Data Protection Impact Assessment (Article 35 GDPR)

The data protection impact assessment is the statutorily prescribed procedure by which a controller identifies and assesses, in advance, the risks that a particularly intrusive processing operation poses to the data subjects, and reduces those risks by means of remedial measures (Article 35 GDPR). It gives expression to the risk-based approach of the GDPR and is at the same time an instrument by which the controller ensures and demonstrates compliance with the Regulation.

1. What the data protection impact assessment achieves

1.1 Purpose and legal nature

The data protection impact assessment is directed at processing operations that are particularly risky for the rights and freedoms of natural persons. For these, the law requires a forward-looking examination of the possible consequences, followed by the selection and implementation of risk-mitigating remedial measures. It is therefore both an obligation to minimize risk and a procedure for ensuring and demonstrating compliance with the GDPR (Recital 84 GDPR).

The addressee of the obligation is the controller (Article 4(7) GDPR). The obligation cannot be shifted onto the data protection officer: the latter is to be involved and provides advice, but bears no responsibility for the content and the outcome (Article 35(2) GDPR).

1.2 Risk-based approach: not for every processing operation

A data protection impact assessment does not have to be carried out for every processing operation, but only where the processing is likely to result in a high risk (Article 35(1) GDPR). Whether this threshold is reached is clarified by the controller in advance in a documented threshold analysis. The details of when an assessment is required, of the statutory examples, and of the lists maintained by the supervisory authorities are dealt with on the sub-page Necessity.

1.3 Timing: before the start of the processing

The data protection impact assessment must be carried out in advance and therefore before the processing is taken up. Because several units are involved (the business unit, data protection, information security and, where applicable, the employee representative body and the supervisory authority), it must be begun with sufficient lead time while the project is still at the planning stage. It is not a one-off act, but accompanies the project and may require individual steps to be repeated where new remedial measures are determined.

2. The process at a glance

The minimum content laid down in Article 35(7) GDPR can be translated into three phases and a concluding report. In practice, a six-step procedure that operationalizes the statutory building blocks has proven effective.

Steps 1 to 6 are not strictly linear: where excessive risks are identified in step 4, steps 2 to 5 must be run through again once the remedial measures have been determined, this time on the assumption that those measures are implemented. The full process, including the risk assessment, is described on the sub-page Carrying out the assessment.

3. Consequences of an omitted or deficient data protection impact assessment

An infringement exists both where a required data protection impact assessment is not carried out and where it is not carried out properly. Both may be sanctioned by an administrative fine (Article 83(4)(a) GDPR) and may give rise to a claim for damages on the part of the data subject (Article 82 GDPR). Because the documentation of the threshold analysis forms part of the duty of accountability (Article 5(2) GDPR), the outcome must also be recorded where the examination concludes that no assessment is required.

4. Structure of this chapter