# Regulatory Standards -- DPIA Register Management

## Primary Legislation

### GDPR Article 35(1) -- Requirement for DPIA
"Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data."

### GDPR Article 35(2) -- DPO Consultation
"The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment."

### GDPR Article 35(7) -- DPIA Content
A data protection impact assessment shall contain at least:
- (a) a systematic description of the envisaged processing operations and the purposes
- (b) an assessment of the necessity and proportionality of the processing
- (c) an assessment of the risks to the rights and freedoms of data subjects
- (d) the measures envisaged to address the risks

### GDPR Article 35(11) -- Periodic Review
"Where necessary, the controller shall carry out a review to assess if processing is performed in accordance with the data protection impact assessment at least when there is a change in the risk represented by processing operations."

### GDPR Article 36(1) -- Prior Consultation
"The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk."

### GDPR Article 36(3) -- Prior Consultation Submission
"When consulting the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory authority with: (a) the respective responsibilities of the controller, joint controllers and processors involved; (b) the purposes and means of the intended processing; (c) the measures and safeguards provided; (d) the contact details of the DPO; (e) the data protection impact assessment; (f) any other information requested by the supervisory authority."

### GDPR Article 5(2) -- Accountability Principle
"The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability')." The DPIA register is a key instrument for demonstrating Art. 5(2) accountability.

### GDPR Article 24(1) -- Responsibility of the Controller
"The controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation." Maintaining a DPIA register is an accountability measure under Art. 24.

### GDPR Article 30 -- Records of Processing Activities
The DPIA register should cross-reference RoPA entries to provide a complete picture of high-risk processing activities.

### GDPR Recital 84 -- Outcomes of DPIA
"The outcome of the assessment should be taken into account when determining the appropriate measures to be taken in order to demonstrate that the processing of personal data complies with this Regulation." Register management ensures DPIA outcomes are tracked and acted upon.

### GDPR Recital 89 -- Elimination of General Notification
While the GDPR eliminated the general obligation to notify supervisory authorities of processing, the DPIA register serves a similar accountability function by maintaining systematic records of high-risk processing assessments.

## Regulatory Guidance

### EDPB WP248rev.01 -- Guidelines on DPIA (Revised 2017)
- Section III.C: "When must a DPIA be carried out?" -- criteria for register inclusion
- Section III.D: "How to carry out a DPIA?" -- content requirements for registered DPIAs
- Section III.E: "When is the supervisory authority to be consulted?" -- prior consultation tracking
- Section IV: "Publication" -- transparency of DPIA summaries
- Annex 2: "Criteria for an acceptable DPIA" -- quality criteria for registered assessments

### EDPB Guidelines 4/2019 on Art. 25 Data Protection by Design and by Default
- Section 3.3: Integration of DPIAs into the privacy management framework
- Recommends systematic DPIA tracking as part of data protection by design obligations

### ICO DPIA Guidance (2024)
- Recommends maintaining a central DPIA register with review dates and status tracking
- Suggests linking DPIAs to the data protection programme governance structure
- Provides template DPIA register fields and lifecycle management guidance

### CNIL DPIA Methodology (PIA Tool v3, 2024)
- Provides structured DPIA framework that integrates with register management
- Recommends automated review date calculations based on risk level
- Supports export of DPIA records for supervisory authority reporting

### ISO/IEC 29134:2023 -- Privacy Impact Assessment Guidelines
- Section 5: PIA governance and programme management
- Section 8: PIA review and update procedures
- Section 9: PIA record-keeping and reporting requirements
- Annex A: PIA register template and lifecycle management

## Enforcement Precedents

### EDPS Audit of EU Institutions (2023)
Found that several EU institutions lacked systematic DPIA registers, making it impossible to demonstrate that DPIAs had been conducted for all high-risk processing. Recommended centralised register with automated review scheduling.

### ICO Enforcement -- British Airways (2020)
The ICO investigation noted the absence of a comprehensive DPIA programme covering all high-risk processing as a contributing factor to inadequate risk management.

### CNIL Enforcement -- Google LLC (2019)
EUR 50,000,000 fine; among the findings was insufficient documentation and tracking of privacy impact assessments for personalised advertising processing.

### BfDI Recommendation to Federal Agencies (2024)
The German Federal Commissioner recommended that all federal agencies establish DPIA registers with automated review scheduling and integration with their Records of Processing Activities.