The document is a practical guide for conducting a Data Privacy Impact Assessment (DPIA) to ensure compliance with GDPR and assess risks associated with personal data processing. It outlines steps for preparation, discovery, and remediation, emphasizing the importance of involving stakeholders and following best practices to mitigate privacy risks. Failing to perform a DPIA when necessary can lead to significant fines from supervisory authorities.

1. DATA PRIVACY IMPACT
ASSESSMENT
A PRACTICAL GUIDE FOR PERFORMING
CLOUD SECURITY & DATA PRIVACY ARCHITECT PROFESSIONAL
FELLOW OF INFORMATION PRIVACY◉ CISSP ◉ CCSK◉ AWS-CSA(PROF) ◉ FIP CIPP/E CIPM
STEPHEN OWEN

2. COUNTDOWN TO MAY 25TH
WHY PERFORM A DPIA ?
◉ HELPS ASSESS THE IMPACT OF PROCESSING PERSONAL DATA
◉ REQUIRED WHEN PROCESSING IS LIKELYTO RESULT IN HIGH RISKTO
INDIVIDUALS’ RIGHTS & FREEDOMS
◉ NOT MANDATORY FOR ALL PROCESSING OPERATIONS BY GOOD PRACTICE
Under the GDPR, non compliance with DPIA requirements
can lead to significant fines imposed by ICO or other EU lead
supervisory authorities
A DPIA is a process designed to describe the processing,
assess the necessity and proportionality of a processing and
to help manage the risks to the rights and freedoms of an
individual

3. WHY ELSE PERFORM A DPIA ?
DEMONSTRATE POSITIVESTEPS TOWARDS COMPLIANCE ◉ AIDS OPERATION OF YOUR INFORMATION
SECURITY MANAGEMENT SYSTEM ◉STIMULATES CLARITY, RELEVANCE AND CURRENCY
DPIA ROI
INVENTORY
VENDOR CONTRACTS
RETENTION PERIODS
PRIVACYNOTICES
SECURITYCONTROLS
VENDOR RISK ASSESSMENTS
SUBJECT ACCESS REQUESTS
PROCESSING REASONS
PRIVACY DEBT REGISTER& RISKLOG
CONSENT

4. GET HELP FROM CERTIFIED PROFESSIONALS!!
PREPARATION
◉ LISTVENDORS WHO ACCESS OR PROCESS PERSONAL DATA YOU CONTROL
◉ IDENTIFY DATACUSTODIANS
◉ COMPARTMENTALISE INTERNAL SYSTEMS
◉ PERSONAL / SENSITIVE DATA
◉ NUMBER OF RECORDS & RETENTION PERIODS
◉ TYPE OF PROCESSING ACTIVITES
SPEND PROPORTIONALTIME
◉ SECURITY POSTURE
◉ DEVISE METRICS & SCORING MATRIX

5. MAPPING DATA FLOWS
DISCOVERY
◉ USE PLAIN LANGUAGE IN COMMMUNICATIONS AND QUESTIONNAIRES
DISCOVERYSCOPETOPICS ◉ WHO WHAT WHY WHEN WHERE HOW
◉ CONSIDER GEOGRAPHIES – WHERE DOES MY DATA FLOW
◉ HOW IS DATA USED?
◉ HAS DATA BEEN ENRICHED WITH OTHER DATA?
◉ RETENTION POLICES & PERIODS
◉ TYPES & LOCATIONS OF STORAGE
◉ WHAT SECURITY CONTROLS PROTECTING DATA
◉ ADEQUATE CONTRACTUAL CLAUSES

6. DISCOVERY RESULTS
OBSERVATIONS
◉ IS DATA COLLECTED EXCESSIVE◉ NECESSARY◉ RELEVANT FOR PURPOSE?
◉ IS PROCESSED DATA ADEQUATE◉ ACCURATE◉ UP TO DATE?
◉ IS DATA RETENTION LEGITIMATE & APPROPRIATE?
◉ IS PERSONALINFORMATIONUSEDIN A WAY EXPECTEDBY THE INDIVIDUAL
◉ ARE SUBJECT ACCESS REQUEST PROCESSES IN PLACE & ADEQUATE?
◉ IS CONSENT FREELY GIVEN & RECORDED?
◉ ARE TECHNICAL CONTROLS APPROPRIATE & ADEQUATE?
◉ IS THERE A FORMAL PROCESS FOR PRIVACY TRAINING AND AWARENESS?
◉ IS DATA ACCESS RECORDED?
◉ INFORMATION CLASSIFICATION & DISCLOSURE CONTROLS?

7. TAKE REASONABLE STEPS
REMEDIATION
◉ REDUCE PRIVACY RISK ◉ ELIMINATE ◉ REDUCE ◉ ACCEPT
◉PRIORITISE DISCOVERY RESULTSINTO ACTIONS
◉POST IMPLEMENTATION GAP ANALYSIS FOR RESIDUAL
PRIVACY RISK
◉ OBTAIN SIGN-OFFBEFORE REMEDIATION
◉ FLAG REMEDIATION RAG STATUS TO SENIOR
STAKEHOLDERS

8. TAKE A HOLISTIC APPROACH
TOP TIPS
◉ USE EXISTING ORGANISATIONAL TAXONOMIES & ARCHITECURE ARTIFACTS
◉CONSIDER SWIM-LANES DIAGRAMS FOR SENSITIVE DATA
◉ADAPT APPROACH FROM DISCOVERY RESULTS
◉ENGAGE STAKEHOLDERS EARLY IN THE PROCESS
EMBED IN TO BAU
◉ COLLABORATE WITH INTERNAL STAKEHOLDERS AT CONCEPT
◉EMPLOY PRIVACY-BY-DESIGN
◉ PLAN & SCHEDULE VENDOR ASSESSMENT REVIEWS
◉CAPTURE CHANGES ◉ VENDOR ◉ SYSTEMS
◉PLAN & SCHEDULE VENDOR CONTRACT REVIEWS

9. QUESTIONS & FEEDBACK
CLOUD SECURITY & DATA PRIVACY ARCHITECT PROFESSIONAL
FELLOW OF INFORMATION PRIVACY◉ CISSP ◉ CCSK◉ AWS-CSA(PROF) ◉ FIP CIPP/E CIPM
STEPHEN OWEN