DPIA
What is a DPIA?
A process to help you identify and minimise the data protection risks of a project.
What does a good DPIA look like?
A good DPIA helps you to demonstrate that:
you have considered the risks related to your intended processing; and
you have met your broader data protection obligations.
DPIA checklist
When do you need a DPIA?
The GDPR says you must do a DPIA if you plan to:
use systematic and extensive profiling with significant effects;
process special category or criminal offence data on a large scale; or
systematically monitor publicly accessible places on a large scale.
Your DPIA must:
describe the nature, scope, context and purposes of the processing;
assess necessity, proportionality and compliance measures;
identify and assess risks to individuals; and
identify any additional measures to mitigate those risks.
The ICO also requires you to do a DPIA if you plan to:
use innovative technology (in combination with any of the criteria from the European guidelines);
use profiling or special category data to decide on access to services;
profile individuals on a large scale;
process biometric data (in combination with any of the criteria from the European guidelines);
process genetic data (in combination with any of the criteria from the European guidelines);
match data or combine datasets from different sources;
collect personal data from a source other than the individual without providing them with a privacy notice (‘invisible processing’);
track individuals’ location or behaviour;
profile children or target marketing or online services at them; or
process data that might endanger the individual’s physical health or safety in the event of a security breach.
How do you conduct a DPIA?
Why are DPIAs important?
DPIAs are a legal requirement for processing that is likely to be high risk.
Under GDPR, failure to carry out a DPIA when required may leave you open to enforcement action including a fine of up to €10 million, or 2% global annual turnover if higher.
Consistent use of DPIAs increases the awareness of privacy and data protection issues within your organisation.