Conducting a Data Protection Impact Assessment (DPIA) in a Practical Manner

Classification of the DSFA within the GDPR Accountability Obligation

• Risk-based approach.
• Accountability and Its Importance in Data Protection Management.

Legal Basis Pursuant to Article 35 of the GDPR

• Prerequisites.
• Minimum requirements and reference to the consultation with government agencies.

Criteria for Determining Whether a Data Protection Impact Assessment (DPIA) Is Required

• Assessment of typical triggers such as profiling, surveillance, sensitive data, and whitelists.

Distinction from VVT, Risk Analyses, and IT Security Assessments

• Differences.
• Interfaces.
• Common Misconceptions in Practice.

Systematic Implementation of a Data Security and Privacy Impact Assessment (DSFA)

• Description of the processing.
• Assessment of necessity, proportionality, and risks.

Technical and organizational measures

• Identification, evaluation, and implementation of appropriate protective measures.

Documentation, Residual Risk, and Decision

• Documentation of the results.
• Managing Residual Risks and Decision-Making.

Common Practical Mistakes and Regulatory Authorities' Expectations

• Common errors, lack of justification, and the authorities' focus during audits.

Real-world examples and collective analysis

• Classification of typical cases such as video surveillance, HR systems, AI/tracking systems, and sensitive data.