DPIA as a Risk Management tool

Data Protection Impact Assessment (DPIA) can be defined as a risk management tool: it helps an organization to identify, assess and minimise any “high” privacy risks in new systems, technologies or processes. Performing a DPIA is an effective tool to operationalise Privacy by Design. This means that carrying out a DPIA helps to embed privacy into product and service development. Also, DPIA is useful when assessing the privacy impacts of the continuous usage of existent systems, technologies or processes.

Involve relevant stakeholders to DPIA process
It is good to keep in mind that DPIA continuous process and it aims to identify risks and solutions, rather than a one-time produced report that demonstrates compliance. Therefore, all the relevant stakeholders should be involved in the DPIA process. DPIA helps to assist relevant stakeholders to make an informed decision regarding business operations involving personal data processing.

Many reasons to carry out DPIA
In addition to demonstrate compliance and proof that your organization has met the mandatory requirements of GDPR’s, there are also other reasons to perform Data Protection Impact Assessment. First, a well-organized DPIA creates communication amongst stakeholders. Second, DPIA can protect the reputation of the organization by avoiding too intrusive products or services being published. Third, DPIA is a helpful tool in collaborating with internal and even external parties: DPIA is an internal check that must be passed and later this can be used in communication with authorities.

Process Overview of Data Protection Impact Assessment (DPIA)
The starting point in a DPIA process is the Records of Processing activities. This documentation would serve as a basis for the initial “threshold” assessment. After this primary risk review, if it appears that the processing activity is likely to result in high risks for the individuals’ rights, the organization should conduct a Data Protection Impact Assessment (DPIA). Also, there can be follow-up actions, such as prior consultation with the supervisory authority, in cases where the chosen controls are not able to sufficiently mitigate the risks.

A genuine DPIA report should typically include, at a minimum:

• A systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;
• An assessment of the necessity and proportionality of the processing operations in relation to the purposes; and
• An assessment of the risks to the rights and freedoms of data subjects.

There are various risks assessment methodologies and frameworks that can help your organization in mapping the risks. The methodology used should be appropriate for the organization’s needs and it should be built on the following key items:

• Risk analysis from the view of the data subjects;
• Likelihood and severity assessment;
• Residual risk after the implementation of mitigating measures. 

Four practical tips for carrying out Data Protection Impact Assessment (DPIA)

1. Design the right overall workflow and DPIA methodology for your project.
2. Do it as team-work by involving all the relevant stakeholders that understand the project management cycle. Integrate this to other existent processes
3. Remember that DPIA is not a one-time activity aimed at ticking a box; Ensure DPIA is a living document and is consulted during the lifecycle of the project;
4. Revisit the DPIA once a year/ regularly.

Use a third party for carrying out the DPIA for you to ensure:

• Objectivity in risk assessment;
• Transparency for increased accountability;
• Training and useful insights for future DPIA processes.

What is a DPIA?

A DPIA is a process designed to help you systematically analyze, identify and minimize the data protection risks of a project or plan and when done properly helps you assess and demonstrate how you comply with all of your data protection obligations.

It does not have to eradicate all risk, but should help you minimize and determine whether or not the level of risk is acceptable in the circumstances, taking into account the benefits of what you want to achieve.

DPIAs are designed to be a flexible and scalable tool that you can apply to a wide range of sectors and projects. Conducting a DPIA does not have to be complex or time-consuming in every case, but there must be a level of rigor in proportion to the privacy risks arising.

Why are DPIAs important?

A DPIA brings broader compliance benefits, as it can be an effective way to assess and demonstrate your compliance with all data protection principles and obligations. However, DPIAs are not just a compliance exercise. An effective DPIA allows you to identify and fix problems at an early stage, bringing broader benefits for both individuals and your organization. Conducting and publishing a DPIA can also improve transparency and make it easier for individuals to understand how and why you are using their information. It helps you to build trust and engagement with the people using your services, and improve your understanding of their needs, concerns and expectations.

There can also be financial benefits. Identifying a problem early on generally means a simpler and less costly solution, as well as avoiding potential reputational damage later on. A DPIA can also reduce the ongoing costs of a project by minimizing the amount of information you collect where possible, and devising more straightforward processes for staff.

You should not view a DPIA as a one-off exercise to file away. A DPIA is a ‘living’ process to help you manage and review the risks of the processing and the measures you’ve put in place on an ongoing basis. You need to keep it under review and reassess if anything changes.

In particular, if you make any significant changes to how or why you process personal data, or to the amount of data you collect, you need to update the DPIA for any new risks. An external change to the wider context of the processing should also prompt you to review your DPIA. 

A DPIA must assess the level of risk, and in particular whether it is ‘high risk’. Assessing the level of risk involves looking at both the likelihood and the severity of the potential harm.

Techniti provides multiple services that can meet your organizations needs to assess applicable laws and the required steps for compliance. You can find out more by contacting us using our contact form listed here.