Cyprus DPIA: assess data protection risks before a project launches

Screen the proposal before procurement and launch

Ask the project owner for a plain-language description of the activity and the people affected. A product name is not enough: the same system may support basic appointment booking or extensive evaluation of a person’s behaviour. Screen the intended use, its context and its likely effects. Include a screening step before the organisation becomes committed to a supplier or implementation date.

The GDPR high-risk test concerns individuals rather than only the organisation’s financial exposure. The EDPB describes mandatory cases including large-scale sensitive-data processing, relevant automated evaluations with significant effects, and large-scale systematic monitoring of public areas. Other combinations of risk factors may also require assessment. Check the applicable Cyprus authority material and record how the actual proposal was evaluated.

Keep a brief reasoned screening record even where the conclusion is that a DPIA is not required. State the facts on which that conclusion depends and who should revisit it if the proposal changes. A small pilot should not receive an automatic exemption if its processing is already likely to create high risk. Equally, the existence of a database alone does not settle the question.

Basis and guidance: EDPB small-business guide: DPIA screening and assessment

Define the processing operation and its boundaries

Describe the purpose in terms that a person affected by the system could understand. Identify which decisions or services the organisation wants to support and why personal data is involved. Avoid a description such as “business improvement” that could accommodate almost any later use. The purpose should be specific enough to compare the proposed processing with a less intrusive alternative.

Map data collection, storage, use, sharing and deletion. Identify the people, categories of information, systems, recipients and relevant locations. Distinguish the organisation’s activity from anything a supplier does for its own purposes. Note assumptions and unresolved details rather than presenting the supplier’s marketing description as a verified account of the system. Explain where data enters and leaves each stage.

Consider information generated by the system as well as information entered into it. A tool may create scores, inferences, logs or location histories that were absent from the procurement questionnaire. Ask the technical team to demonstrate a realistic example using safe test information. Confirm whether exports, support access or integrations create additional copies that must appear in the assessment.

Assign an owner and involve the right people

The Cyprus Commissioner explains that the controller retains responsibility for the assessment even if another person carries it out. Involve the DPO where appointed and obtain assistance from a relevant processor. Define who owns the decision, who provides evidence and who checks implementation. An external template or consultant can support the work without taking over the controller’s accountability.

Bring together the operational owner, technical team and people who understand the affected individuals and relevant requirements. Their contributions should answer concrete questions. For example, the operations team can explain the actual need for location information, while technical staff can establish whether collection continues outside working hours. Record disagreements that could materially affect the assessment rather than silently removing them from the final draft.

Consider appropriate input from affected individuals or their representatives, taking account of the circumstances and the need to protect legitimate interests. A suitable consultation can reveal practical effects missed by the project team. Record the approach and reasons. Ensure the DPO’s advice and management’s resulting decisions remain distinguishable, particularly where the organisation decides to depart from a recommendation.

For the connected practical steps, read the DPO appointment and independence guide.

Basis and guidance: Cyprus Commissioner: data protection impact assessment

Test necessity and proportionality against realistic alternatives

Explain why each material category of data is needed for the stated purpose. Challenge convenient collection that lacks a clear role in the service or decision. If the objective is to confirm that a worker arrived at an agreed site, explain why continuous tracking would be necessary instead of recording a limited arrival event. Compare alternatives against the real operational requirement.

Assess the proposed duration, access and use of the information, not only its collection. A narrowly justified record can become excessive if it is retained indefinitely or made available to unrelated teams. Identify the applicable lawful basis and any additional requirements for the data or activity. The assessment does not replace those requirements or turn an otherwise unlawful purpose into a lawful one.

Record why an alternative was accepted or rejected using evidence available to the project. Cost and convenience can be relevant to implementation choices, but an unsupported statement that the supplier offers no other setting is inadequate analysis. Ask whether settings, a different workflow or a smaller deployment can achieve the purpose with less interference. Preserve the comparison so later reviewers can follow the decision.

Basis and guidance: European Commission: data protection obligations

Describe potential harm to people, not only technical threats

A risk entry should identify who could be affected, what could happen and the resulting impact. “Unauthorised access” describes an event but does not explain the consequence. Disclosure of a person’s location history might expose sensitive routines or create a safety concern. An inaccurate score might wrongly affect access to a service. Make the connection explicit for each material scenario.

Consider likelihood and severity separately and explain the reasoning behind each assessment. Avoid assigning numbers that create an appearance of precision without supporting evidence. Note factors such as the sensitivity of the information, the people’s circumstances and the consequences of an error. Account for uncertainty and seek the missing evidence where it could alter a significant decision.

Include risks from ordinary authorised use as well as misuse or a security incident. A system can operate exactly as designed and still collect excessive information or support unfair decisions. Review how people understand the activity, challenge inaccurate information and exercise their rights. Assessments focused solely on hackers may miss the principal effects of the proposed processing.

