Identify and minimise data protection risks for processing activities that may result in high risk to the rights and freedoms of data subjects.
Legal Framework
Relevant provisions under NDPA and GAID
Section 28 of the NDP Act - Data Protection Impact Assessment
Where processing, in particular using new technologies and taking into account the nature, scope, context, and purposes of processing, is likely to result in high risk to the rights and freedoms of a data subject, the data controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
GAID Regulation - Mandatory DPIA Scenarios
The GAID specifies that a DPIA is mandatory for processing activities involving: evaluation or scoring (profiling); automated decision-making with legal effects; systematic monitoring; sensitive data; vulnerable data subjects; innovative technology; communication software development; digital financial services; healthcare; e-commerce; surveillance cameras; public policy development; educational services; hospitality services; and cross-border data transfers.
What is a Data Protection Impact Assessment?
A Data Protection Impact Assessment (DPIA) is a process designed to help organisations systematically analyse, identify, and minimise the data protection risks of a project or processing activity. It is a key tool for accountability and helps demonstrate compliance with the NDPA.
Step 1
Describe
The processing and its purposes
Step 2
Assess
Necessity and proportionality
Step 3
Identify
Risks to data subjects
Step 4
Mitigate
Measures to address risks
When is a DPIA Mandatory?
Under Section 28 of the NDP Act and GAID Regulations
Evaluation or scoring (profiling)
Automated decision-making with legal or similar effects
Systematic monitoring of individuals
Processing of sensitive or highly personal data
Processing data of vulnerable data subjects
Innovative processes or new technological solutions
Development of communication software
Digital financial services
Healthcare services
E-Commerce services
Surveillance cameras in public places
Legal instruments or public policy processing
Educational services involving student records
Hospitality services
Cross-border data transfers
What Must a DPIA Contain?
Systematic Description
A detailed description of the envisaged processing operations and purposes, including legitimate interests where applicable.
Necessity and Proportionality Assessment
An assessment of whether the processing is necessary and proportionate to the purposes.
Risk Assessment
An assessment of risks to the rights and freedoms of data subjects, including likelihood and severity.
Measures to Address Risks
The measures envisaged to address the risks, including safeguards, security measures, and mechanisms to ensure protection of personal data.