Lexagone supports you in setting up and monitoring your Data Protection Impact Analysis (DPIA).
Identify your risky processing, secure your processes, and ensure GDPR compliance to sustainably protect your data and your organization.
Request a free consultation today!
Since 2018, Lexagone has carried out DPIAs for innovative processing operations, some of which have been submitted to the CNIL as an external DPO or GDPR consulting firm.
These assignments have enabled our GDPR experts to identify the CNIL’s requirements very early on and to test the EBIOS Risk Manager method.
Thus, for the completion of your DPIAs, we work closely with the business lines, the RSSI and the information systems department (DSI) in order to map very precisely the technical and organizational aspects of the risky processing in order to assess the seriousness and likelihood of the feared events.
DPIAs are mandatory for any processing of personal data that presents a high risk to the rights and freedoms of the persons concerned.
The CNIL has established the list of types of processing operations for which it is mandatory to carry out a DPIA. Here is an extract from the list:
DPIAs are also mandatory for processing operations that include at least two of the nine criteria from the G29 guidelines:
A DPIA is divided into three parts:
The DPIA report must determine the technical and organizational measures necessary to eliminate or mitigate the likelihood of data breach risks occurring and the level of material and moral impact on individuals.
NB: Data Protection Impact Assessment (DPIA), Privacy Impact Assessment (PIA), Data Protection Impact Assessment (DPIA) and PIA (Privacy Impact Assessment) are synonymous terms.
The data controller (DC) has the obligation to ensure the compliance of its personal data processing.
If the DC has appointed a data protection officer, it asks for advice and instructs it to ensure the execution of the DPIA.
If a subcontractor is involved in the processing, it must provide its assistance and the information necessary for the completion of the DPIA.
Finally, the data controller should also seek the opinion of the persons concerned by the risky processing or, otherwise, justify this non-solicitation.
For your dpia to be complete, the professions (project management) and the persons in charge of information systems security must participate in the process of producing the DPIA and its validation.
As a preliminary step, a DPIA must contain:
To meet these obligations, several methods are possible. Indeed, the data controller is free to choose it, but whatever the method chosen, it must comply with the criteria defined in Appendix 2 of the G29 guidelines.
However, for the sake of efficiency and pragmatism, it is strongly recommended to use the EBIOS Rick Manager method chosen by the CNIL and ANSSI, which Lexagone also uses.
Mail : contact@lexagone.fr
Phone : +33 (0)972 169 310
Our GDPR consulting firm offers external DPO services managed by teams of specialized legal experts to ensure controlled GDPR governance.
Member of
Referenced by
