View source for Data Protection Impact Assessment (DPIA)

== Introduction ==
A '''Data Protection Impact Assessment''', also called a '''DPIA''' is a process required under Article 35 of the GDPR to help organizations identify and minimize the data protection risks of high-risk processing activities. It is especially important when using new technologies or handling sensitive data at scale. A DPIA ensures that privacy risks are assessed before processing begins and that appropriate safeguards are in place to protect individuals’ rights and freedoms.

A DPIA is necessary when data processing is likely to result in a high risk to individuals’ rights and freedoms—such as when using automated decision-making, profiling, large-scale processing of sensitive data, or systematic monitoring of public spaces. It is required '''before''' such processing begins to ensure risks are identified and mitigated in advance. The purpose of a DPIA is not only to protect individuals but also to help organizations demonstrate GDPR compliance, avoid legal or reputational harm, and implement privacy-by-design principles from the outset.

A DPIA is required when:

* System is used for systematic monitoring in a work environment, especially if used at scale
* AI is involved
* There is a potential risk to individuals' rights

As a rule of thumb, we advise deployers to conduct a DPIA. Please refer to the additional documentation, which includes a sample and a template specifically designed for Safety AI deployments.

== Guide and sample DPIA ==
{| class="wikitable" 
|- style="font-weight:bold; text-align:center;"
! Titles
! Explanations
! Sample Document
|- style="font-weight:bold;"
| colspan="3" |
=== 1. Project Description ===
Set the context for the deployment.
|-
| style="font-weight:bold;" | Project Name
| style="background-color:#ffffff;" | Choose a clear, descriptive name
| style="background-color:#ffffff;" | Safety AI Deployment for Logistics Area Monitoring
|-
| style="font-weight:bold;" | Description
| style="background-color:#ffffff;" | Briefly describe what the Safety AI system will do and where. Include zone coverage, system purpose, and any special setup.
| style="background-color:#ffffff;" | Installation of Event Gates Safety AI system on factory floor to detect and log safety-critical events involving personnel and machinery (e.g., person–forklift proximity).
|-
| style="font-weight:bold;" | Data Controller
| style="background-color:#ffffff;" | Enter your company name—the deployer is the data controller.
| style="background-color:#ffffff;" | XYZ Manufacturing Ltd.
|-
| style="font-weight:bold;" | Contact Person
| style="background-color:#ffffff;" | The responsible manager or DPO handling GDPR matters.
| style="background-color:#ffffff;" | Jane Doe, <br />Compliance Manager (jane.doe@xyz.com)
|-
| style="font-weight:bold;" | Date of Assessment
| style="background-color:#ffffff;" | When you start or update this DPIA.
| style="background-color:#ffffff;" | 24 June 2025
|- style="font-weight:bold;"
| colspan="3" |
=== 2. Purpose of Processing ===
Justify why personal data is processed.
|-
|
| style="background-color:#ffffff;" | Explain the safety goals (e.g., prevent accidents, improve incident response).
| rowspan="3" style="background-color:#ffffff;" | To enhance occupational safety by detecting, recording, and reporting unsafe interactions between workers and moving equipment (e.g., forklifts, cranes). Data is used for real-time alerts and incident analysis.
|-
|
| style="background-color:#ffffff;" | Be specific—link AI use to real, necessary safety functions.
|-
|
| style="background-color:#ffffff;" | This section supports your lawful basis (usually legitimate interest or legal obligation).
|- style="font-weight:bold;"
| colspan="3" |
=== 3. Nature of Personal Data Processed ===
Clarify what types of personal data are involved.
|-
| style="font-weight:bold;" | Types of data
| style="background-color:#ffffff;" | Include video recordings, logs, system metadata.
| style="background-color:#ffffff;" | Video footage (optional), AI-detected safety events, timestamped logs
|-
| style="font-weight:bold;" | Data subjects
| style="background-color:#ffffff;" | Who might be captured (e.g., employees, contractors, visitors).
| style="background-color:#ffffff;" | Factory employees, contractors, and authorized visitors who enter monitored zones
|-
| style="font-weight:bold;" | Identifiers
| style="background-color:#ffffff;" | State whether data is anonymized or could be indirectly identifying (e.g., uniform, patterns of movement).
| style="background-color:#ffffff;" | While names are not recorded, individuals may be indirectly identifiable via video or behavioral patterns (e.g., unique clothing, routine movement)
|- style="font-weight:bold;"
| colspan="3" |
=== 4. Data Flow and Storage ===
Document how data is collected, stored, and accessed.
|-
| style="font-weight:bold;" | Processing location
| style="background-color:#ffffff;" | Note that Event Gates Safety AI operates on edge, not in the cloud.
| style="background-color:#ffffff;" | On-edge device at each monitored zone (no cloud transfer)
|-
| style="font-weight:bold;" | Storage location
| style="background-color:#ffffff;" | Specify where recordings and logs are stored, how long they are kept, and who has access.
| style="background-color:#ffffff;" | Local edge device (internal SSD)
|-
| style="font-weight:bold;" | Retention
| style="background-color:#ffffff;" | Mention features like automatic deletion, no internet access, and secured physical access.
