Introduction and responsibility:
Conducting a data protection impact assessment (DPIA) is an essential requirement of the General Data Protection Regulation (GDPR) to ensure that the risks of processing personal data are assessed and appropriate measures are taken to mitigate the risks. The responsibility for conducting a DPIA lies with the controller. The responsibilities and tasks are explained in detail here:
Person responsible according to Article 4 No. 7 GDPR:
The controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. The controller has the obligation to ensure that a DPIA is carried out if the processing is likely to result in a high risk to the rights and freedoms of the data subjects.
Responsibility of the person responsible:
- Initiation of the DPIA: The controller must initiate the DPIA process as soon as it is determined that a planned processing operation is likely to pose a high risk to the rights and freedoms of data subjects. This includes identifying the relevant processing operations and assessing the need for a DPIA.
- Creation and maintenance of documentation: The controller is responsible for comprehensively documenting the DPIA. This documentation should contain all relevant information about the processing operations, the risk assessment and the risk mitigation measures.
- Implementation of measures: The controller must ensure that the risk mitigation measures set out in the DPIA are implemented. This includes both technical and organizational measures aimed at ensuring the security of the personal data.
- Consultation of the Data Protection Officer: If a Data Protection Officer has been appointed, the controller should involve him or her in the DPIA process at an early stage. The Data Protection Officer can provide valuable support and advice in conducting the DPIA.
- Prior consultation with the supervisory authority: If the DPIA shows that the processing would result in a high risk despite the intended remedial measures, the controller must consult the competent supervisory authority. The supervisory authority will then provide recommendations on how to mitigate the risk.
Role of the Data Protection Officer (Article 39 GDPR):
A Data Protection Officer (DPO) can play an important supporting role in conducting a DPIA. The DPO’s tasks include:
- Advice and support: The DPO advises the controller in carrying out the DPIA and supports him in assessing the risks and determining measures to reduce the risks.
- Monitoring compliance with the GDPR: The DPO monitors compliance with data protection regulations and ensures that the DPIA is properly carried out and documented.
- Contact point for data subjects and supervisory authorities: The DPO acts as a contact point for data subjects and supervisory authorities with regard to questions relating to the DPIA and the processing of personal data.
Involvement of other departments:
Conducting a DPIA often requires collaboration between different departments within a company. This may include:
- IT department: The IT department is usually responsible for the technical aspects of data processing and can provide valuable information about the technologies and security measures used.
- Legal department: The legal department can assist in assessing legal risks and compliance with the GDPR.
- Business departments: Business departments that initiate or are affected by data processing should also be involved in the DPIA process to ensure that all relevant information is taken into account.
Relevant articles of the GDPR:
- Article 4 No. 7: Person responsible
- Article 35: Data protection impact assessment
- Article 39: Tasks of the Data Protection Officer
Practical examples of responsibility in the DPIA:
- Technology company: A technology company plans to launch a new product that processes personal data. The controller initiates a DPIA, consults the Data Protection Officer and works with the IT and Legal departments to assess the risks and implement appropriate risk mitigation measures.
- Healthcare provider: A healthcare provider conducts a DPIA to assess the risks of processing sensitive health data. The controller ensures that the DPIA is fully documented and that the identified risk mitigation measures are implemented.
Summary:
The responsibility for conducting a data protection impact assessment (DPIA) lies with the controller. The controller must initiate the DPIA process, carry out the assessment of risks, determine the measures to mitigate the risks and document the results comprehensively. A data protection officer can provide valuable support and advice. Collaboration between different departments within the company is often required to conduct a comprehensive and effective DPIA. Properly conducting a DPIA ensures that the processing of personal data is carried out in accordance with data protection regulations and that the rights and freedoms of the data subjects are protected.
