Privacy by design
and DPIA support.

What is this service?

Privacy by design means building GDPR requirements into a product, tool or process while it is being designed, rather than once it is already live.

When processing is likely to present a high risk to individuals, the GDPR requires a Data Protection Impact Assessment (DPIA). This service helps you decide whether a DPIA is needed, carry it out, and turn its conclusions into concrete measures for your product and engineering teams.

Who is it for?

It is aimed at teams launching a digital product, an HR tool, a monitoring system or large-scale processing, especially when sensitive data is involved.

Situations that trigger the engagement

• Launch of an app, a SaaS platform or a new feature that collects personal data.
• Employee monitoring tools: call recording, geolocation, activity tracking.
• Use of artificial intelligence, profiling or scoring of individuals.
• Processing of health or biometric data, or data about vulnerable people.

Issues we see most often

• Data protection comes up just before go-live, when every change is expensive.
• Nobody knows whether a DPIA is mandatory, or who should lead it.
• Product and legal teams do not speak the same language.
• A DPIA was written but its measures were never implemented.

What the engagement includes

We ideally join at the design stage, but we also work on existing products that need to be documented.

Deliverables

• Screening: a reasoned decision on whether a DPIA is required, based on the European Data Protection Board criteria.
• DPIA: description of the processing, necessity and proportionality, risks to individuals and chosen measures.
• Product requirements: a list of concrete rules for teams: minimisation, retention, rights, security and privacy-friendly defaults.
• Action plan: the measures to implement, their owner and deadline.
• Decision note: the residual risk level and sign-off by management.

What you provide

A description of the project or product, data flow diagrams, the list of technical providers, and access to a product owner and a security contact.

Typical process

When is a DPIA mandatory?

The GDPR requires a DPIA when processing is likely to result in a high risk. In practice, European authorities consider a DPIA generally necessary when processing meets at least two of nine criteria: evaluation or scoring, automated decisions, systematic monitoring, sensitive data, large scale, combining datasets, vulnerable individuals, innovative technology, or processing that prevents people from exercising a right.

If the risk remains high despite the planned measures, the supervisory authority must be consulted before the processing starts. We help you document these decisions so they can be defended.

Important limits

The DPO advises. Product, security and risk acceptance decisions remain with your organisation.

RCM provides compliance and DPO support. RCM is not a law firm. When specialized legal consultation or litigation representation is necessary, it must be entrusted to an authorized professional.

Talk about your situation

Present the context, timeline and actors. We will tell you if this service really meets your needs.