Assessing risky processing in advance.
WHAT IT IS
A structured assessment of the privacy risks of a proposed activity.
WHEN IT IS TYPICALLY REQUIRED
Processing likely to result in high risk to individuals.
WHAT THAT USUALLY COVERS
Large-scale processing of sensitive data Systematic monitoring Automated decisions with significant effects New technologies applied to personal data Combining datasets
WHAT IT SHOULD CONTAIN
A description of the processing The purpose and lawful basis Whether it is necessary and proportionate The risks to individuals Measures to address them The conclusion
WHY NECESSITY MATTERS
If the purpose can be achieved with less data, the processing is not necessary as designed.
WHEN TO DO IT
Before starting, while the design can change.
WHY THAT TIMING IS THE WHOLE POINT
An assessment after launch is documentation, not protection.
WHO TO INVOLVE
The people designing it Whoever holds the data protection role Sometimes, representatives of those affected
WHAT TO DO WITH HIGH RESIDUAL RISK
Consider consulting the regulator, where the law provides for it.
WHAT TO RECORD
The assessment, the decision, and who approved it.
WHAT TO REVIEW
It, when the processing changes.
WHAT TO AVOID
Treating it as a form to complete.
