How Do I Carry Out a Data Protection Impact Assessment Under the GDPR?

The European Union (EU)’s General Data Protection Regulation (GDPR) came into effect in May 2018, affecting many Australian businesses. If your business needs to comply with the GDPR, you may also need to conduct a Data Protection Impact Assessment (DPIA) at some stage. You must conduct a DPIA before undertaking a particularly risky project that collects or uses data. This article will explain:

• which types of businesses may need to conduct a DPIA;
• when you may need to conduct a DPIA; and
• what “high risk” processing of data is.

Controllers and Processors

‘Processing’ data refers to all the possible ways a business might gather, use and distribute data. Controllers (i.e. businesses that decide what information to process, and how they will process it) may need to carry out DPIAs. Processors (i.e. businesses that process information at the request of a controller) will need to assist the controller in carrying out a DPIA if the controller asks them to. Controllers should specify their processors’ obligations, including the obligation to assist with a DPIA, in their data processing agreement. 

Therefore, you should understand the importance of DPIAs and how to carry one out if you are a controller under the GDPR or a processor who processes data on behalf of a controller.

When Do You Need to Carry Out a DPIA?

If your business is a controller under the GDPR, you may need to carry out a DPIA prior to undertaking a new processing project that is considered to be ‘high risk’. If you are undertaking multiple projects in which you will process data in a similar way, you may only need to conduct a single assessment. 

The purpose of the assessment is to determine if this type of processing falls within the bounds of the GDPR. The table below sets out different types of high-risk processing. 

Many of these types of high-risk processing require large-scale data processing. The meaning of ‘large scale’ does not yet have a formal definition. However, controllers should consider factors such as the:

• number of individuals involved;
• volume of data; and 
• duration of the processing. 

Importantly, you do not have to carry out a DPIA for every processing activity, or for your day-to-day operations (particularly if you have already ensured that these activities comply with the GDPR). 

What Does an Assessment Look Like?

There is no prescribed form for a DPIA. However, templates are available online. Essentially, the DPIA is a written description of the processing you plan to undertake, including:

• its nature and scope; 
• an assessment of the reasons for processing the data in the way you intend to; and
• an assessment of the potential risks to individuals. 

When completing a DPIA, controllers may also need to ask certain individuals for their views on the proposed processing. 

Finally, your assessment should describe how you will mitigate these risks and ensure compliance with the GDPR.

Key Takeaways 

If your business is a controller under the GDPR, you may need to carry out a DPIA before undertaking a ‘high risk’ processing project. Carrying out a DPIA demonstrates that you intend to comply with the GDPR. For many businesses, complying with the GDPR can seem complicated. However, the right professionals can help you to understand and meet your obligations.