Regulation and data
Data protection impact assessment (DPIA)
A data protection impact assessment (DPIA) is the analysis a controller carries out before starting processing that is likely to pose a high risk to people's rights: it describes the processing, assesses its necessity and its risks, and sets the measures to reduce them (art. 35 of the GDPR).
Also known asDPIA · impact assessment · EIPD
When it is needed
Art. 35.3 of the GDPR requires one in three cases: profiling with automated decisions that affect people, large-scale processing of special categories, and systematic large-scale monitoring of a publicly accessible area. For everything else, the AEPD, the Spanish data protection authority, publishes an indicative list (art. 35.4) and says one will be needed in most cases where two or more of its criteria are met. Several fit a student residence:
- Special categories, such as dining-hall allergies, which are health data.
- Data of children under fourteen or of other vulnerable people.
- Large-scale data, or the matching of databases with different purposes.
- Systematic monitoring, such as an access control system that logs every entry and exit.
- New technologies, or a familiar one used in a new way, such as an AI assistant that answers residents.
Worth knowing
It belongs to the controller, and it comes first. The centre carries it out, with the advice of its data protection officer if it has one (art. 35.2), and the supplier processing the data on its behalf has to help (art. 28.3.f). At a minimum it covers a description of the processing, its necessity and proportionality, the risks and the measures (art. 35.7). If the risk remains high, the AEPD has to be consulted before starting (art. 36). Spain's LOPDGDD adds the higher-risk situations every controller must weigh (art. 28.2).
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- Data protection officer (DPO)The data protection officer (DPO) is the person, on the staff or engaged from outside, who informs and advises the controller and the processor, monitors their compliance and deals with the supervisory authority and with data subjects. Arts. 37 to 39 of the GDPR and 34 to 37 of Spain's LOPDGDD govern the role.