How Do I Carry Out a Data Protection Impact Assessment Under the GDPR?

The European Union (EU)’s General Data Protection Regulation (GDPR) came into effect in May 2018, affecting many Australian businesses. If your business needs to comply with the GDPR, you may also need to conduct a Data Protection Impact Assessment (DPIA) at some stage. You must conduct a DPIA before undertaking a particularly risky project that collects or uses data. This article will explain:
- which types of businesses may need to conduct a DPIA;
- when you may need to conduct a DPIA; and
- what “high risk” processing of data is.
Controllers and Processors
‘Processing’ data refers to all the possible ways a business might gather, use and distribute data. Controllers (i.e. businesses that decide what information to process, and how they will process it) may need to carry out DPIAs. Processors (i.e. businesses that process information at the request of a controller) will need to assist the controller in carrying out a DPIA if the controller asks them to. Controllers should specify their processors’ obligations, including the obligation to assist with a DPIA, in their data processing agreement.
Therefore, you should understand the importance of DPIAs and how to carry one out if you are a controller under the GDPR or a processor who processes data on behalf of a controller.
When Do You Need to Carry Out a DPIA?
If your business is a controller under the GDPR, you may need to carry out a DPIA prior to undertaking a new processing project that is considered to be ‘high risk’. If you are undertaking multiple projects in which you will process data in a similar way, you may only need to conduct a single assessment.
The purpose of the assessment is to determine if this type of processing falls within the bounds of the GDPR. The table below sets out different types of high-risk processing.
Type of high-risk processing of data | Examples of this processing |
Implementing a new technology |
|
Large scale monitoring activities |
|
Systematic and large scale processing |
|
Processing large amounts of special categories of data |
|
Processing the data of vulnerable individuals |
|
Many of these types of high-risk processing require large-scale data processing. The meaning of ‘large scale’ does not yet have a formal definition. However, controllers should consider factors such as the:
- number of individuals involved;
- volume of data; and
- duration of the processing.
Importantly, you do not have to carry out a DPIA for every processing activity, or for your day-to-day operations (particularly if you have already ensured that these activities comply with the GDPR).
What Does an Assessment Look Like?
There is no prescribed form for a DPIA. However, templates are available online. Essentially, the DPIA is a written description of the processing you plan to undertake, including:
- its nature and scope;
- an assessment of the reasons for processing the data in the way you intend to; and
- an assessment of the potential risks to individuals.
When completing a DPIA, controllers may also need to ask certain individuals for their views on the proposed processing.
For example, if you are an employer and you plan to conduct high-risk processing in relation to your employees, you should ask them for their views on the project. Controllers should consider the probability of risk and the potential severity of the impact on individuals.
Finally, your assessment should describe how you will mitigate these risks and ensure compliance with the GDPR.
Key Takeaways
If your business is a controller under the GDPR, you may need to carry out a DPIA before undertaking a ‘high risk’ processing project. Carrying out a DPIA demonstrates that you intend to comply with the GDPR. For many businesses, complying with the GDPR can seem complicated. However, the right professionals can help you to understand and meet your obligations.
LegalVision cannot provide legal assistance with this topic. We recommend you contact your local law society.
How Franchisors Can Avoid Misleading and Deceptive Conduct
Wednesday 18 May | 11:00 - 11:45am
Online
New Kid on the Blockchain: Understanding the Proposed Laws for Crypto, NFT and Blockchain Projects
Wednesday 25 May | 10:00 - 10:45am
Online
How to Expand Your Business Into a Franchise
Thursday 26 May | 11:00 - 11:45am
Online
Day in Court: What Happens When Your Business Goes to Court
Thursday 2 June | 11:00 - 11:45am
Online
How to Manage a Construction Dispute
Thursday 9 June | 11:00 - 11:45am
Online
Startup Financing: Venture Debt 101
Thursday 23 June | 11:00 - 11:45am
Online
Was this article helpful?
We appreciate your feedback – your submission has been successfully received.
About LegalVision: LegalVision is a commercial law firm that provides businesses with affordable and ongoing legal assistance through our industry-first membership.
By becoming a member, you'll have an experienced legal team ready to answer your questions, draft and review your contracts, and resolve your disputes. All the legal assistance your business needs, for a low monthly fee.