DPIAs
ISMS
DPIAs
A Data Protection Impact Assessment (DPIA) must be carried out before starting any processing that is likely to result in a high risk to the rights and freedoms of data subjects.
Are you unsure whether a DPIA is mandatory?Contact us →
When is a DPIA mandatory?
Among others, in these situations:
Large-scale processing of special categories of personal data, such as health or ethnic origin.
Systematic and large-scale monitoring of individuals, such as video surveillance or profiling.
Use of new technology with an increased risk for data subjects.
The processing is included in the DPIA list of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
What is included in a DPIA?
1
Description of the processing
Purpose, nature, scope, and context of the processing.
2
Necessity and proportionality
Is the processing necessary, and is it proportionate to the purpose?
3
Risk assessment for data subjects
Assessed using the same risk matrix as for other risk scenarios.
4
Measures to mitigate risks
The control measures that reduce the risk to an acceptable level.
5
DPO Advice
If a Data Protection Officer has been appointed, they provide advice on the DPIA.
Linked to other features
PIA field in a processing activity
If you indicate that a PIA is required for a processing activity, you will be directed here.
Outsource PIA questions
Questions from a DPIA can be outsourced directly to a contact person.
DPO Advice
The DPO role providing advice is drawn from the same roles list as Contact Management.
Risk Matrix
The risk assessment of a DPIA uses the same matrix and methodology.
Control Measures
The measures that mitigate the risk of a DPIA are recorded here.