Processing likely to result in a high risk to individuals requires a data protection impact assessment (article 35 of the GDPR). In MyZapp, it is kept under Data protection › Impact assessments, linked to the activities of the processing register it covers.
Create the assessment
Choose the legal entity, give a title, then New assessment. On its page, tick the register activities covered. The three feared events of article 35 are already set: illegitimate access, unwanted modification, disappearance of data.
The screening questionnaire
The page lists the 9 criteria of the European Data Protection Board guidelines: evaluation or scoring, automated decision, systematic monitoring, sensitive data, large scale, matching data, vulnerable people, innovative use, processing that prevents exercising a right. The assessment is required as soon as 2 criteria are met.
If your country's authority has published its lists (types of operations that require an assessment, or are exempt) and they have been imported, they appear under Authority's list and prevail over the count.
An assessment that is not required, or a decision that differs from the questionnaire, is always justified. The result is reported on the register activities.
The content of the assessment
- Description of the processing: nature, scope, context, purposes, data, flows.
- Necessity and proportionality: legal basis, minimization, retention, information and rights of individuals.
- Risks: for each feared event, rate severity and likelihood from 1 (negligible) to 4 (maximum), before and after the measures. A risk is high when both ratings reach 3. The residual risk of the assessment is the highest one after the measures.
Save: while the assessment is a draft, everything can be changed.
Measures and action plan
Add the existing and planned measures. A planned measure has a due date and, if possible, an owner (their account address): they get a reminder 7 days before the due date and mark it Done.
Opinion, approval, consulting the authority
- Submit to the data protection officer: the questionnaire, activities, description, necessity and risks must be filled in.
- The officer gives an opinion, favorable or not.
- The controller approves the assessment. The views of the data subjects or their representatives must have been sought first, or the reason for not seeking them noted.
- If the residual risk remains high, approval is refused: Consult the authority first (article 36). The response deadline (8 weeks, extendable by 6) is tracked and reminded. On the response, the processing can be approved with the authority's conditions, or given up.
Versions, review and PDF
Each step creates a version. To change an assessment already submitted or approved, reopen it: the opinion and approval lapse and remain visible in the versions. An approved assessment is reviewed periodically; the officer gets a reminder when it is due. The PDF button produces the full assessment document.
Artificial intelligence is not needed: the whole assessment can be carried out by hand.