EU GDPR Article 35(1), (3) and (7) — Data protection impact assessment

Where this comes from

Who it applies to

What engineering work it implies

• FRIA / DPIA Assessment ScaffoldCovers it fully

  An assessment record carrying the Article 27(1)(a)-(f) headings and the WP248 DPIA sections in one artefact, stored with the project and linked to the evidence that...

Related obligations

Where the same control satisfies more than one framework — comply once, cover many.

• EU Artificial Intelligence ActComplementary
  Training, validation, and testing datasets for high-risk AI must meet quality criteria and be subject to governance practices addressing bias, representativeness, and data originArticle 10 — Data and data governance
• EU Artificial Intelligence ActPartially covered by
  Public-law bodies, private entities providing public services, and deployers of creditworthiness or life/health-insurance AI must complete a fundamental rights impact assessment before first use of a high-risk AI system and notify its results to the market surveillance authorityArticle 27 — Fundamental rights impact assessment for high-risk AI systems
• EU Artificial Intelligence ActComplementary
  High-risk AI systems require a continuous, documented risk management system covering the entire lifecycle — from design through post-market monitoringArticle 9 — Risk management system
• EU GDPR Children's Provisions (Article 8)Equivalent requirement
  Conduct a Data Protection Impact Assessment before processing children's data, as processing data of vulnerable persons (including children) is considered likely to result in high riskArticle 35 / Recital 75 - Data protection impact assessment for children's data
• EU General Data Protection RegulationPrerequisite
  Consult the supervisory authority before processing when a DPIA shows the residual risk stays high despite the mitigations plannedArticle 36(1) and (3) — Prior consultation

Evidence an auditor expects

• Assessment documentDocument reviewReviewed Art. 35(11): review where necessary, and at least when there is a change of the risk represented by the processing operations

  Data protection impact assessment report containing the Art. 35(7) minimum content

  A DPIA carried out PRIOR to the processing containing at least: (a) a systematic description of the envisaged processing operations and the purposes, including where applicable the legitimate interest pursued; (b) an assessment of the necessity and proportionality of the processing in relation to the purposes; (c) an assessment of the risks to the rights and freedoms of data subjects; and (d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance. Art. 35(9): where appropriate, the views of data subjects or their representatives must be sought

• Process recordDocument review

  DPO advice record (Art. 35(2)) and the screening decision for processing where no DPIA was carried out

  Evidence that the controller sought the advice of the data protection officer where one is designated, together with the advice given; and, for processing screened and found not to require a DPIA, a dated record of the screening and its reasons — the accountability artefact under Art. 5(2) is the screening decision, not only the DPIA

• Process recordDocument reviewRecommended

  Processor assistance evidence (Art. 28(3)(f))

  Where processors are engaged, evidence of the assistance they provided to the DPIA under Art. 28(3)(f), and the contractual term requiring it

Questions people ask

Does EU GDPR Article 35(1), (3) and (7) — Data protection impact assessment apply to my service?

It applies when Service processes personal data; and at least one of: DPIA screening criteria includes Evaluation or scoring, including profiling and predicting; DPIA screening criteria includes Automated decision-making with legal or similarly significant effect; DPIA screening criteria includes Systematic monitoring of people, including in publicly accessible areas; DPIA screening criteria includes Sensitive data, or data of a highly personal nature; DPIA screening criteria includes Processing on a large scale; DPIA screening criteria includes Matching or combining datasets from different processing operations; DPIA screening criteria includes Data about vulnerable people, such as children, employees or patients; DPIA screening criteria includes Innovative use of new technological or organisational solutions; DPIA screening criteria includes Processing that stops people exercising a right, or using a service or contract; Service makes solely automated decisions with legal or similarly significant effects; Service deploys AI systems in a professional capacity. It does not apply where Art. 2(2)(c): the Regulation does not apply to processing of personal data 'by a natural person in the course of a purely personal or household activity'. Recital 18 keeps controllers or processors providing the means for such processing in scope. (GDPR Art. 2(2)(c)).

When does this become enforceable?

EU GDPR Article 35(1), (3) and (7) — Data protection impact assessment is enforceable from 25 May 2018. Its current status is: in force.

What evidence does an auditor expect?

Data protection impact assessment report containing the Art. 35(7) minimum content; DPO advice record (Art. 35(2)) and the screening decision for processing where no DPIA was carried out; Processor assistance evidence (Art. 28(3)(f)).