## 2 Materials and Methods
### Decomposing a DPIA
An exemplary DPIA snippet including a specific risk, one of the seven objectives, a risk evaluation, tailored TOMs, as well as the risk evaluation after the application of the TOMs is displayed in Figure 3. Figures 2 and 3 also aim to give brief examples of the types of risks that are addressed using DPIAs. Figure 1: The proposed matrix allows a comprehensive risk assessment for the data protection impact assessment (DPIA) by utilizing a rating system that considers both the probability of occurrence and the severity of possible damage, each rated on a scale from 1 to 4. By multiplying these ratings, a combined risk score is derived, which enables the classification of risks into three distinct categories: low-, medium-, and high-risk. Risks falling into the low-risk category necessitate the implementation of technical and organizational measures (TOMs) to address and mitigate their impact. If, even after the implementation of TOMs, a risk remains classified as high (indicated by the red zone), it indicates an unacceptably high level of risk. Consequently, proceeding with the project would be impossible from a data protection perspective and requires further analysis and adjustments to ensure compliance with established risk thresholds. The figure was oriented by [22]. Figure 2: The process can be divided into several key steps (simplified) consisting of different project parts that are interconnected, i.e., where patient-related data are transferred (here, indicated by arrows): (**A**) The creation of a data flow diagram, such as the one used in the here-presented example project—the tumor board project with multiple consortium partners. (**B**) The analysis and categorization of potential risks are based on the matrix presented in Figure 1. In this step, specific TOMs are required for the red parts of the matrix, and depending on their risk score, some of the yellow parts may also necessitate TOMs. Implementing TOMs for parts below the threshold is advisable to achieve a lower risk score, which is always the objective. The dotted line implies that the DPIA solely covers the transmission part from the merging software to the data hub, not the data hub itself, as the latter requires a separate DPIA. (**C**) A preliminary selection of TOMs aimed at reducing the probability of occurrence (marked in pink) or the severity of harm (marked in blue). It is important to acknowledge that the same TOM may apply to different risk sources, multiple TOMs may mitigate the same risk, and some TOMs can simultaneously lower both the probability of occurrence and the severity of harm. (**D**) The risk evaluation after the implementation of the TOMs. The absence of red parts indicates that the project can proceed from a data protection standpoint. Note, that the DPIA click&go tool only offers suggestions for (**B**–**D**), but not for (**A**). The creation of the data flow diagram (**A**) is obligatory and unique to each individual project. Note, that “external tool” hereby refers to a tool that was not developed by our institute but by a different academic institute. IDAT = identifying data, MDAT = medical data, SOP = standard operating procedure.