Data Protection Impact Assessment under the GDPR

A Data Protection Impact Assessment (DPIA) according to Art. 35 GDPR is a procedure used to assess the impact of certain processing operations on the protection of personal data. It is carried out to minimize the risks associated with data processing and to ensure that all data protection requirements are met. A practical example shows the importance of this procedure: by carrying out a data protection impact assessment, companies can reduce the risk of liability in the event of data leaks, cyberattacks or other data protection breaches. It also helps to avoid high fines from data protection authorities, which can occur if the rights of data subjects are not taken into account. Overall, the data protection impact assessment helps minimize both legal and financial consequences and strengthens the trust of data subjects.

The Data Protection Impact Assessment (DPIA) is of key importance for several reasons:

• Legal compliance: DPIA is a legal requirement under Article 35 of the General Data Protection Regulation (GDPR). Non-compliance can result in significant penalties, including fines of up to €20 million or 4% of annual global turnover in the previous fiscal year, whichever is greater.
• Risk mitigation: DPIA enables companies to identify potential data protection risks early and develop measures to mitigate these risks. This reduces the risk of data breaches and associated negative consequences, such as reputational damage and loss of trust.
• Data privacy through technology design and data privacy-friendly default settings: The DPIA supports the Privacy by Design and Privacy by Default principle by ensuring that data protection considerations are integrated into new projects, processes, or products from the outset. 
   

Article 35(1) of the GDPR states that a DPIA is necessary if the planned processing of personal data is likely to result in a high risk to the rights and freedoms of natural persons. To assess the risk of data processing, a group of experts has compiled a list of 9 criteria that increase the risk. 

9 Criteria for a High-Risk Level for Data Protection

1. Evaluation or classification of data subjects
2. Automated decision making
3. Observation, monitoring or control of data subjects (Article 35(3)(c) GDPR)
4. Processing of confidential or particularly personal data
    
   • Special categories of personal data within the meaning of Article 9 (1) or Article 10 GDPR
   • Health data (Section 67 (1) SGB X)
   • Social data
   • Financial data
5. Data processing on a large scale
6. Data sets are merged from two or more processing operations
7. Processing data of vulnerable data subjects
   
   
   • Children
   • Employees
   • Citizens with special protection needs (e.g. mentally ill persons, asylum seekers, senior citizens, and patients)
   • Affected persons where there is an unequal balance of power
8. Use of advanced technologies or solutions such as facial recognition, IoT, AI, etc.
9. Processing prevents data subjects from exercising rights or fulfilling services/contracts

A Data Protection Impact Assessment is required if the risk to data subjects is high and at least two criteria are met Supervisory authorities are obliged to publish positive lists listing the necessary processing operations. Processing activities that meet only a few criteria can also pose a high risk and therefore also require a case-by-case assessment. 

Article 35(7) of the GDPR states that a DPIA must include a systematic description of the intended processing operations, assessing the necessity and proportionality of the processing in relation to the purpose, and evaluating the risks to the rights and freedoms of the data subjects.

Our team of data protection experts has prepared a detailed guide on conducting a DPIA. From identifying data processing activities to documenting and reviewing your process, we'll walk you through it step-by-step.

Step 1: Identify data processing activities

The DPIA begins by identifying any processing activities that could pose a high risk to the rights and freedoms of individuals.

Step 2: Assess the data protection risks

Assess the potential risks associated with these processing activities. Our experts will help you identify these risks and assess their consequences.

Step 3: Mitigate the risks

Develop measures to mitigate the identified risks. Our expert lawyers will assist you in selecting appropriate measures. 

As companies increasingly introduce new technologies and cloud structures, a data protection impact assessment is useful to evaluate and mitigate the risks associated with the introduction of new technologies.

Practical example: Development of a health app by a technology company

A DPIA becomes relevant if your company works with health data or plans to develop systems or apps that process sensitive data. As health data is particularly worthy of protection, the data protection requirements are particularly high at this point. It therefore not only helps to meet the legal requirements but also strengthens users' trust in the security of their data.