Risk Assessment & DPIA
This workshop introduces a risk-based approach: spotting high-risk processing, carrying out data protection impact assessments (DPIAs), treating the risks and building privacy into new projects.
Workshop 8 video
Walkthrough of the workshop and its tasks — coming soon
Workshop tasks
-
1. Screening
Check every RoPA activity against high-risk criteria: large-scale sensitive data, systematic monitoring, profiling, automated decisions or new technologies.
In ResGuard: DPIA -
2. Carry out the DPIA
Describe the processing, assess necessity and proportionality, and identify the risks to individuals and possible misuse.
In ResGuard: DPIA -
3. Risk treatment & sign-off
Define controls, assess the residual risk, get the DPO's advice and management approval.
In ResGuard: DPIA -
4. Privacy by design
Build a data protection review into project and change management, and involve the DPO from the start.
In ResGuard: Policy Framework -
5. Review cycle
Review each DPIA when the processing changes, after an incident and regularly, for example every two years.
In ResGuard: DPIA -
6. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Peru
- Check whether the Regulation in force requires an impact assessment for your type of processing.
- Video surveillance is governed by a specific ANPDP directive; include it in the risk analysis.
Expected result
- Screening of all activities completed
- DPIAs carried out for high-risk processing
- Treatment measures approved with an action plan
- Privacy by design built into projects and changes
ResGuard modules: DPIA, Policy Framework