The following document can be used for determining the baseline of the Workshop 1 of EBIOS Risk Manager, when the scope of the study is a processing of personal data:
It constitutes a declaration of applicability relating to the fundamental principles related to the protection of privacy.
The other Workshops of the study makes it possible to satisfy the obligations of the GDPR in terms of security (cf. art. 32) if you assess the impacts on the data subjects in addition to those on the organization.
You can thus use EBIOS Risk Manager to carry out a PIA (cf. art. 35).
This international standard defines the vocabulary and principles that must be respected by any specific approach to privacy.
This international standard defines the principles that must be respected by any risk management approach specific to privacy.
The CNIL’s PIA Guides have been updated to provide a tool for the General Data Protection Regulation (GDPR).
The methodological approach is a privacy specific instantiation of the EBIOS toolbox.
It allows to build and demonstrate compliance with the GDPR of a processing of personal data.
The guides (the methodology, the templates and the knowledge bases) are provided with a free software, case studies, guidelines, etc.
On the CNIL’s website: Privacy Impact Assessment (PIA)