Data Protection Impact Assessment (DPIA)

What makes PrivacyEngine^TM Data Protection Impact Analysis (DPIA) different?

A DPIA will deliver real benefits and return on your investment (ROI).

The ROI can be realised through:

• Demonstrate compliance internally & externally
• Mitigate against the risk of possible reputational damage in the form of Data Breaches
• Protect brand value
• Enhanced customer satisfaction & engagement
• Higher customer retention levels
  
  

PrivacyEngine^TM Data Protection Impact Assessment (DPIA) 6-Step Process

The PrivacyEngine DPIA is a 6-step process specifically designed to identify and address all Data Protection risks within a new or existing project.

Step 1: Stakeholders, Systems and Entities
A complete list of stakeholders, entities and systems. Anyone or anything that processes personal data should be considered in this category. This could be a job role, a person, a third party or a computer system.

Step 2: Identify Processes
A complete list of data management processes. A process is any event that is required to complete a business function. The focus is on processes that involve personal and special categories of data.

Step 3: Workflow Analysis
For processes identified in Step 2, we assess via our facilitated collaborative workshops what data is processed, what systems have visibility of this data, where the data is processed and who has access to it.

Step 4: Data Protection Assessment
For each process identified in Step 3, we categorise the processing according to UK Data Protection Act 2018 (GDPR) compliance requirements, areas of consideration and evaluation of potential risk.

Step 5: Risk Analysis
A Risk Register is created in parallel with Step 4 to measure risk against likelihood and severity. A point in time heat map is generated for executive /c-suite leadership attention as to the current risk status.

Step 6: Implementation
An agreed implementation plan is formalised into actionable items and after implementation a new point in time heat map is generated to reflect progress and identify next steps.

The PrivacyEngine DPIA workshop typically involves several key stakeholders within an organisation and is overseen by an internal sponsor who is either the current Data Protection Officer / Lead or is intended to take up this role in the medium term.

A DPIA engagement can vary depending on the customer and the complexity of the proposed processing change. Our experienced team of data protection consultants will work with you to identify the most suitable candidates for the assessment workshop.