Data Protection Impact Assessment: What You Should Know

What Is DPIA (Data Protection Impact Assessment)?

A Data Protection Impact Assessment (DPIA) is a form of risk assessment. It assists with minimizing risks and identification in relation to personal information processing.

The UK Data Protection Act (DPA) of 2019, and the European Union’s General Data Protection Regulation (GDPR), demand that organizations conduct DPIA prior to carrying out specific types of data processing. The DPIA aims to ensure organizations make an effort to reduce risks related to sensitive personal information.

For example, if an organization deals with personal data, and this could impact the freedoms and rights of a data subject under the GDPR, it must conduct a DPIA. Organizations must also conduct a DPIA when they introduce new information processing systems, process or technology.

In this article:

• What Is the Purpose of a DPIA?
• Who Should Conduct a DPIA?
  • If a project introduces a great risk to personal data privacy and protection, a DPIA should be employed. Look at the DPIA Initial Screening template to see if you are required to complete a DPIA.
• Data Protection Impact Assessments Under the GDPR
• What Are the Consequences of Not Completing a DPIA?
• Benefits of Performing a DPIA
• Data Protection with Cloudian Secure Storage

Note: This article is part of a series on Data Protection.

The information provided in this article and elsewhere on this website is meant purely for educational discussion and contains only general information about legal, commercial and other matters. It is not legal advice and should not be treated as such. Information on this website may not constitute the most up-to-date legal or other information.

The information in this article is provided “as is” without any representations or warranties, express or implied. We make no representations or warranties in relation to the information in this article and all liability with respect to actions taken or not taken based on the contents of this article are hereby expressly disclaimed.

You must not rely on the information in this article as an alternative to legal advice from your attorney or other professional legal services provider. If you have any specific questions about any legal matter you should consult your attorney or other professional legal services provider.

This article may contain links to other third-party websites. Such links are only for the convenience of the reader, user or browser; we do not recommend or endorse the contents of any third-party sites.

What Is the Purpose of a DPIA?

Various legal professionals believe that conducting DPIAs is a key component of the GDPR, which generally deals with providing individuals with greater authority over their personal information and creating consistent data protection rules throughout Europe. The GDPR is applicable to the European Union—however, many organizations that are found outside the EU, but conduct their business globally, are making use of the GDPR’s terms, including DPIA requirements.

The GDPR notes that a DPIA is the controller’s responsibility, where the controller refers to the organization that decides the methods and purposes of processing information. For instance, a bank that outsources their data processing to a third-party must adhere to the GDPR and comply with DPIA requirements when needed.

Who Should Conduct a DPIA?

The individuals responsible for a given initiative need to make sure that a particular DPIA is completed, for example:

• The sponsor of the project
• The information asset provider
• The ladder of the research project

If a project introduces a great risk to personal data privacy and protection, a DPIA should be employed. Look at the DPIA Initial Screening template to see if you are required to complete a DPIA.

Data Protection Impact Assessments Under the GDPR

Article 35 of the GDPR deals with Data Protection Impact Assessment. The DPIA is a new condition under the GDPR as a component of the “protection by design” rule. Before the processing, the controller should conduct an assessment of the effect of the foreseen processing operations on the safety of individual data.

This rule applies to any instance in which the method of processing is likely to pose a significant risk to the freedoms and rights of the data subjects. Specifically, it covers processing methods that employ new technologies and takes into account the scope, nature, purposes and context of the processing.

DPIA is thus required by law according to certain conditions. The following are concrete examples of the sorts of situations that may demand a DPIA:

• Using new technologies
• Tracking individual’s behavior or location
• Methodically monitoring a publicly accessible location on a big scale
• Dealing with personal information connected to ethnic or racial origin, philosophical or religious beliefs, political opinions, genetic data, data concerning health, biometric data, etc,
• Data processing is employed to automate decisions about individuals that may have legal or otherwise significant implications
• Processing data about children
• Processing data that may lead to physical harm to the data subject if the information were leaked

Even in cases where the data being processed does not qualify as high-risk, it may still be worthwhile to carry out a DPIA to reduce your liability and to make sure best practices for data security and privacy are in place. Note that data breaches are often subject to various regulatory requirements.

Related content: Read our guide to data protection regulations and to gdpr data protection

What Are the Consequences of Not Completing a DPIA?

DPIAs are a key component of your accountability requirements. Carrying out a DPIA is a legal must for all forms of processing, including particular specified forms of processing which will probably cause great risks to the freedoms and rights of people. According to the UK GDPR, if you don’t conduct DPIA when you need to, you may experience enforcement action, in the form of a fine of up to £8.7 million, or 2% global annual turnover (whichever is higher).

By taking the risks connected to your processing into consideration, before you start, you also ensure compliance with other general requirements under UK GDPR.

The following may make your organization liable for a fine:

• Not undertaking a DPI where the processing requires a DPIA
• Implementing a DPIA in the wrong way
• Not reaching out to the ICO when needed

Benefits of Performing a DPIA

Generally speaking, ongoing use of DPIAs provides the following benefits:

• Improves the awareness of data protection and privacy issues within an organization
• Makes sure that all employees involved in creating projects consider privacy at the initial stages
• Enables the implementation of data protection by creation.
• Helps demonstrate compliance with data protection responsibilities and principles.
• Lets you isolate and solve problems at an early stage, protecting both your organization and your data subjects.

Impact on company reputation
An effective DPIA can help assure people that you are safeguarding their affairs and have minimized all possible negative impacts on them. In certain instances, the consultation process for a DPIA provides them with an opportunity to have some sway over the way that data is employed. Publishing and conducting a DPIA may also increase transparency and could make it simpler for people to know why and how your organization is utilizing their data.
This can lead to possible benefits for your organization’s relationships with people and its reputation. Carrying out a DPIA may help you create engagement and trust with the individuals making use of your services, and help you better understand their requirements, expectations and concerns.

Financial advantages
There may also be financial advantages to implementing DPIAs. Isolating an issue quickly typically means a less costly and simpler solution, and may help you avoid damage to your reputation later on. A DPIA may also minimize the continual costs of a project by reducing how much information you may collect, when possible, and creating more streamlined processes for employees.

Data Protection with Cloudian Secure Storage

Data protection requires powerful storage technology. Cloudian’s storage appliances are easy to deploy and use, let you store Petabyte-scale data and access it instantly. Cloudian supports high-speed backup and restore with parallel data transfer (18TB per hour writes with 16 nodes).

Cloudian provides durability and availability for your data. HyperStore can backup and archive your data, providing you with highly available versions to restore in times of need.

In HyperStore, storage occurs behind the firewall, you can configure geo boundaries for data access, and define policies for data sync between user devices. HyperStore gives you the power of cloud-based file sharing in an on-premise device, and the control to protect your data in any cloud environment.

Learn more about data protection with Cloudian