The organization must perform and document a Data Protection Impact Assessment (DPIA) before starting any processing that may affect individuals’ privacy or data protection rights. The assessment must evaluate the nature, scope, purpose, and risks of the processing to ensure personal data is handled lawfully and responsibly.
The assessment must define:
- The purpose and legal basis of processing.
- The types, sources, and scope of personal data, including any intended disclosures.
- The context of processing, defining roles and relationships between the controller, processors, and data subjects.
- An evaluation of necessity and proportionality to ensure only essential data is processed.
- The potential impacts on individuals and the likelihood of harm.
- Mitigation measures and their effectiveness.
Completed assessments must be reviewed, approved, and retained as evidence of compliance. When processing is carried out by a processor, a copy of the relevant DPIA must be provided to them to ensure awareness of risks and required safeguards.
.svg)