Connect every safeguard to evidence and an owner

For each important risk, identify a measure that addresses the cause or reduces the impact. Specify who will implement it and how completion will be verified. “Access control” is less useful than an explanation of the relevant roles, approval process and restrictions. Ask what evidence will show that the measure works in the configured system used by the organisation.

Treat supplier assurances as evidence to examine rather than as a substitute for understanding the deployment. A security feature may exist in the product but require an additional setting or agreement. Check whether it covers exports, support tools and connected systems. Where a processor operates part of the solution, connect its responsibilities with the actual assistance and controls needed.

Keep unresolved measures visible. A planned safeguard should not be counted as an implemented reduction in risk without a basis for that treatment. Record dependencies, a responsible person and a completion condition. If a necessary setting cannot be delivered before the intended launch, revisit the schedule or design and assess the implications instead of deleting the issue from the table.

For the connected practical steps, read the processor-agreement checklist.

Evaluate remaining risk and the consultation threshold

Reassess the material scenarios after the proposed safeguards have been evaluated. Explain what has changed and what remains unresolved. A reduction in a risk score should follow from the evidence, not simply from moving a project into its final approval stage. Identify measures that are essential conditions before processing starts and distinguish them from later improvements.

The Commissioner’s guidance requires prior consultation where sufficient measures cannot be found to reduce high residual risk appropriately. This is not an automatic submission requirement for every DPIA. When the threshold is met, the consultation must be addressed before starting the relevant processing. Obtain appropriate advice on uncertain cases rather than treating an internally signed assessment as regulatory permission.

Keep the consultation material consistent with the actual planned activity and responsibilities. Preserve relevant correspondence and any resulting changes. Do not infer approval from silence or assume that a submitted question removes the need to resolve a known problem. Management should be able to identify the lawful basis for proceeding and the conditions it has committed to implement.

Basis and guidance: Cyprus Commissioner: data protection impact assessment

Example: redesigning a workplace location proposal

Consider a hypothetical service business proposing a mobile app that continuously records workers’ location so dispatch staff can confirm attendance at assigned sites. The assessment should distinguish the attendance objective from other possible purposes, such as performance ranking or route analysis. Identify who can view location records, whether tracking continues outside work and what histories the supplier retains.

The team compares continuous tracking with a limited site-arrival confirmation and identifies what each option would achieve. It tests the settings and discovers that a default export includes a longer history than the dashboard shows. That finding creates a practical action for configuration and supplier review. A statement that managers see only the dashboard would otherwise give an incomplete account of access.

The outcome depends on the facts and applicable requirements; the example does not establish that a particular configuration is always lawful. The useful result is a documented comparison, clearer limits and verified controls. The project team should update the assessment to match the chosen design and demonstrate that the deployed system follows it, including any retained information and connected services.

For the connected practical steps, read the employee personal-data guide.

Keep an assessment and decision file that can be reviewed

Keep the processing description, evidence, risk analysis, advice and final decisions together with a version identifier. Record the relevant decision date and the configuration to which the assessment applies. A reviewer should be able to tell whether a later supplier change falls within that assessment or needs further work. Restrict access appropriately where the file contains sensitive security or commercial information.

The Cyprus guidance says publication of the full DPIA is not generally required, while a summary can support transparency. Decide what information can help affected people understand the activity without unnecessarily exposing confidential details. A public privacy notice and an internal assessment serve related but different purposes. Neither should contradict the actual processing or promise controls that have not been implemented.

Check whether the design supports the rights described in the assessment. Test how relevant records can be found and supplied, how inaccurate data is corrected and how appropriate deletion is performed. Document practical limitations and the chosen response. The exercise should expose problems while the team can still fix them rather than leave those discoveries to the first individual making a request.

For the connected practical steps, read the access-request handling guide.

Basis and guidance: Cyprus Commissioner: data protection impact assessment

Review the assessment when the activity or risk changes

Agree review triggers with the people who operate and change the system. Examples include new data categories, additional recipients, a different purpose, a significant integration or a supplier change affecting access. An incident or credible complaint can also reveal that the original assessment missed an important scenario. Route these developments to the responsible person rather than assuming an old assessment covers them.

Compare the deployed activity with the description in the assessment and investigate differences. Confirm that safeguards continue to operate, especially where staff roles, retention settings or support arrangements have changed. Keep earlier versions and explain the reason for revisions. A review date by itself is not evidence that the organisation examined the processing or verified its controls.

Use the findings to update operational instructions and relevant agreements, notices or configuration. Assign corrective work and check completion. Where the review identifies a significant unresolved issue, assess what must happen to the processing while that issue is addressed. Zeno can coordinate independent professional support for a case-specific assessment and the associated operational work.

Primary sources and scope

Sources checked: September 27, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Cyprus Commissioner: data protection impact assessment
• EDPB small-business guide: DPIA screening and assessment
• European Commission: data protection obligations