Conducting a DPIA: working through high privacy risk in a structured way

The threshold assessment makes the trigger traceable

The nature, scope, context and purpose of the processing are checked against possible high risks to rights and freedoms. New technologies, systematic evaluation, extensive sensitive data or monitoring can be important indicators.

The DPIA follows risk through to the decision

Description, necessity, risk analysis and measures must fit together. If a high residual risk remains, the intended further treatment must be clarified, including a possible prior consultation.

• Describe the processing and the data flows
• Assess necessity and proportionality
• Analyse consequences for data subjects as scenarios
• Document measures, residual risk, approval and review