When it may be needed in prevention
Article 35 of the GDPR requires a DPIA where processing is likely to result in a high risk to people’s rights and freedoms. It is not automatically required for every OSH software application, nor solely because a new technology is introduced.
It should be considered in projects combining systematic monitoring, profiling, sensitive data or novel technologies. A camera, sensor or health analysis system requires an assessment of what it actually does, whom it affects and its scope. A preventive purpose does not, by itself, remove the privacy risk.
How it differs from an occupational risk assessment
An occupational risk assessment examines potential harm to safety and health arising from work. A DPIA focuses on the rights and freedoms affected by data processing: loss of confidentiality, discrimination, disproportionate surveillance or decisions based on inaccurate information, among others.
Both may be needed and should be coordinated. A sensor may detect an exposure while also collecting excessive information about movements. Nor does a cybersecurity assessment replace a DPIA: securing a server does not make data necessary if it should not be collected in the first place.
What a DPIA should include
Under Article 35(7) and AEPD guidance, the assessment must describe the processing, examine its necessity and proportionality, analyse the risks and define measures to address them.
- Description: purpose, individuals, data, sources, recipients and retention.
- Necessity: why the data are needed and whether a less intrusive alternative exists.
- Risks: what could harm individuals and with what consequences.
- Measures: safeguards, access, controls, responsibilities and verification.
The outcome must explain decisions and residual risks. Attaching a privacy policy or a questionnaire without analysing the specific activity is not enough.
Who participates and when it is reviewed
The obligation belongs to the data controller, not the supplier or the data protection officer. The DPO provides advice where appropriate; prevention specialists contribute knowledge of tasks and exposures; technology teams explain data flows and controls; and the departments involved help assess effects on individuals.
Start the analysis during design, while it is still possible to change what is collected or how it is used. Review significant changes in purpose, scale, recipients or technology. If the assessment reveals a high risk that cannot be mitigated, prior consultation with the supervisory authority must be considered under Article 36 of the GDPR.
Useful questions for an OSH project
Before purchasing, request specific answers: are identifiable data necessary? Is recording continuous? Who will see individual results? Will they be reused for other purposes? How can a data item be corrected? What happens when the service ends?
Health data and the employment context require particular care. Do not assume that ticking an acceptance box resolves every requirement. In Spain, Article 22 of the Occupational Risk Prevention Act limits access to personal medical information. Distinguish clinical data from preventive conclusions that may be communicated according to the law and each recipient’s role.
Hypothetical example: sensors to detect physical overload
A company is considering sensors that identify movements associated with physical overload. The initial design retains individual records throughout the shift and allows comparisons between workers. The assessment examines whether those functions are necessary to improve working conditions and what secondary uses could arise.
Options include limiting collection, using aggregated results where possible and restricting access. The organisation also defines how accuracy will be checked and how errors will be addressed. The project is not considered acceptable simply because the supplier has security measures: the entire processing operation and the effectiveness of the safeguards adopted must be justified.
