Process modeling of a data protection impact assessment (DPIA)

The new EU General Data Protection Regulation (GDPR), which will enter into force in May 2018, obliges companies to carry out a review of the necessity of conducting a data protection impact assessment (DPIA) for each data procedure (e. g. collection and processing of personal data). If sensitive personal data is processed in a certain form in the data procedure, it must be checked whether the data protection guidelines are adhered to. A risk assessment must be carried out with regard to the rights and freedom of the persons concerned and, if necessary, a catalogue of measures must be drawn up to eliminate or minimise the risks. This is done with the implementation of a so-called DPIA, which has a direct influence on the implementation of a data procedure. The DPIA must be documented uniformly and transparently in order to ensure traceability, especially for the supervisory authorities.