Reading time: 4 minutes

The European Union (EU)’s General Data Protection Regulation (GDPR) came into effect in May 2018, affecting many Australian businesses. If your business needs to comply with the GDPR, you may also need to conduct a Data Protection Impact Assessment (DPIA) at some stage. You must conduct a DPIA before undertaking a particularly risky project that collects or uses data. This article will explain:

  • which types of businesses may need to conduct a DPIA;
  • when you may need to conduct a DPIA; and
  • what “high risk” processing of data is.

Controllers and Processors

‘Processing’ data refers to all the possible ways a business might gather, use and distribute data. Controllers (i.e. businesses that decide what information to process, and how they will process it) may need to carry out DPIAs. Processors (i.e. businesses that process information at the request of a controller) will need to assist the controller in carrying out a DPIA if the controller asks them to. Controllers should specify their processors’ obligations, including the obligation to assist with a DPIA, in their data processing agreement

Therefore, you should understand the importance of DPIAs and how to carry one out if you are a controller under the GDPR or a processor who processes data on behalf of a controller.

When Do You Need to Carry Out a DPIA?

If your business is a controller under the GDPR, you may need to carry out a DPIA prior to undertaking a new processing project that is considered to be ‘high risk’. If you are undertaking multiple projects in which you will process data in a similar way, you may only need to conduct a single assessment. 

The purpose of the assessment is to determine if this type of processing falls within the bounds of the GDPR. The table below sets out different types of high-risk processing. 

Type of high-risk processing of data Examples of this processing 
Implementing a new technology 
  • Finger print technology
  • Facial recognition software 
  • Internet of Things applications
Large scale monitoring activities
  • Monitoring of public activities (e.g. a local council setting up a CCTV system or a railway provider setting up surveillance at multiple stations) 
  • Tracking individuals’ location and behaviour  
Systematic and large scale processing
  • Profiling (i.e. automated processing of a large number of individuals’ characteristics)
  • Automated decision making that could result in discrimination or exclusion of a particular group
  • Monitoring of individuals’ (e.g. employees’) internet usage 
Processing large amounts of special categories of data
  • Biometric or health information
  • Criminal details or history
  • Genetic data
  • Political opinions 
Processing the data of vulnerable individuals
  • Children 
  • Employees
  • Mentally ill individuals

Many of these types of high-risk processing require large-scale data processing. The meaning of ‘large scale’ does not yet have a formal definition. However, controllers should consider factors such as the:

  • number of individuals involved;
  • volume of data; and 
  • duration of the processing. 

Importantly, you do not have to carry out a DPIA for every processing activity, or for your day-to-day operations (particularly if you have already ensured that these activities comply with the GDPR). 

What Does an Assessment Look Like?

There is no prescribed form for a DPIA. However, templates are available online. Essentially, the DPIA is a written description of the processing you plan to undertake, including:

  • its nature and scope; 
  • an assessment of the reasons for processing the data in the way you intend to; and
  • an assessment of the potential risks to individuals. 

When completing a DPIA, controllers may also need to ask certain individuals for their views on the proposed processing. 

For example, if you are an employer and you plan to conduct high-risk processing in relation to your employees, you should ask them for their views on the project. Controllers should consider the probability of risk and the potential severity of the impact on individuals. 

Finally, your assessment should describe how you will mitigate these risks and ensure compliance with the GDPR.

Key Takeaways 

If your business is a controller under the GDPR, you may need to carry out a DPIA before undertaking a ‘high risk’ processing project. Carrying out a DPIA demonstrates that you intend to comply with the GDPR. For many businesses, complying with the GDPR can seem complicated. However, the right professionals can help you to understand and meet your obligations. 

LegalVision cannot provide legal assistance with this topic. We recommend you contact your local law society.

Webinars

How Franchisors Can Avoid Misleading and Deceptive Conduct

Wednesday 18 May | 11:00 - 11:45am

Online
Ensure your franchise is not accused of misleading and deceptive conduct. Register for our free webinar today.
Register Now

New Kid on the Blockchain: Understanding the Proposed Laws for Crypto, NFT and Blockchain Projects

Wednesday 25 May | 10:00 - 10:45am

Online
If you operate in the crypto space, ensure you understand the Federal Government’s proposed licensing and regulation changes. Register today for our free webinar.
Register Now

How to Expand Your Business Into a Franchise

Thursday 26 May | 11:00 - 11:45am

Online
Drive rapid growth in your business by turning it into a franchise. To learn how, join our free webinar. Register today.
Register Now

Day in Court: What Happens When Your Business Goes to Court

Thursday 2 June | 11:00 - 11:45am

Online
If your business is going to court, then you need to understand the process. Our free webinar will explain.
Register Now

How to Manage a Construction Dispute

Thursday 9 June | 11:00 - 11:45am

Online
Protect your construction firm from disputes. To understand how, join our free webinar.
Register Now

Startup Financing: Venture Debt 101

Thursday 23 June | 11:00 - 11:45am

Online
Learn how venture debt can help take your startup to the next level. Register for our free webinar today.
Register Now

About LegalVision: LegalVision is a commercial law firm that provides businesses with affordable and ongoing legal assistance through our industry-first membership.

By becoming a member, you'll have an experienced legal team ready to answer your questions, draft and review your contracts, and resolve your disputes. All the legal assistance your business needs, for a low monthly fee.

Learn more about our membership

Our Awards

  • 2020 Excellence in Technology & Innovation Finalist – Australasian Law Awards
  • 2020 Employer of Choice Winner – Australasian Lawyer
  • 2021 Fastest Growing Law Firm - Financial Times APAC 500
  • 2020 AFR Fast 100 List - Australian Financial Review
  • 2021 Law Firm of the Year - Australasian Law Awards
  • 2019 Most Innovative Firm - Australasian Lawyer