Brian Rutledge — May 2, 2018 — May 2, 2018
We’ve made it to #7 in our 10-part GDPR blog series. In this blog post, we tackle Data Protection Impact Assessment (DPIA) and what it may mean for your organization.
The Chapter Explained
GDPR’s Article 35 is all about the DPIA.
Here’s a quick summary:
- GDPR mandates a DPIA for high-risk, data-sensitive projects, “where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.”
- The Data Protection Office (DPO) is responsible for overseeing the DPIA – “The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment.”
How do I Achieve Compliance?
Compliance will vary for each company. Two aspects of the DPIA, however, are pretty clear: assess high-risk projects with new applications of technology and consult your DPO.
Pointers to get started:
- Determine if your organization/project processes data that is likely to result in a high risk to the rights and freedoms of natural persons.
- In particular, the DPIA is required if the project involves:
- Profiling Processing.
- Systematic monitoring of a publicly accessible area on a large scale.
- Automated processing, including profiling, on which decisions are based that could have legal implications.
What are your concerns about the GDPR? Add them to the comments below.
Digital & Social Articles on Business 2 Community
(50)
