Lion Cipher Lab

Run a GDPR DPIA and a post-Schrems II Transfer Impact Assessment on a real data flow

• GRC / Compliance
• Advanced
• ~75 min
• Free · no account required

Why it matters

Two of the highest-stakes documents in European privacy work are the DPIA and the TIA, and both are routinely done badly — as blank templates filled in by reflex to create a paper trail, rather than real risk assessments that change a decision. A DPIA (Data Protection Impact Assessment) is a GDPR Article 35 obligation: before you start processing that is 'likely to result in a high risk' to people, you must assess that risk and how you will reduce it — and if you cannot reduce it enough, Article 36 makes you consult the regulator BEFORE you go live. Getting the 'is it even required?' question…

What you'll learn

• deciding whether a GDPR Article 35 DPIA is legally MANDATORY (the WP29 nine-criteria 'likely high risk' test), not just filling one in by reflex
• writing the four required DPIA sections: description of processing, necessity & proportionality, risks to data subjects, and mitigating measures
• landing a residual-risk verdict and deciding whether Article 36 prior consultation with the supervisory authority is triggered
• running the EDPB Recommendations 01/2020 six-step Transfer Impact Assessment on a real US transfer
• naming the transfer tool (Standard Contractual Clauses) and testing whether destination law (FISA 702 / EO 12333) undermines it in PRACTICE, not on paper
• choosing supplementary measures and understanding why importer-unreachable encryption keys are the one that actually removes the risk
• knowing when the EU-US Data Privacy Framework changes the analysis and replaces the SCC-plus-measures path
• the judgment that a TIA is a living document to be re-evaluated, not a one-time checkbox

Steps in this lab

1. The scenario, and the two artifacts you will produce
2. Part A, Step 1 — Is a DPIA even mandatory? (the screening test)
3. Part A, Step 2 — Describe the processing, necessity & proportionality
4. Part A, Step 3 — Identify the risks to data subjects
5. Part A, Step 4 — Mitigations, residual risk, and the Article 36 trigger
6. Part B, Step 1-2 — Map the transfer, identify the transfer tool
7. Part B, Step 3 — Assess whether US law breaks the SCCs in practice
8. Part B, Step 4 — Supplementary measures (the one that actually works)
9. Part B, Step 5-6 — Formalise, re-evaluate, and the DPF alternative
10. The judgment: what makes these artifacts real, not theatre

Open the full interactive lab →