A data protection impact assessment (DPIA) assesses in advance the risks that processing personal data poses for the data subjects. Under the Swiss FADP (Art. 22), it is required if processing is likely to result in a high risk. In Varmo, the protection requirements assessment of a system shows whether a DPIA is required; it is then created and approved directly on the asset. This article is aimed at asset owners, the data protection approver and ISMS managers.

Before you start

  • The DPIA is created by the owner of the system or by whoever may carry out its protection requirements assessment.
  • It is approved by the Confirmation by data protection approver. For new organisations, the functional role Data protection advisor is preset for this; the ISMS managers can choose a different role, including a custom functional role, in the settings of the protection requirements assessment. If the functional role does not yet have any members, the approval waits until someone fills it. Without this approver, assessments with personal data cannot be submitted.
  • How a DPIA is assessed is set under ISMS settings › Assets › Data protection impact assessment: the Impact on data subjects scale, the result per risk level, the suggested Risks for the data protection impact assessment with scenarios and the Details of processing. It is based on your active risk methodology.
  • The DPIA is included in all plans.

When a DPIA is required

If a system processes personal data, its owner answers the questions of the risk pre-assessment in the protection requirements assessment. For personal data with a high protection requirement, such as sensitive personal data, Varmo always asks all questions; for ordinary personal data, it first asks the triggers and only asks all questions if one applies. If a rule applies, a DPIA is required.

The ISMS managers maintain questions and rules under ISMS settings › Assets › Protection requirements assessment in the Risk pre-assessment and data protection impact assessment section. The questions and rules prescribed by law (Art. 22 FADP) are fixed; your organisation can add its own but cannot remove any.

  1. Protection requirements assessmentDPIA required

    A rule of the risk pre-assessment applies.

  2. OwnerCreate and assess

    Describe the processing, assess risks before and after the measures.

  3. Data protectionApprove

    Never the person who created or submitted the DPIA.

High risk

When approving, the consultation with date, result and evidence (PDF) is required.

Rejected

The person who created it revises the DPIA and submits it again.

The path of a DPIA

The protection requirements assessment of the system shows that a DPIA is required. The owner describes the processing, assesses the risks before and after the measures and submits the DPIA. The Confirmation by data protection approver approves it; in the case of high risk, they record the consultation with evidence. If it is rejected, the person who created it revises the DPIA.

How to create a DPIA

  1. Open the system. If a DPIA is required, the asset page shows the corresponding card. Click Create DPIA.
  2. Fill in the details of processing: Purpose of the processing, Data subjects, Recipients and disclosure and Retention, plus any custom fields of your organisation. You can save at any time; checks only happen on submission.
  3. Under Risks from the catalogue, Varmo suggests the risks of your organisation. Remove what does not fit and add more with Add risk.
  4. Assess each risk Before the measures and After the measures. To do so, link measures of the asset or create new ones; the responsible person receives a task to implement them. Without a measure, the risk after the measures is the same as before.
  5. The highest residual risk determines the Result: no increased risks, possible increased risks or high risk. Except for “no increased risks”, you justify the result.
  6. Click Submit for approval.

If you have already created a DPIA outside Varmo, choose Adopt existing DPIA instead and upload the report as a PDF (at most 20 MB) with date, result and summary. It also goes for approval.

How to approve a DPIA

The data protection approver receives a task. Check the description, risks and measures and choose Approve DPIA or Reject DPIA. If the result is “high risk”, record the consultation when approving: for private organisations, by the data protection advisor (Art. 23(4) FADP) or by the FDPIC; for federal bodies, by the FDPIC; in each case with the date of the opinion and evidence as a PDF.

What happens next

  • With approval, the DPIA counts as carried out and is recorded on the asset as evidence.
  • After a rejection, the person who created it receives a task to revise it.
  • If a later protection requirements assessment again requires a DPIA, Varmo suggests the risks from the last approved DPIA.

Frequently asked questions

Why can't I change the question about sensitive personal data?

The answer is derived from the data categories of the processed information and cannot be overridden.

Can our organisation require a DPIA more often than the law does?

Yes. Add your own questions and rules to the risk pre-assessment. The legal requirements remain in place in any case.

Which data protection laws does Varmo support?

Currently the Swiss Federal Act on Data Protection (FADP).