Step 4: Assessing Necessity and Proportionality

Per Article 29 of the GDPR, organizations are to include how you ensure data protection compliance, which is a good measure of necessity and proportionality. In particular, you should include relevant details of:

• your lawful basis for the processing;
• how you will prevent function creep;
• how you intend to ensure data quality;
• how you intend to ensure data minimization;
• how you intend to provide privacy information to individuals;
• how you implement and support individuals' rights;
• measures to ensure your processors comply; and
• safeguards for international transfers.

Step 5: Risk Identification and Assessment

It’s also critical when performing a DPIA to conduct an assessment of risks relevant to the organization’s processing activities. Specifically, organizations should assess, define, and document all relevant risks that could impact the organization’s processing activities. Risk considerations should include, but are not limited to, the following:

• inability to exercise rights (including but not limited to privacy rights);
• inability to access services or opportunities;
• loss of control over the use of personal data;
• discrimination;
• identity theft or fraud;
• financial loss;
• reputational damage;
• physical harm;
• loss of confidentiality;
• re-identification of pseudonymised data; or
• any other significant economic or social disadvantage

Step 6: Risk Reduction and Mitigation

All organizations will have identified relevant risks that will need to be mitigated to the fullest extent possible. With a properly performed risk assessment, organizations can then assess which options to best reduce risk. Every organization is different, and as such, measures to reduce risks will be different also. Yet with that said, there are common areas that all organizations should consider in terms of risk reduction, and Centris can help identify such measures.

Step 7: Issuance of DPIA Report

The conclusion of a DPIA is a final, formal report documenting the following:

• Additional measures you plan to undertake.
• whether each risk has been eliminated, reduced, or accepted.
• the overall level of ‘residual risk’ after taking additional measures.

Whatever the findings are, it’s important to then implement them into your existing control environment. With Centris, we offer a wide range of data privacy services, including assessments & programs, data governance, data mapping, PIA, DPIA, GDPR assessments, CCPA/CPRA assessments, international international privacy assessments, U.S. state privacy assessments, EU Cloud Code of Conduct, Microsoft SSPA/DPR, along with data privacy programs.