The Government is clearly out for what they see as ‘red tape’. I suspect, and this is a personal opinion here, that no argument on the benefit of something like ROPA will get past their Brexit stuff ears. Therefore I strongly suspect Article 30, as we know it today, in the UK is likely to not exist for too much longer.
That is an interesting approach and one that I think I agree with. When GDPR came in there was a lot of noise and guidance around many thing, including Cyber Security. So to not have effective controls in place from the 25th May 2018, or to not have a risk management strategy in place for where controls can’t be put in place, does make it a fair point to raise (in my opinion).
As Captain Kirk once said in the film Star Trek Generations when giving a piece of advice to the new Enterprise captain, “Risk is part of the business if you want to sit in that chair”.
If your DPIA forms are not working for those filling them in, then they will never work for you either. So why are you using them? If you do what you’ve always done, you get what you’ve always got. So change them!
If, like me, you’ve been completing and assessing Data Protection Impact Assessments for a number of years (long before GDPR came along), you’ll notice that apart from them being called DPIAs and being ‘mandatory’ (in certain circumstances), the same old issues around getting people to fill them in correctly remain the same.