# Data Protection Impact Assessment (DPIA) for Cloud-Based Health Organizations
## 4 Conclusions  
The global dimension of cloud computing requires standardized methodologies and technical solutions in order to enable stakeholders to assess privacy risks and establish adequate protection levels. The cloud presents new challenges for compliance and many cloud services are not GDPR ready. For this reason, the Data Protection Impact Assessment study is a useful tool, aiming to assess the privacy risks involved in processing operations. A DPIA is the basis of a \"privacy by design\" approach and helps organizations meet the privacy and data protection expectations of their customers, employees, and other stakeholders. Although conducting a DPIA is now a legal requirement under the GDPR [1], it is not mandatory for all processing operations, but only for those involving high risks to the rights and freedoms of their subjects. Data controllers should consider conducting a Data Protection Impact Assessment in such processing operations, as a useful and positive activity that helps them demonstrate compliance with the law. Currently, there is a lack of methodology offering systematic support for the process of DPIA in cloud-based Health Information Systems. Our work seeks to fill this gap by providing the appropriate guidelines. In this paper, we have presented the first two steps of a DPIA for a cloud-based Health Information System, based on the PIA-CNIL methodology [6]. Through the case study employed, we have identified the _Purposes of Processing_ and the data categories involved in each of them. Furthermore, we have demonstrated how to evaluate the organization's GDPR compliance level through a _Gap Analysis_. Finally, the main organizational and legal requirements that must be fulfilled by the health care organization, were identified. \begin{table}
\begin{tabular}{r r} \hline \hline \multicolumn{2}{c}{**Organizational/Legal Requirements**} \\ \hline
**Requirement ID** & **Requirement** \\ \hline GDPR-19 & Define a Data Protection Policy for describing the process for data anonymization for processing related to scientific research/statistical research \\ GDPR-20 & Maintain records of processing activities \\ GDPR-21 & Maintain documents as a proof of compliance \\ GDPR-22 & Maintain documents to prove the lawfulness of processing \\ GDPR-23 & Maintain documents to prove the lawfulness of processing of special categories of personal data \\ GDPR-24 & Maintain a record of incidents/breaches \\ GDPR-25 & Maintain the list of notifications to the supervisor authority/data subjects about a personal \\ data breach \\ GDPR-26 & Maintain a record/log of actions when dealing with a data breach \\ GDPR-27 & Conduct a Risk Analysis Study \\ GDPR-28 & Define security measures based on the risk level (e.g., pseudonymization, encryption, access control, firewall, network intrusion detection, logs, etc.) \\ \hline \hline \end{tabular}
\end{table} 
Table 7: _Cont._As GDPR touches on all aspects of a hospital and more specifically on a cloud-based Health Information System, we are currently working on a framework to enable the non-stressful implementation of a DPIA. In our future work, we will focus on the remaining DPIA steps, providing the appropriate guidelines for their effective implementation. Conceptualization, D.G. and C.L. ; methodology, D.G. and C.L. ; validation, D.G. and C.L. ; investigation, D.G. and C.L. ; resources, D.G. and C.L. ; writing--original draft preparation, D.G. ; writing--review and editing, D.G. and C.L. ; supervision, C.L. ; funding acquisition, D.G. and C.L. All authors have read and agreed to the published version of the manuscript. This work has been partly supported by the University of Piraeus Research Center. This research is co-financed by Greece and the European Union (European Social Fund, ESF) through the Operational Programme <<Human Resources Development, Education and Lifelong Learning>> in the context of the project \"Reinforcement of Postdoctoral Researchers--2 nd Cycle\" (MIS-5033021), implemented by the State Scholarships Foundation (IKY).