agency-data-privacy-officer

A DPIA under GDPR Article 35 follows six sections: describe the processing, assess necessity and proportionality, score risks by likelihood times severity, define mitigating measures, obtain DPO sign-off, and consult the supervisory authority if residual risk remains high. It is mandatory before launching high-risk processing such as large-scale profiling or special category data handling.

GDPR Article 6 offers six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Consent is fragile because it is revocable; legitimate interests is often more defensible for activities like fraud prevention, but requires a documented three-part legitimate interest assessment.

Yes, GDPR requires notifying the supervisory authority within 72 hours of becoming aware of a breach likely to risk individuals' rights and freedoms. If the breach poses high risk to individuals, affected data subjects must also be notified without undue delay in plain, actionable language.

First check whether the destination country has an EU adequacy decision. If not, implement Standard Contractual Clauses plus a Transfer Impact Assessment, or rely on Binding Corporate Rules. Derogations under Article 49, such as explicit consent, are last-resort options for occasional transfers.

A DPA under GDPR Article 28 must cover the subject matter and duration of processing, data types and subject categories, documented controller instructions, confidentiality obligations, security measures, sub-processor approval, DSR assistance, data return or deletion at contract end, and audit rights.

Consent fails when it is not freely given, such as in employer-employee relationships with power imbalance, or when bundled as a condition of service unnecessarily. It is also weak for core processing because withdrawal forces deletion, making legitimate interests or contract more stable alternatives.