Lesson 5.27: A full data protection impact assessment
Under GDPR Article 35, processing likely to result in a high risk to people's rights needs a data protection impact assessment (DPIA) before it starts. A good DPIA is a design tool, not paperwork: it describes the processing, tests whether each piece of data is necessary and proportionate, assesses risks to the people concerned (not to the company), and records measures and the remaining risk. If a high risk remains, the supervisory authority must be consulted first (Article 36). In the lab you assess a telematics system for Northwind's delivery drivers: screen it, cut unnecessary data, check retention, read the risks and measures, and write the conclusion.
20 min
You will learn to
- Decide when a DPIA is required
- Test necessity and proportionality per data field
- Assess risks to individuals, not the company
- Record measures and residual risk
- Know when prior consultation applies
Key terms
- DPIA
- Data protection impact assessment, required by GDPR Art. 35 for likely high-risk processing.
- Necessity and proportionality
- Each data item must be needed for the purpose and the least intrusive way to achieve it.
- Residual risk
- The risk to individuals that remains after measures.
- Prior consultation
- Consulting the supervisory authority before processing when high risk remains (Art. 36).
- EDPB
- European Data Protection Board, which issues guidelines on applying GDPR.
← Insider risk: lawful and proportionate · All lessons · On-call load and burnout, measured →