Module 4 of 8 · About 15 minutes
Accountability: records, DPIAs and processors
The documentation and governance that let an organisation demonstrate compliance.
Records and design
Article 30 requires records of processing activities: purposes, categories of data and data subjects, recipients, transfers, retention periods and security measures. Organisations with fewer than 250 employees are exempt only where processing is occasional, unlikely to result in a risk and does not include special-category or criminal data — in practice most organisations need records. Article 25 requires data protection by design and by default: safeguards built in from the start, and only the data necessary processed by default.
Data protection impact assessments
Article 35 requires a DPIA before processing that is likely to result in a high risk to individuals, in particular systematic and extensive profiling with significant effects, large-scale processing of special-category or criminal data, and large-scale systematic monitoring of publicly accessible areas. Supervisory authorities publish lists of processing that needs a DPIA. A DPIA describes the processing, assesses necessity and proportionality, assesses the risks to individuals and sets out the measures to address them. The controller must seek the DPO’s advice. If high risk remains after mitigation, the controller must consult the supervisory authority before processing (Article 36).
Processors and joint controllers
A processor acts only on the controller’s documented instructions. Article 28 requires a binding contract covering the subject matter, duration, nature and purpose of processing and the types of data, with obligations on confidentiality, security, sub-processors, assistance with rights and breaches, deletion or return at the end, and audits. Joint controllers (Article 26) must set out their respective responsibilities in an arrangement and make its essence available to individuals.
Key points
- Most organisations need records of processing, whatever their size.
- A DPIA is required before likely high-risk processing, and the DPO’s advice must be sought.
- High risk that cannot be mitigated means prior consultation with the supervisory authority.
- Every processor relationship needs an Article 28 contract.
Check your understanding
Who carries out a DPIA — the DPO or the controller?
Show answer: The controller is responsible; the DPO advises on it and monitors its performance.
A cloud provider stores your HR files and acts only on your instructions. What is it, and what do you need?
Show answer: A processor; you need a contract that meets Article 28.