DATA PROTECTION
The Spanish Data Protection Agency (AEPD) publishes a checklist to facilitate the carrying out of the DPIA.
The Spanish Data Protection Agency (AEPD) has published a checklist to help controllers quickly identify and determine if the process and documentation they are following to carry out a data protection impact assessment ( DPIA) contain the required elements.
The AEPD has made available a substantial guide entitled "Risk management and impact assessment in the processing of personal data", which facilitates the mandatory management of risk in the governance processes of institutions and, where appropriate, in the DPIA.
The previous Guide is therefore integrated with the checklist in order to carry out a final check - once the impact assessment has been developed and documented - to ensure that all aspects included in the data protection rules have been taken into account. consideration.
The aim of this new AEPD resource - the checklist - is also to help managers comply with the obligations to develop and document a DPIA and so that, in case it is later necessary to carry out prior consultation with the Supervisory authority pursuant to art. 36 GDPR, it is then easier to verify that the requirements for its presentation are met.
The AEPD has made available a substantial guide entitled "Risk management and impact assessment in the processing of personal data", which facilitates the mandatory management of risk in the governance processes of institutions and, where appropriate, in the DPIA.
The previous Guide is therefore integrated with the checklist in order to carry out a final check - once the impact assessment has been developed and documented - to ensure that all aspects included in the data protection rules have been taken into account. consideration.
The aim of this new AEPD resource - the checklist - is also to help managers comply with the obligations to develop and document a DPIA and so that, in case it is later necessary to carry out prior consultation with the Supervisory authority pursuant to art. 36 GDPR, it is then easier to verify that the requirements for its presentation are met.
