GDPR Data Protection Impact Assessments (DPIAs): Articles 35 and 36 in Practice

When must you carry out a data protection impact assessment, what must it contain, and when must you go to the Commissioner before you start? This course works through Articles 35 and 36 of the General Data Protection Regulation (EU) 2016/679, the Article 29 Working Party Guidelines on DPIAs (WP248 rev.01) with their nine high-risk criteria, the Commissioner for Personal Data Protection's DPIA guidance and its Indicative List of 13 processing operations that require a DPIA in Cyprus, and the national DPIA requirements in Law 125(I)/2018. You will practise the method using the Commissioner's 24 indicative questions, and learn what the Digital Omnibus proposal would change.

Jurisdiction: Cyprus / EU · For: Data Protection Officers, Compliance Officers, Risk and IT Security Managers, Project and Product Owners, Directors, Lawyers · CPD units: 5 · Price: €120.00 · Pass mark: 50%

Learning time: 5 hours (300 minutes): about 107 minutes of reading, 173 minutes of case studies and self-check questions, and 20 minutes for the final test. The estimated time for each lesson is shown in its title and at the top of the lesson.

What this course covers

1. The Legal Framework and the High-Risk Test — Article 35(1), "risk" and "high risk", the three mandatory cases in Article 35(3), and when a single DPIA can cover several operations.
2. Deciding Whether a DPIA Is Required — the nine WP248 criteria, the "two criteria" rule of thumb, the Cyprus Indicative List, and when no DPIA is needed.
3. Who, When and Existing Processing — timing, the controller's responsibility, the DPO's advice, processors, data subjects' views, and reviewing existing processing.
4. Carrying Out the Assessment — the four minimum elements in Article 35(7), necessity and proportionality, risk assessment, mitigation, and the Commissioner's 24 indicative questions.
5. Prior Consultation with the Commissioner — when residual risk is high, what to submit, the 8 + 6 week timetable, and the Cyprus provisions that require DPIA and consultation.
6. Accountability, Sanctions and Reform — documenting and publishing DPIAs, review, fines and the section 33(1)(f) offence, a worked DPIA for a regulated firm, and the Digital Omnibus proposal.

Assessment and certificate

A 10-question scenario-based test follows the final lesson. The questions test the triggers, thresholds and procedures precisely, so read each lesson carefully. A 50% pass mark (5 of 10) is required, with unlimited retakes. On passing, a CPD certificate for 5 units is issued in your name, with a unique certificate number.

Legal sources

• Regulation (EU) 2016/679 (General Data Protection Regulation) on EUR-Lex
• Office of the Commissioner for Personal Data Protection (Cyprus), for the Commissioner's guidance and the unofficial English translation of Law 125(I)/2018

Legislation current as at: Regulation (EU) 2016/679 as published in the Official Journal; Law 125(I)/2018 as in the Commissioner's unofficial English translation. Translations are unofficial and provided for convenience only. Always check the Official Gazette of the Republic of Cyprus and the Official Journal of the EU for the current law.