| style="background-color:#ffffff;" | Video footage and logs retained for max 7 days (configurable)<br />Automatic deletion by default
|-
| style="font-weight:bold;" | Access
| style="background-color:#ffffff;" |
| style="background-color:#ffffff;" | Restricted to safety personnel with login credentials and physical device access
|- style="font-weight:bold;"
| colspan="3" |
=== 5. Assessment of Necessity and Proportionality ===
Show that data processing is justified and minimal.
|-
| style="font-weight:bold;" | Necessity
| style="background-color:#ffffff;" | Explain why this method (AI + video) is necessary for the purpose.
| style="background-color:#ffffff;" | Monitoring is essential to prevent human–machine accidents in high-risk operational zones
|-
| style="font-weight:bold;" | Proportionality
| style="background-color:#ffffff;" | Describe minimization features: zone filtering, event-based logging, optional recording.
| style="background-color:#ffffff;" | No continuous surveillance; only event-triggered logging<br />Recording limited to incident-related events<br />Zones and rules configured to avoid unnecessary data capture<br />Video recording can be disabled entirely if not needed
|-
|
| style="background-color:#ffffff;" | Show that there’s no less-intrusive way to achieve the same safety goal.
| style="background-color:#ffffff;" |
|- style="font-weight:bold;"
| colspan="3" |
=== 6. Risks to Data Subjects ===
Identify potential GDPR risks.
|-
|
| style="background-color:#ffffff;" | Use a table to rate risks (e.g., unauthorized access, over-monitoring, inability to fulfill access requests).
| style="background-color:#ffffff;" | [[Data Protection Impact Assessment (DPIA)#Sample risk table|See table below]]
|-
|
| style="background-color:#ffffff;" | Consider likelihood, impact, and what mitigations you’ve applied.
| style="background-color:#ffffff;" |
|-
|
| style="background-color:#ffffff;" | Event Gates features like on-edge processing, no facial recognition, and access control help reduce risk.
| style="background-color:#ffffff;" |
|- style="font-weight:bold;"
| colspan="3" |
=== 7. Measures to Mitigate Risks ===
List safeguards you have in place.
|-
| style="font-weight:bold;" | Technical
| style="background-color:#ffffff;" | Built-in system features and configurations that enforce data protection through design and technology.
| style="background-color:#ffffff;" | On-edge processing (no cloud dependency)<br />Optional blurring of persons in recorded footage<br />Password-protected user interface with audit logs<br />Automatic deletion of video and logs based on retention settings<br />No facial recognition or biometric profiling
|-
| style="font-weight:bold;" | Organizational
| style="background-color:#ffffff;" | Internal controls and resource management practices that govern who can access data and how systems are operated.
| style="background-color:#ffffff;" | Data access limited to trained safety staff
|- style="font-weight:bold;"
| Process-based
| style="background-color:#ffffff; font-weight:normal;" | Policies, documentation, and routines that ensure consistent, compliant handling of personal data and privacy responsibilities.
| style="background-color:#ffffff;" | Clear internal policy defining processing purposes and operational restrictions
|- style="font-weight:bold;"
| colspan="3" |
=== 8. Consultation ===
Demonstrate accountability and awareness.
|-
|
| style="background-color:#ffffff;" | Document any internal consultation with your DPO or legal team.
| style="background-color:#ffffff;" | Internal consultation with DPO and legal department
|-
|
| style="background-color:#ffffff;" | Note whether external advice was sought (only required for high-risk cases).
| style="background-color:#ffffff;" | No external supervisory authority contact required at this stage
|-
|
| style="background-color:#ffffff;" | State how data subjects are informed (e.g., signage, employee briefings, privacy notices).
| style="background-color:#ffffff;" | Staff informed via updated safety policy and signage in monitored areas
|- style="font-weight:bold;"
| colspan="3" |
=== 9. Conclusion ===
Sum up the overall risk and your readiness.
|-
|
| style="background-color:#ffffff;" | Briefly confirm whether privacy risks are acceptable with the safeguards in place.
| style="background-color:#ffffff;" | The Safety AI deployment at XYZ Manufacturing is deemed low risk when configured and operated as described. <br />The system supports privacy-by-design through edge processing, role-based access, and configurable data minimization features.
|-
|
| style="background-color:#ffffff;" | Note whether any actions are still required (e.g., install signage, finalize DPA).
| style="background-color:#ffffff;" | No further mitigation required at this stage.
|-
|
| style="background-color:#ffffff;" | If the system is compliant and no further risk exists, you can conclude the DPIA.
| style="background-color:#ffffff;" |
|}

=== Sample risk table ===
{| class="wikitable" style="background-color:#ffffff;"
|- style="font-weight:bold; text-align:center; background-color:#EFEFEF;"
! Risk
! Likelihood
! Severity
! Mitigation
|-
| Unauthorized access to video or logs
| Medium
| High
| Role-based access, physical security
|-
| Excessive monitoring leading to surveillance concerns
| Low
| Medium
| Zone-based filtering, optional video logging
|-
| Inability to respond to data subject rights
| Low
| Medium
| Internal procedures in place, DPO appointed
|-
| Data reuse beyond safety purposes
| Low
| High
| Purpose limitation enforced by configuration
|}
[[Category:Privacy]]