# Data Protection Impact Assessment (DPIA) for Cloud-Based Health Organizations
###### Abstract  
The General Data Protection Regulation (GDPR) harmonizes personal data protection laws across the European Union, affecting all sectors including the healthcare industry. For processing operations that pose a high risk for data subjects, a Data Protection Impact Assessment (DPIA) is mandatory from May 2018. Taking into account the criticality of the process and the importance of its results, for the protection of the patients' health data, as well as the complexity involved and the lack of past experience in applying such methodologies in healthcare environments, this paper presents the main steps of a DPIA study and provides guidelines on how to carry them out effectively. To this respect, the Privacy Impact Assessment, Commission Nationale de l'Informatique et des Libertes (PIA-CNIL) methodology has been employed, which is also compliant with the privacy impact assessment tasks described in ISO/IEC 29134:2017. The work presented in this paper focuses on the first two steps of the DPIA methodology and more specifically on the identification of the _Purposes of Processing_ and of the data categories involved in each of them, as well as on the evaluation of the organization's GDPR compliance level and of the gaps (_Gap Analysis_) that must be filled-in. The main contribution of this work is the identification of the main organizational and legal requirements that must be fulfilled by the health care organization. This research sets the legal grounds for data processing, according to the GDPR and is highly relevant to any processing of personal data, as it helps to structure the process, as well as be aware of data protection issues and the relevant legislation. cloud computing; security; privacy; data protection impact assessment; GDPR; healthcare systems +
Footnote †: journal: _Future Internet_  
processing operations are likely to result in a high risk to the rights and freedoms of natural persons, the controller should be responsible for the carrying-out of a Data Protection Impact Assessment (DPIA) to evaluate, in particular, the origin, nature, particularity, and severity of that risk\". Therefore, it is safe to say the DPIAs benefits are 2-fold: (a) To understand and mitigate risks to peoples' rights and (b) to satisfy the legal requirements [5]. The outcome of a properly conducted DPIA will be the minimization of privacy, security and reputation risks, compliance with the data protection legislation, and enhanced trust among data subjects and stakeholders. DPIA is a concept in complete harmony with GDPR's philosophy, calling for the protection of data subjects from _\"high risks\"_ through timely planning and obtaining all the necessary precautionary measures. The Data Controller and the Data Processor need to comply with the principle of accountability, or in other words be always able to prove that they have taken all the appropriate measures to protect the personal data and ensure compliance. The estimation of the impact forms a potential incident and helps fulfill both aspects of the accountability principle, since depending on the risk that may arise from the processing of data and on the weighting (impact) of this risk estimated during the DPIA, the appropriate protection measures will be identified. The earlier we identify threats that pose a \"risk\" to personal data, the better the accuracy and effectiveness of the measures that will be adopted for the protection of the data. The process of early identification of potential risks and the integration of appropriate protection measures during design is known as \"privacy by design\". However, the process of conducting a DPIA for a hospital can be complex and requires special skills. Although almost 3 years have passed since GDPR is in effect, organizations still face difficulties to comply. This is particularly challenging for healthcare organizations, due to the lack of resources and expertise. This paper presents the main steps of a DPIA study and provides guidelines on how to carry them out effectively.