Re-determining the means during operational processing
Home » The GDPR » Main Concepts » Data Protection by Design and by Default (DPbDD) » Analysis of Article 25. Data protection by design » Re-determining the means during operational processing

Considering that the result of determining the means are the resources and the instructions, it is common place to re-determine the means also during operational processing. The following examples shall illustrate this:

  • Replacement of failing technical resources and unavailable human resources. Replacement of resources can be temporary or permanent.
  • Addition, subtraction or replacement of resources to adapt to a changing volume of processing. This could for example include the addition of human resources to an overtaxed work unit or the replacement by a technical resource by a more powerful one.
  • Change of instructions for improved efficiency and effectiveness. This can include, for example, routine updates of software to the latest version. Other examples are the evolutionary improvement of instructions or the redesign of organizational processes.
  • Beyond this, also an extension of the means to support an extension of the purposes is possible. This typically goes along with additional functionality supported by the processing.

Since such re-determining the means is still determining the means, also here, appropriate measures have to be implemented by the controller. The above analysis will therefore be also used for structuring the discussion of means in section 1.1.4 below.


Skip to content