A data protection impact assessment examines a new product, system or process that uses personal data, identifies the privacy risks and decides how to reduce them — before launch.
DPIAs are required under GDPR for high-risk processing, and periodic data protection impact assessments are expected of Significant Data Fiduciaries under India's DPDP framework.
Objectives
- Describe the processing, its purpose and necessity
- Identify risks to individuals' rights and freedoms
- Recommend measures to reduce risk
- Document decisions for regulators and auditors
Methodology
01
Describe
- Workshops with product and engineering teams
- Data-flow and system mapping
02
Assess
- Necessity and proportionality review
- Risk identification and scoring
03
Mitigate
- Technical and organisational measures
- Sign-off and documentation
Deliverables
DPIA report
Risk register with mitigations
Recommendations for product and engineering