A DPIA is required if data processing is likely to entail a high risk to the rights and freedoms of data subjects. Examples include systematic monitoring, large-scale data processing or the handling of sensitive data.
A DPIA is necessary for processing operations that pose a high risk to data subjects, such as video surveillance, scoring systems or the processing of sensitive data such as health information or biometric data.
The DPIA is carried out in three steps: Analysing the data processing, assessing the risks for data subjects and defining suitable protective measures, followed by detailed documentation.
Risks such as data loss, unauthorised access, misuse or breach of confidentiality that could endanger the rights and freedoms of data subjects are assessed.
The responsibility lies with the person responsible for data processing in the company. The DPIA is often carried out by the data protection officer in cooperation with other departments.