The data protection impact assessment (DPIA) is a tool associated with GPDR that is used to determine the level of protection a data needs within an organization. Protection is determined by finding potential risks that might negatively affect data within the organization. In this post we will look at the benefits of conducting a DPIA, assessing when to conduct an assessment, and a brief look at the process for completing a DPIA.

Benefits

As mentioned earlier, conducting a DPIA allows an organization to document risk. Documenting risk allows for strategies to be developed to reduce the said risk. Other benefits include allowing an organization to assess the cost or level of a particular risk. Lastly, a DPIA can provide unique insights into specific data protection needs and risks.

In general, the DPIA provides the initial data needed to develop a roadmap for supporting data protection within an institution. As such, this is a critical first step in a complex process.

When to do DPIA

Considering the importance of conducting a DPIA a natural question to consider is when should such an assessment be performed. There are several situations that warrant a DPIA. One example is whenever an organization is moving to some form of auto processing such as a program that identifies at-risk students. Since this system is automated it is important to make sure the data is protected.

Another situation that may warrant a DPIA is a situation in which individuals are judged and or evaluated. For example, collecting what users watch on Youtube to make recommendations. Lastly, instances of data integration may require a DPIA to make sure there is no loss of protection from combining data.

Process

There are several steps to actually completing a DPIA. Step one often involves describing the data flow. By data flow, it is meant how data movies throughout the organization in terms of its collection, storage, as well as sources. Step two involves determining the scope of the data. Scope is referring to what types of data will be assessed, the amount of data to be assessed, and or how long will the data be stored.

Step three involves defining the benefits of data processing. Data processing is the cleansing of data so that it can be used for analysis. How this is done varies wildly and depends on the situation. Step four looks at how processing affects the consumer. Explaining this is difficult but for example, complex data processing could slow down the user experience.

Steps 5 and 6 involve talking to stakeholders about this new project and checking for compliance. Stakeholders will explain any concerns that they may have while compliance involves legal matters such as regulations and laws.

Steps 7 and 8 are where various risks are identified and solutions are proposed. For example, if it is discovered that some of the data is revealing people’s identities it might be appropriate to make the data anonymous. Once all of the problems and solutions are developed, step 9 is the official approval of the DPIA.

Conclusion

Completing a data protection impact assessment is a practical way to take the first steps in data privacy in an organization. With the insights developed an organization can inspire confidence in their stakeholders that the data within the organization is not only accurate but safe as well.