary to achieve the overall purpose?
Is there any way to reduce or minimize the use of consumer data
throughout the project?
How will consumer rights be upheld?
How will the data controller confirm that third-party processors also
comply with privacy laws?
How will international data transfers be legally performed?
7. Identify and Evaluate Data Protection Risks
This section is considered the most important issue to explore in any DPIA.
It is where data protection and privacy are analyzed from all
angles. Potential threats to privacy and data security must be
considered and listed.
Although it is impossible to predict every potential risk scenario in a
generalized article like this one, here are some points to review during risk
assessment:
Are proper controls and safeguards in place to prevent or reduce
unsafe data processing practices due to internal employee errors?
Is there a possibility that the project might evolve and change the
way data is being processed beyond the scope of current legal
bases?
Has security software been properly updated and audited against
potential data theft or hackers?
If special categories of sensitive data or vulnerable individuals are
subject to data processing, is the project following GDPR-mandated
stipulations to protect that data?
Could the merging of anonymized data sets lead to individuals being
inadvertently identified?
Have data retention policies been outlined, and how will data be
disposed of when it no longer serves its purpose?
Is the information being stored in a location with adequate data
security?
Of course, the potential risks to data protection will be conditional to the
type of project and data processing that's involved. If you feel that your
development team has not or cannot sufficiently identify potential threats to
data protection, it may be necessary to consult the services of an
information security expert or an attorney that specializes in privacy law.
8. Risk Mitigation Strategies
The next step is to formulate solutions and mitigation strategies to
reduce or eliminate the risks identified in the assessment phase. All of
the previously identified risks to data protection must be addressed in this
section, as well as viable mitigation techniques for each.
Many data controllers choose to combine risk assessment and mitigation
strategies into one comprehensive table that is easy to read and
understand.