Technology And Regulation: DPIAs "Triggers" - Cheat Sheet

The General Data Protection Regulation ("GDPR") requires organisations processing personal data to be proactive with respect to their data-processing activities, including by continuously monitoring and evaluating said activities to ensure they meet the GDPR's principles and requirements. A key requirement under the GDPR is to undergo a Data Protection Impact Assessment ("DPIA"), both as an ongoing need to assess their processing activities' associated risks and as a result of certain changes or events in an organisation's life cycle. This is also one of the key responsibilities of the Data Protection Officer of the company.

During recent months various data protection regulators across the EU have published updated guidelines concerning when and how organisations must carry out DPIA. These recent regulatory changes demonstrate that during 2019, data protection regulators across the EU are expected to initiate more enforcement actions against companies that failed to