With advancements in tech, the process of collecting, and storing data was expected to be smooth. Unfortunately, the use of the internet for data collection and transfers exposes it to more threats.
The owners of the data collected are now vulnerable, as their data can suffer accidental loss or compromise. In the wrong hands, sensitive data can be destructive e.g. impersonation, targeted attacks, and the likes.
What do organizations do then? They devise means of data protection, guided by data protection laws around the world. As a precautionary method, data controllers (entities that collect and determine the purpose of data processing) are required to carry out a data protection impact assessment.
What is a Data Protection Impact Assessment (DPIA)?
Data Protection Impact Assessment is the process of determining the level of risks involved with collecting personal data for a project. All projects come with risks, as long as data is involved. The main issue is how prepared data controllers are to contain the risks.
Given that it is impossible to fight an unknown enemy, the purpose of a DPIA is made more obvious. A Data Protection Impact Assessment will identify the risks and also find ways to reduce the impact.
The Importance of A Data Protection Impact Assessment
Organizations stand to lose everything unless they perform DPIA. Think about it: no one would keep money in a bank prone to robberies. The same principle applies in this case.
Clients trust organizations to keep their data safe. Regular data loss or compromise will do enough damage to shut down a company.
A DPIA ensures data controllers are aware of risks to data and ready to curtail them. Threats to organizations’ reputations are thus averted.
Besides that, organizations can avoid penalties of data protection laws around the world. The GDPR, for example, deems a DPIA necessary under certain circumstances. So, carrying out a Data Protection Impact Assessment is important to achieve GDPR- compliance.
When is a DPIA Required?
According to the Nigeria Data Protection Regulation (NDPR), it is necessary in situations where they process highly sensitive data. Sensitive data under the NDPR refers to personal data relating to an individual’s:
-
- Race, ethic, or origin
-
- Genetic and biometric data
-
- Political opinions
-
- Health
-
- Sex life
And others, as determined by Section 30(2) of the NDPR.
A DPIA is required when the data handled belongs to sensitive or differently-abled subjects.
Systematic monitoring, large-scale profiling, automated decision-making with legal effects, and the application of new technological solutions are some of the situations that need a DPIA.
On the flipside, data protection impact assessment is not required where data processing is not likely to result in high risk to rights and freedoms of persons.
Honestly, organizations should carry out a DPIA when handling a new project. To be on the safe side.
Who Should Be Included in DPIA?
The controller is 100% responsible for carrying out a DPIA. Other groups are involved in the process, but the data controller is held most accountable
Now, the data controller may choose to outsource the process to a third party. Especially when the organization lacks the expertise, experience, or personnel to conduct it. A project deemed risky may also warrant the use of a data protection service consultancy.
Since the process is likely to affect several aspects of a project, it is necessary to involve engineers, developers, and designers. They will be able to shed more light on the DPIA process.
The data protection impact assessment should be carried out with the utmost care. This requires a team of professionals well-versed in the DPIA process.
Whether overseen internally by the organization or outsourced to a consultancy, the GDPR and the Data Protection Bill mandate the appointment of a Data Protection Officer (DPO).
Who is a DPO?
A Data Protection Officer is a person overseeing the process of a Data Protection Impact Assessment. A DPO can be outsourced by a data protection service consultancy, if an organization lacks the personnel for it.
Lastly, data subjects must be involved when carrying out a DPIA. This will show transparency while taking the concerns of the subjects into consideration.
How To Do a DPIA
Conducting a data protection impact assessment is serious business. Doing it the wrong way can cost an organization valuable time and money.
To make the process simpler, here is a DPIA template you can follow.
Step 1: Identify The Need.
It will be futile to carry out a Data Protection Impact Assessment where it is not important. Below are some questions to determine if it’s necessary.
-
- Does your data involve processing personal data on a large scale?
-
- Does your project involve data transfer?
-
- Does your data processing include the data of vulnerable persons?
-
- Does your data processing include profiling and predicting?
-
- Does your data processing include datasets that have been matched or combined?.
Step 2: Context
If you answered yes to any of the above questions, then you can move on to this step.
Here, you have to be clear and specific.
-
- What is the purpose of this data processing?
-
- What does it aim to achieve?
-
- What are the benefits?
Be as detailed as possible.
Step 3: Describe the Flow of Information.
-
- How will you collect the data?
-
- How will you store the data?
-
- Who has access to it?
-
- How will you share? Etc.
For extra clarity, make use of a flow diagram.
Step 4: Identify and Assess the Privacy Risks.
Make a list of the identified risks, their impacts, and the likelihood of their occurrence.
Step 5: Make a Risk-reduction Plan.
Once the risks have been identified, the next is to create a counterplan.
How do you intend to curtail the effect of each of the risks? Document your plans, leaving no stone unturned.
The expected result of the counterplan should also be documented.
Step 6: Delegation
Assign a part of the process to several personnel for greatest effectiveness. Record who oversees what and the stipulated time frame for the activity.
Step 7: Reassess the Entire System.
Double-check all the identified risks, impacts, and likelihoods against the control methods.
This will cut all loopholes.
These 7 steps are enough to get an idea of how to conduct a Data Protection Impact Assessment.
DPIA vs. PIA
The Data Protection Impact Assessment and Privacy Impact Assessment (PIA) are tools that organization use to estimate privacy risks to personal data in projects.
While the former is a specific and mandatory requirement of the GDPR, any organization can use PIA to assess the privacy impacts of their activities.
DPIA is legally necessary in certain cases within the EU, while PIA is the best data protection practice and privacy compliance globally.
Conclusion
In compliance with data protection laws like the GDPR and Nigeria Data Protection Act, Data Protection Impact Assessment is important. By identifying and reducing risks to data, such organizations can maintain data protection. This will boost trust with the client community and help avoid penalties.
If you find integrating DPIAs difficult, Johan consults is your best way out. Reach out to us today!.
