Data Protection Impact Assessment under the GDPR

With the introduction of the General Data Protection Regulation (GDPR), companies are required to exercise increased care in handling personal data. A key component of this process is the data protection impact assessment (DPIA). Our experts are ready to help you conduct and implement a successful DSFA.

Get in touch now!

Table of contents

What is a Data Protection Impact Assessment (DPIA)?

A Data Protection Impact Assessment (DPIA) is a procedure used to evaluate the impact of certain processing operations on the protection of personal data. It is carried out to minimize the risks posed by data processing and to ensure that all data protection requirements are met.

Why is the DPIA so important?

The data protection impact assessment (DSFA) is of key importance for several reasons:

  • Legal compliance: DSFA is a legal requirement under Article 35 of the General Data Protection Regulation (GDPR). Non-compliance can result in significant penalties, including fines of up to €20 million or 4% of annual global turnover in the previous fiscal year, whichever is greater.
  • Risk mitigation: DSFA enables companies to identify potential data protection risks at an early stage and develop measures to mitigate these risks. This reduces the risk of data privacy breaches and associated negative consequences, such as reputational damage and loss of trust.
  • Data privacy through technology design and data privacy-friendly default settings: The DPIA supports the principle of Privacy by Design and Privacy by Default by ensuring that data protection considerations are integrated into new projects, processes or products from the outset.
     

When is a data protection impact assessment necessary according to the GDPR?

Article 35(1) of the GDPR states that a DPIA is necessary where the proposed processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons (in particular, using new technologies, by virtue of their nature, their scope, their circumstances, and their purposes).

What should the DPIA contain and how often should it be conducted?

Article 35(7) of the GDPR states that a DSFA must include the systematic description of the intended processing operations, the assessment of the necessity and proportionality of the processing in relation to the purpose, and an evaluation of the risks to the rights and freedoms of the data subjects.

Our team of data protection experts has prepared a detailed guide on how to conduct a DSFA. From identifying data processing activities to documenting and reviewing your process, we'll walk you through it step-by-step.

Step 1: Identify data processing activities

The DPIA begins by identifying any processing activities that could pose a high risk to the rights and freedoms of individuals.

Step 2: Assess the data protection risks

Assess the potential risks associated with these processing activities. Our experts will help you identify these risks and assess their consequences.

Step 3: Mitigate the risks

Develop measures to mitigate the identified risks. Our expert lawyers will assist you in selecting appropriate measures.
 

Need help with the DPIA?

Free initial consultation!

Frequently asked questions

View our prices

The frequency of carrying out a data protection impact assessment depends on several factors, including the type of data processing, the occurrence of changes or new risks, and the privacy relevance of the processing. In general, it is advisable to review and update the DPIA on a regular basis.

Article 35(2) of the GDPR states that the "controller" shall conduct the DPIA. As a rule, the data controller is responsible for carrying out the data protection impact assessment and for involving the advice of the data protection officer, internal or external.

Failure to conduct a required data protection impact assessment can result in significant penalties under the GDPR, including fines of up to €10 million or 2% of the global annual turnover of the previous fiscal year, whichever is greater.

The DPIA usually consists of three main parts:

  • A systematic description of the planned data processing operations and the purposes of the processing.
  • An assessment of the necessity and proportionality of the processing operations in relation to the purpose.
  • An assessment of the risks to the rights and freedoms of data subjects and the mitigation measures, safeguards and mechanisms envisaged to mitigate those risks.

The data protection officer plays an essential role in the performance of the DPIA. He or she advises the controller or processor on how to conduct the DPIA, reviews the results, and ensures that the DPIA is conducted in compliance with the GDPR.

Not all companies are obliged to conduct a DPIA. The obligation to conduct a DPIA arises from Article 35 of the GDPR and only concerns processing operations that involve a high risk to the rights and freedoms of natural persons, in particular when using new technologies.

Although it is possible to perform a DPIA yourself, it is often advisable to consult a data protection law expert or a data protection officer due to the complexity of the requirements of the GDPR.

The GDPR provides a set of guidelines for conducting a DPIA. It is important that you familiarize yourself with these guidelines and incorporate them into your DPIA. In addition, consulting with an external data protection expert or data protection officer can help ensure compliance.