View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Policy
December 7, 2017

GDPR: The Importance of Data Privacy Impact Assessments

Under the GDPR, the more in-depth Data Protection Impact Assessment (DPIA) will be required by businesses to help identify threats to the privacy rights of EU residents.

By James Nunns

It’s always been wise to conduct a Privacy Impact Assessment (PIA) before any overhaul of your data process; but with the GDPR looming, assessments are about to become


Kris Lahiri, co-founder & Chief Security Officer, Egnyte.

essential. Starting May 25th 2018, conducting data assessments will become an enforced part of any compliance program. Under the GDPR, the more in-depth Data Protection Impact Assessment (DPIA) will be required by businesses to help identify threats to the privacy rights of EU residents.


Why conduct DPIAs?                                                              

DPIAs are simply a means to identify data risks to the privacy rights when processing personal data. The GDPR expects businesses to build an effective response to risks that may be revealed during a DPIA. Those responses will often include adding deeper technical controls such as the encryption, pseudonymization, and anonymization of personal data. Formulating an on-going effort to review data procedures will help businesses build a solid foundation for assessing the risk of data systems and securing the sensitive information they hold.


When should DPIAs occur?

An impact assessment should always take place whenever developing a new way to process personal data. However, with an increased purpose put on data protection and responsibility (especially in the EU), it’s wise to make sure it’s a permanent operating procedure. To get the most value from assessments, try to concentrate the focus of assessments on things like the proportionality of operations and the systematic description of processing activities.


Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester
Can I use DPIAs for more than data?

While the driving force of conducting DPIAs is GDPR compliance, these assessments also allow for service level agreements (SLAs) to evolve between data protection officers and other teams within an organization. This will help the fundamentals of data protection filter through an entire organization; positively affecting things like development, test and deployment, and ongoing monitoring. A comprehensive DPIA plan will also help privacy teams develop an effective privacy by design approach, and a risk-based overview of data protection; both of which are essential elements of GDPR compliance. A well planned and implemented DPIA process should eventually become a core part of all operating procedures and should not be seen as an extra task to tack on at the end.


The privacy by design approach

One of the main goals of the GDPR is to make organizations develop a system of “privacy by design” with the aim to consistently promote data compliance from the start of any initiative. This approach is essential for reducing privacy risks and building trust – both from within an organization and in the eyes of the law. The UK Government Data Programme has even built a Data Science Ethical Framework to help organizations decipher the benefits and risks of using personal data when developing such a policy. Implementing projects with privacy at the forefront will help:


  • Address issues early, making them easier to fix and a lot less costly.
  • Increase privacy and data awareness across an entire organisation.
  • Meet legal obligations including GDPR


Whatever approach you take to comply with GDPR, the key to success, and of course compliance, is planning, and planning early. Taking a privacy by design approach and exploring the potential of DPIAs (beyond just a compliance regulation) will benefit any organization – from the inside out.

Topics in this article : , ,
Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.