startData protection by design with DPIAs
How To

Data protection by design with DPIAs

CCH GDPR Compliance
Last update: Reading time 3 minutes
Data ProtectionGDPRGetting Started

    For data protection to become part of an organisation’s general business practices, they need to undertake Data Protection Impact Assessments (DPIAs). The assessments require that the business: describes the processing, details how you have ensured that processing complies with the fundamental principles of the GDPR, explains the risks and the measures you’ve put in place to mitigate them.

    The DPIA is a process for building and demonstrating compliance. As such, the owner or drafter of the DPIA will need to solicit comments from different reviewers, possibly including the DPO, and will need to get the DPIA approved. The software’s DPIA workflow helps manage this process and documents all the feedback.

    When should you conduct a DPIA?

    clipboard_e625930ed933e2186f57b4b347238dcd1.png

    Certain processing operations are considered high risk: use of personal data of children or other vulnerable individuals, tracking an individual’s behaviour, processing genetic or biometric data and even processing high volumes of data. Basically, processing that’s likely to result in a high risk requires you to undertake a DPIA.

    Even if you’ve decided you don’t need to do a DPIA, you should document why you have decided you don’t need to do one. The regulation says that whenever the data processing could result in a high risk to individuals, you should do a DPIA.

    CCH GDPR Compliance makes it easy for you to document why you need to do a DPIA – or why not – and why the DPIA is relevant to the process you’re undertaking.

    What should a DPIA contain?

    Borrowing on best practices suggested by European data protection supervisory authorities, our DPIA builder will make sure your DPIA:

    • Details all elements of the data processing operation
    • Describes the reasons for processing, including explanations of any legitimate interests pursued by the controller
    • Assesses the necessity and proportionality of the processing in relation to the purposes
    • Assesses and documents the risks to data subjects
    • Details what measures you’ve put or are putting in place to mitigate these risks

    We help you to:

    Define the DPIA’s scope, assign roles and responsibilities for its drafting, its review and its approval.

    • Determine whether or not a DPIA is required.
    • Identify why a DPIA is relevant.
    • Capture and describe all the processing detail.
    • Demonstrate the controls you’ve implemented to protect individuals’ data rights.
    • Capture all the processing details.
    • Identify the risks and produce a risk catalogue.
    • Detail the technical or organizational measures you’ve put in place to mitigate those risks.
    • Get sign off and approvals.

    At the end of the process, you will have an assessment that you can share internally with all stakeholders, so they understand the risks and how they are being mitigated. You’ll have documentation to show that you have gone through this process and, if necessary, something to share with your supervisory authority to get feedback.

    Related documents

    CCH GDPR Compliance  MFA
    The document outlines the implementation of multi-factor authentication (MFA) for users of the CCH GDPR Compliance application to enhance account security. It explains that users must provide two factors for access, specifically a password and a verification code sent via SMS or generated through a time-based one-time password (TOTP) app, such as Google Authenticator or Microsoft Authenticator. Instructions for downloading these apps and setting up SMS verification are provided, along with visual aids for the login process and MFA selection.
    Stakeholder training and awareness
    The document discusses the importance of staff awareness and compliance in data protection programs within organizations. It highlights the necessity of training employees on relevant policies and providing documentation of their understanding and acceptance. The CCH GDPR Compliance tool is introduced, which allows organizations to distribute policies, track employee receipt and acceptance, and monitor compliance status with visual indicators. It emphasizes the need for a record of training efforts and offers templates for communication, ensuring all employees are informed and compliant.
    Simplifying Data Subject Access Requests (DSAR)
    This document outlines the rights of individuals regarding their personal data and how organizations can facilitate the exercise of these rights. It emphasizes the importance of allowing easy access to rights through communication channels. The process for handling Data Subject Access Requests (DSAR) is detailed in three steps: receiving and logging requests via a customizable online form, validating requests by confirming the requester's identity, and responding appropriately to the request while ensuring compliance. The document stresses the importance of training staff and maintaining records for accountability and transparency.
    Responding to data breaches
    This document discusses the importance of effective breach management in compliance with GDPR, highlighting the challenges many organizations face in acknowledging breaches. It introduces CCH GDPR Compliance as a solution, detailing its workflow for logging breaches, managing responses, and assessing incidents. Key features include understanding causes, assembling response teams, risk evaluation, and facilitating communication with supervisory authorities and affected data subjects. The tool also provides downloadable reports and maintains a historical breach log for future learning and prevention efforts.
    Ensuring third parties are compliant
    This document emphasizes the importance of managing personal data shared with third parties, particularly concerning GDPR compliance. It highlights the necessity for written agreements outlining data processing practices and the need for meticulous logging of data transfers. The document addresses the complexities of sharing data with both processors and controllers, including specific legal obligations when processors are outside the EU. It underscores the distinct legal responsibilities between controllers and processors and recommends mapping these relationships for clarity and compliance. Additionally, it offers tools for generating agreements and recording legal bases for data sharing.