What is a data protection impact assessment?
A data protection impact assessment evaluates what consequences planned processing will have for the rights and freedoms of the people concerned, before the processing starts. Article 35(1) GDPR requires one where processing, by virtue of its nature, scope, context and purposes, is likely to result in a high risk. What is assessed is the harm to the person, such as discrimination or identity theft, not the harm to the company; that is the difference from a risk analysis in the ISMS.
Article 35(7) sets four minimum contents:
- a systematic description of the envisaged processing operations and purposes,
- an assessment of necessity and proportionality in relation to the purpose,
- an assessment of the risks to the people concerned,
- the measures envisaged to address the risks, including safeguards and security measures.
The controller seeks the advice of the data protection officer (paragraph 2) and, where appropriate, the views of data subjects or their representatives (paragraph 9). Where the risk changes, the controller reviews the DPIA (paragraph 11). A single assessment may cover several similar processing operations with similarly high risks (paragraph 1, second sentence).
When is a data protection impact assessment required?
The duty arises in three ways, and each is enough on its own:
| Route | Provision | What applies |
|---|---|---|
| Listed cases | Art. 35(3) | profiling with decisions producing legal effects (a), large-scale processing of special categories under Art. 9 or of criminal-offence data under Art. 10 (b), systematic large-scale monitoring of publicly accessible areas (c) |
| Supervisory authority's mandatory list | Art. 35(4) | for companies in Germany, the list of the German Data Protection Conference (DSK) for the private sector (in German), version 1.1 of 17 October 2018, with 17 entries |
| Own assessment | Art. 35(1) | high risk likely, even where no listed case and no list entry fits |
A list of processing that needs no DPIA under paragraph 5 is an option for the authority, not a duty. Processing that appears on no list remains subject to paragraph 1.
Threshold assessment: how to check a processing operation
The preliminary check, which the German supervisory authorities call a Schwellwertanalyse, runs in three steps for each processing activity:
- Check the three listed cases in paragraph 3 and the 17 entries of the mandatory list. One match is enough.
- Count how many of the nine criteria in the WP 248 rev.01 guidelines of the former Article 29 Working Party apply (list below).
- Under WP 248, in most cases a controller can consider that processing meeting two criteria requires a DPIA; in some cases one is enough. This counting rule is not a legal norm, and the assessment under paragraph 1 remains yours.
The nine criteria under WP 248:
- evaluation or scoring
- automated decisions with legal or similarly significant effect
- systematic monitoring
- sensitive or highly personal data
- large-scale processing
- matching or combining datasets
- vulnerable data subjects, including employees
- innovative use or new technological solutions
- processing that prevents data subjects from exercising a right or using a service or contract
Record the result with reasons, and especially when no DPIA is needed.
Fictional example: two processing operations at a company with 200 employees.
| Processing | Criteria under WP 248 | Mandatory list | Result |
|---|---|---|---|
| Ticket system for IT support with employees' names and requests | vulnerable data subjects (employees) | no entry | one criterion, no listed case: no DPIA; record the reasons in the records of processing |
| The same ticket system, which additionally analyses handling times per employee for performance appraisal | evaluation, systematic monitoring, vulnerable data subjects | no. 8 may apply: large-scale processing of employees' behavioural data to assess their work | three criteria: carry out a DPIA |
Because a single new analysis lifts the same software over the threshold, repeat the preliminary check whenever a system gets a new purpose, not only when it is introduced.
What follows from a DPIA duty?
- Designate a data protection officer. Under § 38(1) sentence 2 of the German Federal Data Protection Act (BDSG), this applies to any processing subject to a DPIA, regardless of how many people work on it.
- Consult the supervisory authority beforehand where the DPIA indicates that the processing would result in a high risk in the absence of measures taken to mitigate it (Article 36(1) GDPR).
- Implement the measures and test their effectiveness before the processing is formally approved. This is how the German Data Protection Conference describes steps 12 and 14 of its process in Kurzpapier Nr. 5 (in German, status 17 December 2018).
- Fine risk: failing to carry out a required DPIA breaches Article 35. Article 83(4)(a) provides for up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher.
Systems of a processing operation in the Rizzqo asset register
In Rizzqo, the asset register models, for the scope of a DPIA, which systems carry the personal data of a processing operation. Every primary asset of type information carries a confidentiality rating and the personal-data flag. The supporting assets, meaning the applications, IT systems and external providers' services that process this information, inherit exactly these two attributes from the primary assets they support.
The mitigating measures apply to these systems. An owner can be assigned to each asset; the owner answers the requirements for the measures and finalises each answer with name and timestamp.