Risk Assessment & DPIA
This workshop introduces a risk-based approach: spotting high-risk processing, carrying out data protection impact assessments (DPIAs), treating the risks and building data protection into new projects.
Workshop 8 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- DPIA module with a built-in catalogue of risks and legal checks
- High-risk screening built into every processing activity of the RoPA
- Online approval of controls by the responsible persons
- Template for the privacy by design and by default procedure
Workshop tasks
-
1. Screening
Check every activity in the inventory against high-risk criteria: large volumes of sensitive data such as NRIC or financial data, systematic monitoring, profiling, automated decisions or new technologies.
In ResGuard: DPIA -
2. Carry out the DPIA
Describe the processing, assess necessity and proportionality, and identify the risks to individuals and possible misuse.
In ResGuard: DPIA -
3. Risk treatment & sign-off
Define controls, assess the residual risk, get the DPO's advice and management approval.
In ResGuard: DPIA -
4. Data protection by design
Build a data protection review into project and change management, and involve the DPO from the start.
In ResGuard: Policy Framework -
5. Review cycle
Review each DPIA when the processing changes, after an incident and regularly, for example every two years.
In ResGuard: DPIA -
6. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind under the PDPA
- The PDPA does not make DPIAs mandatory in general, but the PDPC's Guide to Data Protection Impact Assessments recommends them for new or changed processing.
- Relying on deemed consent by notification or on the legitimate interests exception requires an assessment of adverse effects; record it in the DPIA module.
Expected result
- Screening of all activities completed
- DPIAs carried out for high-risk processing
- Treatment measures approved with an action plan
- Data protection by design built into projects and changes
ResGuard modules: DPIA, Policy Framework