Should the introduction of a new IT system be accompanied by a data protection analysis?

ANSWER

Regardless of the ‘size’ of the new IT system, data protection by design should address the same elements, namely:

1. Personal data protection principles (Art. 5 GDPR).
2. Rights of data subjects (Arts. 12–22 GDPR).
3. Freedoms of data subjects (risk analysis).