## 3 Results
### Components of the New DPIA--FRIA Framework
#### 3.1.1 The DPIA Part of the Framework  
The DPIA part is structured into different sections with questions and tasks for assessing and ensuring compliance with the GDPR. There are four Assessment Categories identified and 71 questions(Figure 1). Further, each Assessment Category consists of Focus Areas. All questions in DPIA should be answered by the Deployer (D). Adapted/enriched based on [42]. The questions per category are provided below indicating in addition, if the answer is connected with a FRIA question, i.e., if it provides output (\(\rightarrow\)) or receives input (\(\leftarrow\)). Assessment Category 1: General Framework  
The general section aims to describe the corresponding processing activities, clarifies the responsibilities of data controllers and processors, and lists applicable standards and certifications relevant to data processing Additionally, it describes the personal data that is processed, the life cycle of data, and identifies the elements that support data processing, such as systems and applications (Figure 2). Adapted/enriched based on [42]. * Overview
* What is the processing under consideration? **(D)**
* What are the responsibilities linked to data processing? Describe the responsibilities of the data controller and processor. **(D)**, \(\rightarrow\)_FRIA_: _Q10_, _Q13_
* Are there standards applicable to the processing? List all relevant standards and references governing the processing that are mandatory for compliance. **(D)**
* Data, Procedures, and Support Elements
* What types of personal data are processed? **(D)**, \(\leftarrow\)_FRIA_: _Q34_
* What is the operational lifecycle for data and processes? **(D)**
* What are the supporting elements for the data? **(D)**  
Assessment Category 2: Core Principles  
In the core principles section, we review compliance with Article 5 of the GDPR, assessing whether data processing is transparent, lawful, necessary, and meets data minimization requirements, as well as ensuring that personal data are kept accurate. We also outline the legal basis for processing, how data subjects are informed of the processing, and the ways they can exercise their rights (Figure 3). Adapted/enriched based on [42]. Figure 1: DPIA categories. Figure 2: General framework. * Proportionality and Necessity
* Are the goals of the processing clear, explicit, and lawful? **(D)**
* What legal foundation justifies the processing? **(D)**, \(\rightarrow\)_FRIA_: _Q123_
* Do you apply the principle of data minimization? **(D)**, \(\leftarrow\)_FRIA_: _Q35_
* Are the data adequate and up-to-date? **(D)**, \(\leftarrow\)_FRIA_: _Q18_
* What is the duration of data storage? **(D)**
* Legal controls
* By what means are data subjects notified about the processing? **(D)**, \(\leftarrow\)_FRIA_: _Q106-Q108_
* If applicable, how do you obtain the data subjects' consent? **(D)**
* In what ways can data subjects exercise their rights to access and data portability? **(D)**, \(\rightarrow\)_FRIA_:_Q124_. * By what means can data subjects request correction or erasure of their personal data? **(D)**, \(\rightarrow\)_FRIA_:_Q124_. * By what means can data subjects exercise their rights to restriction and objection? **(D)**, \(\rightarrow\)_FRIA_:_Q124_. * Are the responsibilities of the processing personnel clearly specified and contractually governed? **(D)**, \(\leftarrow\)_FRIA_: _Q52_. * When transferring data outside the EU, are the data protection measures sufficient? **(D)**  
Assessment Category 3: Preventative and Mitigating Measures  
The preventative and mitigation measures section examines measures (existing or planned) covering organizational control responsibilities, including policies for data protection, risk management, personal data breach management, measures related to the personnel, and third-party data access. Physical and logical security controls involve protecting data integrity and accessibility through various security protocols, risk avoidance strategies, and data management techniques (Figure 4). Figure 4: Preventative and mitigating measures (DPIA).