ARTICLE · 07 SEPTEMBER 2018

When Do Organisations Need To Carry Out A Data Protection Impact Assessment? German Authorities Provide Guidance

Reed Smith (Worldwide)

The German data protection authorities (German DPAs) have jointly released a list of processing activities (List) that are subject to a data protection impact assessment (DPIA). The List contains 16 examples.

GermanyPrivacy

Sven Schonhofen LL.M.

Dr. Alexander Hardinghaus, LL.M.

Author LinkedIn connections

What is a DPIA?

DPIAs shall help identifying, assessing and minimising the data protection risks of a project in which personal data are processed. Especially broader risks to the rights and freedoms of individuals, resulting from the processing, shall be assessed and mitigated by appropriate countermeasures.

DPIAs also support the General Data Protection Regulation's (GDPR) accountability principle, helping organisations to prove that they have taken appropriate measures as required by GDPR, so that a compliant processing is possible.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

When Do Organisations Need To Carry Out A Data Protection Impact Assessment? German Authorities Provide Guidance

What is a DPIA?

Related Articles

Do We Have An Expectation Of Privacy In Public? AI Glasses May Change The Answer

Workplace Investigations Versus Privacy: Why Investigation Data Does Not Automatically Belong In Personnel Files

Avoiding Unauthorized Display Of Sensitive Personal Data (Such As A User's Facial Image) During A Payment Authentication Process: Non-technical

EuGH: Erster Antrag auf Auskunftserteilung kann nach DSGVO als missbräuchlich abgelehnt werden

CJEU: First Request For Access May Be Rejected As Abusive Under GDPR

Read more about

Related Comparative Guides

Data Protection & Cybersecurity

See more popular content from

Data Protection Authority Issues First German Fine Under GDPR

EU Proposes Sweeping Reforms To The GDPR, Cookie Rules, Data Act, And Breach Reporting

Action Required For Providers Of Connected Devices: Challenges Under The EU Data Act

CJEU: First Request For Access May Be Rejected As Abusive Under GDPR

Germany To Expand Consumer Associations' Right To Sue Companies For Breach Of Data Protection Laws

GDPR Representatives In The EU And The UK After Brexit

Decision By German Higher Regional Court Koblenz: Consent For Publication Of Interview Not Revocable

CJEU's Russmedia Decision Expands Platform Controller Duties Under GDPR

Windows Pain? German Report Casts Doubt On Microsoft GDPR Compliance

GDPR Fine For Failure To Appoint An EU Representative