2.5 When do I process personal data with a high risk and what should I take into account?

Oplossing

If the type of data or the nature of the processing probably entails a high risk for those involved, you are required by GDPR to carry out an additional risk analysis before the start of the processing, a so-called data protection impact assessment (DPIA, also known as GEB).

The following questions (which are included in the register) help to determine if there is a high risk.

If the data were made public, would this have a major impact on those involved?	YES NO
Do you work with special categories of personal data?	YES NO
Do you process personal data of vulnerable groups?	YES NO
Do you process data on a large scale? When answering, take into account the absolute amount of personal data, but also the size of the sample with regard to the relevant population?	YES NO
Will the data be transferred to a country outside the EU that is not on the "white list"?	YES NO
Are you going to link different (special categories of) personal data to each other?	YES NO
Do the processing operations have legal consequences or a similar effect for the data subject such as exclusion or discrimination against the data subject?	YES NO
Do the processing operations have the effect of preventing the data subject from exercising his rights or using a service or contract?	YES NO
Are you going to systematically monitor people in public places?	YES NO
Do the processes serve to draw up profiles of people and to make predictions?	YES NO
Do you make innovative use of technological applications such as the combined use of fingerprint and face recognition for access control?	YES NO
Do you work with non-pseudonymised personal data?	YES NO

If every question is answered with NO, your research is probably not a high risk for those involved.

If one or two or more questions are answered with YES, then your research probably involves a high risk for those involved. During a DPIA you fill in a form with which you can assess privacy issues and the resulting measures to solve potential privacy problems at an early stage.

It is important to document this DPIA and, if necessary, adjust it during the course of the project.

Was dit artikel bruikbaar? ja / nee