- Practical manual for carrying out the data protection impact assessment (DPIA) in accordance with Art. 35 GDPR, freely available as a PDF from Fraunhofer Verlag.
- Structured process in five phases: Initiation, preparation, execution, implementation and ongoing review of the DPIA.
- Detailed methodology including risk analysis, remedial measures, documentation, responsibilities and warranty targets.
Nicholas Martin, Michael Friedewald, Ina Schiering, Britta A. Mester, Dara Hallinan and Meiko Jensen have published a “Manual for practice” for “The data protection impact assessment according to Art. 35 DSGVO” published. It is at Fraunhofer available free of charge in full text (PDF).
Table of contents:
1 Introduction
1.1 Data protection
1.2 Data protection impact assessment
1.3 Responsibility for the DSFA
Responsible
Data Protection Officer
Product manufacturers, processors and jointly
Responsible
2 Necessary preliminary work
2.1 Directory of processing activities according to
Art. 30 GDPR
2.2 Agencies involved
2.3 Documentation of the legal basis of the
Processing
2.4 Assessment of necessity and proportionality
The processing
3 Phases of a DSFA
4 Phase I: Initiation of the DSFA
4.1 Procedure
4.2 Examination of the requirements from Article 35 (3) DSGVO
4.3 Positive lists (“must lists”) of the data protection
Supervisors
4.4 Article 29 Working Party criteria
4.5 Independent testing
4.6 Documentation of the test result
5 Phase II: Preparation of the DSFA
5.1 Procedure
5.2 Collection of information and description of the
Processing operations and the purposes of processing
5.3 Identification of the persons concerned
5.4 Identification of other stakeholders
5.5 DSFA team
6 Phase III: Implementation of the DSFA
6.1 Procedure
6.2 What are risks within the meaning of the GDPR?
Damages and the impairment of rights and freedoms
Events
6.3 Risk identification and risk analysis, creation of damage scenarios
Analysis on the basis of the warranty targets
6.4 Risk assessment
6.5 Selection of remedial measures
6.6 Assessment of the remaining risks and decision
about further steps
6.7 Assessment of necessity and proportionality 49
6.8 Recommended methodology: participatory
Workshop-based approach
6.9 DSFA report
6.10 Prior consultation with the supervisory authority
7 Phase IV: Implementation of the DSFA
7.1 Implementation and testing of the remedies
7.2 Proof of compliance with the GDPR and release
The processing
8 Phase V: Continuous review of the DSFA
APPENDIX
A Description of the warranty targets
A1 Data minimization
A2 Availability
A3 Integrity
A4 Confidentiality
A5 Non-chainability
A6 Transparency
A7 Intervenability
B Further reading
C Abbreviations
D Notes
E About the authors