Managing PIA Review and Update Cadence

Managing PIA Review and Update Cadence

Overview

Art. 35(11) requires controllers to carry out a review to assess whether processing is performed in accordance with the DPIA, at least when there is a change in the risk represented by processing operations. A DPIA is not a one-time compliance exercise but a living document that must be maintained throughout the processing lifecycle. This skill establishes the governance framework for DPIA reviews, including trigger event identification, scheduled review cadence, version control, stakeholder sign-off, and DPIA register management.

Art. 35(11) Review Obligation

"Where necessary, the controller shall carry out a review to assess if processing is performed in accordance with the data protection impact assessment at least when there is a change in the risk represented by processing operations."

This means:

1. Reviews are mandatory when risk changes
2. The controller should proactively monitor for risk changes
3. Regular periodic reviews are a best practice even without identified changes
4. The DPIA must be updated to reflect the current state of processing

Review Trigger Categories

Category 1: Regulatory Triggers

Category 2: Processing Change Triggers

Category 3: Technology Change Triggers

Category 4: Incident Triggers

Category 5: Organisational Change Triggers

Scheduled Review Cadence

Review Process

Step 1: Trigger Detection and Triage

1. DPIA register manager monitors for trigger events continuously.
2. When a trigger is detected, it is logged in the DPIA register against the affected DPIA(s).
3. DPO triages the trigger to determine whether a full or targeted review is needed:
   • Full review: Re-examine all DPIA sections (new system, major regulatory change, data breach)
   • Targeted review: Update only the affected section (new recipient, retention change, minor system update)

Step 2: Review Execution

1. Assemble the review team: processing owner, DPO, IT security (for technology changes), legal (for regulatory changes).
2. For full reviews: re-execute the complete DPIA methodology from screening through risk assessment.
3. For targeted reviews: update the affected section and reassess overall risk level.
4. Document all changes from the previous version.
5. Update the risk register with any new or modified risks.

Step 3: Stakeholder Sign-Off

Step 4: Version Control and Registration

1. Create a new version of the DPIA document.
2. Use version numbering: major changes increment the first digit (v2.0); minor changes increment the second digit (v1.1).
3. Include a change log documenting:
   • Date of change
   • Trigger event that prompted the review
   • Sections modified
   • Summary of changes
   • Reviewer and approver names
4. Archive the previous version (do not delete; maintain audit trail).
5. Update the DPIA register with the new version, review date, and next review date.

DPIA Register Management

The DPIA register is the central index of all DPIAs conducted by the organisation. It must contain:

Common Review Process Deficiencies

1. No trigger monitoring: Organisation relies solely on scheduled reviews without monitoring for change events.
2. Stale DPIAs: Reviews conducted on paper without verifying actual processing matches the DPIA description.
3. No version control: Edits made to the original document without maintaining previous versions.
4. Incomplete stakeholder engagement: DPO reviews without consulting the processing owner or IT security.
5. No change log: Updates made without documenting what changed and why.
6. Expired review dates: DPIA register shows overdue reviews without remediation.

Enforcement Context

Supervisory authorities have increasingly scrutinised DPIA currency:

• Swedish DPA vs Karolinska (2019): Noted that DPIA had not been conducted at all, let alone reviewed.
• CNIL vs Clearview AI (2022): The absence of any DPIA was an aggravating factor in the fine determination.
• Austrian DPA vs Austrian Post (2019): Inadequate ongoing review of profiling DPIA was a contributing factor.