What is a Data Protection Impact Assessment (DPIA)?

A data protection impact assessment (DPIA) in accordance with Art. 35 GDPR assesses the effects of processing operations on personal data. Doing so minimizes risks, protects data subjects' rights, and helps to avoid heavy fines.

Why is a Data Protection Impact Assessment so Important?

Legal Compliance

The DPIA is required by law. Violations can result in fines of up to €20 million.

Risk Minimization

Identify and minimize privacy risks to avoid reputational damage and loss of trust.

Privacy by Design

Data protection should be integrated into projects from the outset to ensure long-term security.

How Often Should You Conduct a DPIA?

A Data Protection Impact Assessment is not a one-time process. New technologies, changes in data processing or new risks require regular review and updates. This is how you ensure that your data processing always meets the latest requirements and that the rights of those affected are protected. With a continuous DPIA, you stay on the safe side legally and build trust in the long term.

When is a Data Protection Impact Assessment required?

According to Article 35 of the GDPR, a data protection impact assessment is required if the data processing poses a high risk to the rights of the data subjects. The following nine criteria help with the assessment:

Evaluate or classify affected parties

Creating profiles or categorizing people can affect their rights and freedoms, especially if sensitive decisions are based on them.

Automated decision-making

Automated processes such as AI-supported decisions or algorithms carry risks of discrimination or erroneous decisions.

Observation, monitoring or control of data subjects

The surveillance of individuals using cameras, GPS or other technologies can significantly endanger their privacy.

Processing of confidential or particularly personal data

The processing of data such as health, social or financial data requires special care, as a loss of this information can have far-reaching consequences for those affected.

Large-scale data processing

When large amounts of data are processed, the risk of data breaches increases, as does the potential impact on those affected.

Data sets are merged from two or more processing steps

Combining data sources can create new risks, especially when linking sensitive information.

Processing of data of data subjects in need of protection

Groups such as children, employees, or people with special protection needs are particularly vulnerable to data protection violations because they often have less control over their data.

Use of advanced technologies or solutions such as facial recognition, IoT, AI, etc.

Innovative technologies such as facial recognition, IoT or AI bring new data protection risks with them, as their effects are often difficult to predict.

Processing prevents data subjects from exercising rights or fulfilling services/contracts.

If data processing hinders the exercise of rights or access to services, there is a significant risk for those affected.

How to Carry Out a Data Protection Impact Assessment

1

Identification of the Processing Activities

The DPIA begins with the identification of all processing activities that could pose a high risk to the rights and freedoms of natural persons.

2

Assessment of Data Protection Risks

Evaluate the potential risks associated with these processing activities. Our experts will help you identify these risks and assess their consequences.

3

Measures to Minimize Risks

Develop measures to mitigate the identified risks. Our team of experts, consisting of lawyers, will support you in selecting suitable measures.

4

Completion and Documentation

The DPIA results are documented to demonstrate GDPR compliance. Our team ensures that everything is complete and legally compliant.

I need help!

Who Should Carry Out a Data Protection Impact Assessment?

In your company, if you are responsible for data processing, it is your responsibility as the "data controller". However, you don't have to handle this on your own.

Whether internal or external, a data protection officer is your most important partner when it comes to performing a DPIA accurately and in compliance with the law. An experienced expert can help you overcome any challenge efficiently, securely, and without any headaches.

Advantages of External Support

In-house

Third-party (with heyData)

Expertise

Specialized knowledge or experience is often lacking internally.

With heyData, you have a team of experts at your side that can draw on years of experience in the field of data protection.

Time required

Conducting a DPIA internally ties up valuable resources and extends project times.

By outsourcing to heyData, you save time and can concentrate on your core business.

Legal security

Internal errors or gaps increase the risk of fines and reputational damage.

With heyData, you benefit from maximum compliance security so that you can avoid legal consequences.

Hear it From Our Customers

"heyData impressed us with their digital software solution and expertise. Like us, heyData is a digital pioneer in a rather traditional and less digital industry. heyData is a strong partner for the BRZ Group."

Markus Schobert

Head of Customer Service at BRZ Gruppe

"heyData is a great help for us and makes the topic of data protection really easy. We are very satisfied with the digital audit, the online training and the customer support."

Leonard von Kleist

CTO & Co-Founder at Hive Technologies GmbH

"I value this feature for its ability to simplify supplier risk assessment. It is an indispensable tool for anyone dealing with data compliance in the European Union and Switzerland."

Jan Stephan

Head of Legal Affairs at Learnship

"As a customer, we have only had good experiences with heyData's support and communication. Questions were answered in detail, responses were always prompt and personal 1-1 support is also no problem."

Roman Georgi

Director Of Customer Support at AMBOSS

“What sets heyData apart is its responsiveness and rapid implementation.”

Sandra Scherzer

Legal department at Bioland

"We always receive competent and prompt advice from heyData and have so far been able to find a satisfactory solution to every question relating to the GDPR or data protection in general."

Nikolai

CTO at Instaffo GmbH

FAQ

Failure to conduct a required data protection impact assessment can result in significant penalties under the GDPR, including fines of up to €10 million or 2% of the global annual turnover of the previous fiscal year, whichever is greater.

The DPIA usually consists of three main parts:

A systematic description of the planned data processing operations and the purposes of the processing.
An assessment of the necessity and proportionality of the processing operations in relation to the purpose.
An assessment of the risks to the rights and freedoms of data subjects and the mitigation measures, safeguards and mechanisms envisaged to mitigate those risks.

A DPIA is necessary when data processing involves a high risk to the rights and freedoms of data subjects, such as sensitive data. The processing of sensitive data requires a careful assessment of the associated risks and potential impact on privacy to ensure compliance with data protection requirements, such as:

Comprehensive processing of biometric data to uniquely identify natural persons
Comprehensive processing of genetic data
Comprehensive processing of data on the location of data subjects.

The data protection officer plays an essential role in the performance of the DPIA. He or she advises the controller or processor on how to conduct the DPIA, reviews the results, and ensures that the DPIA is conducted in compliance with the GDPR.

Not all companies are obliged to conduct a DPIA. The obligation to conduct a DPIA arises from Article 35 of the GDPR and only concerns processing operations that involve a high risk to the rights and freedoms of natural persons, in particular when using new technologies.

Although it is possible to perform a DPIA yourself, it is often advisable to consult a data protection law expert or a data protection officer due to the complexity of the requirements of the GDPR.

The GDPR provides a set of guidelines for conducting a DPIA. It is important that you familiarize yourself with these guidelines and incorporate them into your DPIA. In addition, consulting with an external data protection expert or data protection officer can help ensure compliance.

Data Protection Impact Assessment (DPIA)

Table of contents