Skip to content
cyberGDPR

03 · Art. 35–36 · Area

Impact assessments (DPIA)

High-risk processing needs a DPIA before it goes live. Security teams own a large part of it: describing the system, assessing risks to people rather than to the company, and proving the measures that bring residual risk down. This area shows when a DPIA is required and how to contribute to one.

  1. DPIA for IT Projects: A Security Team's Guide to Article 35

    When a DPIA is mandatory under GDPR Article 35, the WP248 criteria, what the assessment must contain, and how security teams contribute to it.