General – foxondo

Data Protection Impact Assessment: When is it required and how do you document it properly?

Nora — Tue, 16 Jun 2026 11:24:09 +0000

A data protection impact assessment (DPIA) sounds like a lot of work. And although it’s not just a box-ticking exercise it won’t eat up your whole week either – as long as you know when it’s really necessary and what needs to be included.

When is a DPIA required?

A DPIA is always required when processing personal data is “likely to result in a high risk” to the rights and freedoms of data subjects. This can sound very abstract at first.

In practice this means: If two or more of the following characteristics apply to your planned processing, you should have a closer look:

You process sensitive or highly personal data (e.g., health data, biometric data, union membership).
You evaluate or classify individuals -for example, through scoring or profiling.
You systematically monitor people (e.g., through comprehensive video surveillance or the routine review of all log files).
You process data on a large scale, for example, affecting a very large number of data subjects or continuing over a long period of time.
You merge or cross-reference data sets from different contexts.
You process data about individuals with whom there is a significant power imbalance (e.g., employees, patients, children).
The system used makes automated decisions without human oversight, e.g., regarding job interviews or granting loans.
You use new technologies whose impact on privacy is not yet fully foreseeable – for example, AI-supported systems.
Individuals are prevented from exercising their data protection rights.

In addition, data protection supervisory authorities publish so-called “blacklists” of processing activities for which a DPIA is always mandatory. The Bavarian supervisory authority, for example, lists among other things the use of biometric data for unique identification or extensive video surveillance. It’s worth checking out.

What should a DPIA include?

The GDPR sets clear requirements for what a DPIA must contain:

A systematic description of the planned processing operations – that is: What happens to which data, why, and how?
An assessment of necessity and proportionality – is the processing truly necessary to achieve the intended purpose?
An assessment of the risks to the rights and freedoms of the data subjects.
The planned risk mitigation measures – that is, specific technical and organizational measures (TOMs) that reduce the risk to an acceptable level.

Sound like a lot? It can be sometimes.

But: You already have most of the basics in your data protection documentation (e.g., in foxondo). The DPIA builds on this, consolidating and evaluating what already exists. And it makes it easier to demonstrate that you’ve given this careful consideration.

Where can I find the DPIA topic in foxondo? And how can I document it there?

In every process/data processing activity, you’ll find a separate question regarding the data protection impact assessment. Once you answer this, you’ll know whether you need to conduct a DPIA or not.

In the “Forms & Checklists” module, you’ll find a questionnaire on the topic of DPIA. This allows you to create a DPIA or at least prepare one so that a DPO can review it.

It is best to save the result of the DPIA as a document within the respective process.

Please note: If the process changes significantly, you must review and update the DPIA. This may be the case, for example, if new technologies are implemented or the scope of processing increases significantly.

And if the risk still remains too high?

Then you can consult the competent data protection supervisory authority.

This is called “prior consultation” (Art. 36 GDPR) and rarely occurs in practice—but it’s good to know that this step may be necessary.

Not sure whether a DPIA is required for one of your processes? Check the blacklist published by your relevant supervisory authority—and if in doubt, consult your data protection officer. Better to check one time too many than to leave something undocumented.

Audit focus for 2026: Focus on requirements to provide information

Nora — Tue, 27 Jan 2026 13:20:04 +0000

The Data protection supervisory authorities have announced that in 2026 they will focus on the topic of information and transparency obligations. This is an EU-wide coordinated priority audit. It’s best to check right away whether you are using complete and up-to-date privacy notices in all your processes! Luckily, this is very easy to do in foxondo using the filters.

Filter for the content using the tag “Data Protection Notice”. You may see the following typical errors and weaknesses with your privacy notices:

Some of your processes do not have any data protection notice yet.

That would not be ideal, of course, but there is still time to fix this… If something is missing, it is best to report it directly to your DPO—there are probably suitable templates you can use as a basis.
👉 Better late than never.

Legally correct, but practically incomprehensible

There is data protection notice, but it is incomprehensible. The obligation to provide information is not fulfilled if you need to have gone to law school to understand what is happening.
👉 The benchmark is the “average person.”

