# Data Protection Impact Assessment (DPIA) for Cloud-Based Health Organizations
## 2 Description of the DPIA Steps  
Clearly, the provision of cloud-based health services involves \"high-risk\" processing on a high volume of data and thus the DPIA is a necessary step in order to protect the privacy and the rights of the patients. Based on the literature research we present, through a case study, the steps necessary for conducting a DPIA that will ensure the security and privacy aspects of a cloud-based Health Information System and more specifically the GDPR principles, such as purpose limitation, data minimization, accuracy, accountability, the lawfulness of processing, and the user consent (Article 5) [7]. In this regard, the hospital information system will respect all the data owners' rights (patients), such as their rights to object to the storage/processing of their data, their right to be forgotten, and their right to the restriction of processing (Article 12-23) [8], while the obligations of the intermediate users, such as health professionals, production managers, and in general all the professional profiles that manage the system and potentially exploit all the data generated within the cloud-based system are specified. Finally, all the necessary technical, organizational, and procedural measures for the satisfaction of the eliciting security and privacy requirements are considered, thus enhancing confidence and trust among all stakeholders. As already mentioned, the DPIA process is not strictly defined. The data controller can develop its own template or use a template provided by someone else. In our case study, we will employ the methodology proposed by the French Data Protection Authority (CNIL) [6]. Its main steps/stages, as well as the transition from one stage to the other, are depicted in Figure 1.  
More specifically, the four steps of the PIA-CNIL methodology are:  
1. Define in detail the context of the processing of personal data under consideration. Provide a brief description of the project including its nature, scope, content, and purposes. Moreover, the data controller must identify the data processors, if any. In addition, the precise personal data that will be collected and processed must be defined together with their recipients, the duration of storage, and the processing activities from their collection to their deletion. This step also contains the identification of the personal data supporting assets for the under-examination system. Summarizing, this step aims to define the outline of the personal data processing process, such as the categories of the personal data, the purpose of processing, the way data are processed, the personal data supporting assets, the data subjects, etc. 2. Identify the existing and planned controls (procedural/technical/organizational) that are necessary for protecting the data, treating privacy risks in a proportionate manner, and achieving compliance with legal requirements. Justify and explain the choices made regarding the purpose for which the data are collected, their storage period, and their quality. More specifically, a clear description/documentation of the way that the following legal requirements are satisfied, is necessary: 1. Clear description of the purpose of personal data processing, 2. Data minimization (only the absolutely necessary data for serving the specific purpose of processing are collected), 3. Quality of data (data are correct and kept up-to-date), 4. Retention periods (for how long are the data stored), 5. Information (ensure that the data subjects are informed about the way their data are processed), 6. Ensure that the processing is performed legally, identifying the appropriate legal basis (for instance, the consent of the data subjects),  
Figure 1: General approach of the privacy impact assessment, Commission Nationale de l’Informatique et des Libertés (PIA-CNIL) methodology. 7. Right to object (respect the data subjects' right of opposition), 8. Right of access (respect the data subjects' right to access all the data stored for her), 9. Right to rectification, 10.