A Data Protection Impact Assessment (DPIA) is a process of weighing up the high risks that data processing might have on the rights and freedoms of individuals, with the benefits of what you want to achieve.
Companies have to do this to minimise the risks of a new project or plan, or to help determine whether it's even worth pursuing in the first place.
Our top tips for carrying out a DPIA:
Carry out the DPIA when you can still influence the outcome of the project. You can do a DPIA before or after implementing a new plan, but doing it beforehand can save the potential costs of an initiative.
Throughout your role make sure you remain ‘independent’, i.e. the controller should not direct you with how you do your work, this is required under GDPR. It means when you do tasks like DPIAs they have more credibility.
Consult the Data Protection Authority in your area depending on the scale, context or magnitude of the risks involved. This isn’t necessary all the time but it depends on how serious you think the risks are.
Map the information flows and identify the risks and benefits by following a template like the ICO’s.
Publish the DPIA report, sometimes you can’t for security reasons but it can be a great PR move to show customers/employees that you take their data very seriously: the FBI publish their DPIAs!