Paper and practice don’t match

The privacy policy says one thing, but the data is actually processed differently. Well-formulated information is useless if it doesn’t match reality. That’s why you can’t just copy privacy information from somewhere else – processes are always a little different.
👉 It is precisely this gap that is being examined.

Information provided too late or not transparent enough

Data subjects do not need to “search” for the information. It must be provided in a simple and easily accessible manner. Is it clearly documented in foxondo HOW you provide privacy notices in practice (e.g., via links in email signatures or via web forms)? If not, ask your process owners and make improvements if necessary.
👉 Hiding information is not permitted.

“No one has ever complained about this before.”

This is precisely why the supervisory authorities are now focusing specifically on this issue. 2026 is not a year to let this topic slide.
👉 Focused audits are there to enforce new standards.

➡️ Do you have outdated or difficult-to-understand data protection notices?
Then now is a really good time to make improvements!

AI in data protection? More positive sentiment than expected.

Nora — Mon, 13 Oct 2025 13:16:30 +0000

We recently asked foxondo users what they think about the use of AI in data protection and in our application foxondo.

The result was surprising: only a few are fundamentally opposed to AI. The clear majority would like to see support and time savings to make data protection documentation (even) easier.

To be honest, we had expected a rather mixed reaction and perhaps even controversial discussions on this topic!

But there were no heated debates and the mood was mostly positive.

Tests of AI functions

We are therefore currently testing various options to see if and how AI could offer meaningful added value in foxondo.

Depending on the results of our tests, new features may or may not be added. We are excited to see the results and will keep you updated.

Would you like to share your thoughts on AI with us? Then feel free to send us a message at info@foxondo.com.

Navigation made easy: Our “Processes” module is now updated

Nora — Tue, 01 Jul 2025 13:11:00 +0000

Why we have updated the module

Feedback from our users consistently shows us how important intuitive navigation and a quick overview are – especially when many processes are documented. With the previous view, it could quickly become confusing with extensive processing activities.

We have therefore fundamentally revised the structure. The new layout is clearer, tidier and helps you to find your way around more quickly.

Our aim is to make it even easier for you to find your way around and to further improve work processes.

What’s new in the structure

Groupings according to topics: The individual processes are now summarised according to topics (such as personnel). The new structure makes it easier to summarise information at a glance.
Elimination of the abbreviations in front: The two-digit abbreviations were intended to provide orientation, but were not always clear. The collapsible and expandable headings now make it easier to find your way around.
Collapsible and expandable headings: Collapsing topics for which you are not responsible provides even more clarity.

The new display is now available to all users. Simply log in and discover how much easier your work is now.

Not yet a foxondo user?
Then why not test foxondo for 30 days free of charge!
We would be delighted to receive your feedback.

Easter promotion – reward for YOUR MrFOX points

Nora — Thu, 17 Apr 2025 13:03:00 +0000

Do you only have a few MrFOX points, or do you already have a lot?

No matter, you always have a chance!

Together with our partner fox-on Dateschutz GmbH,
we are giving away a nice Easter surprise.

Send us a screenshot of your MrFOX points at info@fox-on.com.

You can find your accumulated MrFOX points under “My account” in the top right-hand corner of foxondo.

There will then be three winners:

the sender with the lowest number of MrFOX points,
the sender with the highest value and
the sender whose MrFOX points are closest to the average of all submissions.

If there is more than one sender in the respective category, the decision will be made by drawing lots.

Don’t worry, we won’t tell anyone who sent in the lowest number except the winner 😉

So that all Easter vacationers can take part, we are accepting entries until Wednesday, April 30.*

Not using foxondo yet?

Then simply test foxondo for 30 days free of charge.
And if you book by May 31, 2025 with the code: Easter2025, you will receive an additional month free of charge.

* The winners will be selected from all participants who send us an e-mail with a screenshot of their MrFOX points in good time and will be informed by e-mail if they have won. The promotion is organized by fox-on Datenschutz GmbH (Pollerhofstr. 33a, 51789 Lindlar, Germany). By participating in the promotion, you consent to the processing of your data. It will only be used for the purpose of running and processing the promotion and to notify you if you win. The data will not be used for advertising purposes or passed on to other third parties. You can revoke your consent at any time by sending us a message; you will then no longer be able to take part in the promotion.