Data protection impact assessment for a monitoring procedure
Project duration: 11 months
Brief description
Carrying out a data protection impact assessment (DPIA) for an existing data processing procedure, which is intended to detect or avoid violations of an advertised house ban by means of systematic monitoring. This DPIA is intended to serve as a'pilot project' for the client to carry out further data protection impact assessments, which, according to the new EU Data Protection Basic Regulation, will become mandatory, in particular for the collection and processing of personal data.
Supplement
The task comprises all steps of a DPIA including description of the subject matter, development of the legal basis, a risk assessment and the preparation of an action plan for compliance with the EU Data Protection Ordinance (GDPR). The basis of the DPIA is a process-related procedure model, which was developed in advance with process models in the notation BPMN 2.0. The final DPIA documentation provides the customer with a structured template for carrying out further DSFAs, which he can use as a basis for future orientation.
Subject description
According to Article 35 of the EU Data Protection Regulation (GDPR) which will become effective on 25 May 2018, a data protection impact assessment (DSFA) must be carried out for each procedure for processing personal data if a high risk to the rights and freedoms of natural persons (= data subject of the procedure) exists. The aim of a DPIA is to systematically assess in advance the risks to the rights and freedoms of those concerned and to determine remedial measures to ensure the protection of personal data and to provide evidence of compliance with the GDPR.