Data Privacy Impact Assessment

Under the GDPR, conducting a DPIA is mandatory when personal data processing is likely to result in high risks to individuals’ rights and freedoms. DPIAs are essential for identifying and mitigating potential risks before they impact individuals’ privacy. 

The data controller is primarily responsible for conducting a DPIA since they determine the purposes and means of processing personal data. If the processing is likely to result in high risks, the controller must carry out a DPIA and consult the relevant authority if risks cannot be mitigated. The data processor, on the other hand, processes data on behalf of the controller and must assist by providing necessary information but is not responsible for performing the DPIA itself. In summary, the controller is responsible for the DPIA, while the processor supports the controller in the process. 

There are several key scenarios when a DPIA is essential under the GDPR, as outlined below: 

•  When introducing new data processing technologies or methodologies, such as new features or products, which may change how personal data is processed. If these changes involve high-risk activities like large-scale data analysis or AI, a DPIA helps identify and mitigate privacy risks early on.  

• When working with customers, especially in industries dealing with sensitive data, a DPIA shows your commitment to data protection and compliance. Many customers may request DPIAs as part of their due diligence. 

•  Lastly, GDPR requires organizations to review their DPIAs periodically, at least annually or whenever significant changes occur.  

To perform a DPIA follow the steps below to ensure compliance with privacy regulations and protect personal data.  

Step 1: Perform the DPIA 

• The person responsible for overseeing the DPIA should be your Privacy Officer (PO) or Data Protection Officer (DPO).  

•  A DPIA can be accessed in the Compleye Online Templates Section. It is a Word document designed to comply with the necessary DPIA standards. It includes formal fields to be filled out, such as the owner’s name, dates, and other essential details. 

• Start the DPIA by providing general information about the project or data processing activity. Some of this information may come from previous sources, such as a GDPR overview or privacy assessment, but remember that the DPIA needs to be specific to the particular project, product, or data scope you’re assessing. This section should reflect a thorough and complete analysis, taking into account all the risks and preventive measures that may apply. 

•  The second part of the DPIA involves assessing the risks. You will need to classify potential risks and document the measures already in place to mitigate these risks. Consider the impact of the processing and the existing controls that minimize risks. It’s important to have some mitigation measures documented so that you can classify any residual risks (those that remain after mitigation) as low, medium, or high. 

• If you classify any residual risks as high, you must document an improvement plan to address these risks. This improvement should be added to the section of the template that corresponds to the residual risk, so customers are aware of the actions being taken. 

•  Any improvements identified during the assessment will be processed in Step 2 of the process, which will be completed online. 

•  Once the DPIA is complete, review and finalize the document. Obtain approval from the relevant stakeholders, including those at the C-level, to ensure that everyone involved is aware of the risks and the mitigation strategies in place. 

Step 2: Process Your Findings in the Compleye Online System 

Once the DPIA is finalized and approved, the next step is to implement the actual improvements in Compleye Online. This is the final step and can be carried out by your Compliance Officer. 

To begin, simply click on the ‘Create New DPIA’ button located at the bottom left of the page in Compleye Online. This will allow you to enter the necessary details and start the process of implementing the improvements identified. 

When you click on the ‘Create New DPIA’ button in Compleye Online, a new window will open where you can upload the finalized DPIA document. Please note that once the document is uploaded, it cannot be deleted, but it can be downloaded whenever needed. The DPIA card will be automatically named based on the date the document is uploaded. 

If you have multiple documents related to the DPIA, there is an option to upload additional documents. However, it is important to upload the main DPIA document first to ensure the correct order and organization of your files. 

After creating the DPIA in Compleye Online, you can add the findings by using the term “reducing of risk” and specifying the potential risk that was identified during the assessment. This helps in clearly documenting the risk mitigation efforts and the associated risks. 

Additionally, if there are any other relevant documents that need to be attached, you can upload them under the ‘Attachments’ tab. While this is not mandatory, it can be helpful for providing additional context or supporting materials. 

When adding a finding in Compleye Online, an option to create an improvement will automatically appear (in blue). 

 When you create an improvement, a new pop-up screen will appear. The finding will already be pre-filled, tagged with DPIA, so it’s clear where the improvement originated. 

You will then need to: 

• Assign an Owner: the individual responsible for implementing the improvement. 

• Set a Due Date: the estimated date by which the first expected results should be achieved. 

• By documenting and assigning improvements, you ensure proper follow-through and demonstrate proactive steps towards enhancing data protection practices.
  

Once all fields are addressed and the necessary information is filled in, click the ‘Create Improvement’ button. This will automatically generate the improvement, assign it a unique ID, and add it to the ‘Improvements Section’ in Compleye Online, allowing you to track and manage the improvement process efficiently. 
 

The DPO/PO will monitor the progress of all improvements during the monthly compliance meeting to ensure that the improvements are on track. 

Once an improvement is completed, it will be marked with a green check-box tick in the tab, along with the date it was completed and the person who closed the improvement. Before starting a new DPIA, always check if the findings from your previous DPIA have been addressed in any closed improvements.