A DPIA is a risk assessment that is carried out for any activity that involves processing user data and are a key part of privacy best practice
Data Protection Impact Assessments (DPIAs) are a key part of privacy best practice. They also pose a unique challenge.
At the most basic level, a DPIA is a risk assessment that is carried out for any activity that involves processing user data.
Going to launch a new marketing campaign that involves sharing first-party data with a partner? Going to migrate your email database to a new platform? Going to start a Consumer Loyalty Program? All of these activities should include a DPIA.
In Europe, DPIAs are legally required in certain cases.
Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. – GDPR Article 35
DPIAs involve a variety of business departments working together in a way that is often unfamiliar. For data-reliant businesses, the volume of DPIAs that GDPR calls for and the unusual depth of coordination needed makes them very hard to do well. We wrote about it here.
Given this difficulty, and given that DPIAs are not “consumer-facing” in the same way as Data Subject Requests, many businesses have opted to take a “managed-risk” approach. They may conduct DPIAs only for the largest or riskiest operations and skip them for day-to-day activities that they deem lower risk. However, in the event that there are complaints about privacy practices, a lack of DPIA documentation will land them in hot water with regulators.
Today we’re announcing faster and more powerful Data Privacy and AI Governance support
See new feature releases enhancing user experience, adding new integrations and support for IAB GPP
Learn more about the privacy and data governance enhancements in Fides 2.27 here.
Read Ethyca’s CEO Cillian Kieran describe why and how an open data governance ontology enables companies to comply with data privacy regulations and frameworks.
Ethyca sponsored the Unpacking Privacy Engineering for Lawyers webinar for the Interactive Advertising Bureau (IAB) on December 14, 2023. Our CEO Cillian Kieran moderated the event and ran a practical discussion about how lawyers and engineers can work together to solve the technical challenges of privacy compliance. Read a summary of the webinar here.
Ethyca’s CEO Cillian Kieran hosted a LinkedIn Live about the newly agreed upon EU AI Act. Read a summary of his talk and find a link to his slides on what governance, data, and engineering teams need to do to comply with the AI Act’s technical risk assessment and data governance requirements.
Our team of data privacy devotees would love to show you how Ethyca helps engineers deploy CCPA, GDPR, and LGPD privacy compliance deep into business systems. Let’s chat!
Request a Demo