Assessing GDPR Guidelines Part II: Data Impact Assessments

Following up on yesterday's blog about profiling and automated decision making, we now look at guidance on data protection impact assessment (DPIA). The same guidance we discussed also directs companies to conduct a DPIA where profiling or automated decision making results in the "systematic and extensive evaluation" of an individual and decisions are made based on that evaluation that could have legal effects.

Additional guidelines released by the Working Party last month (here) provide more detail on DPIAs and when a DPIA is required. DPIAs are tools to manage risk and can be used by companies to demonstrate compliance with GDPR requirements. They are only required where the processing of personal data under the GDPR is "likely to result in a high risk to the rights and freedoms of natural persons." The guidelines provide the following examples of processing that is likely to require a DPIA: