Dear EPDP Team, Below, please find ICANN org’s response to a question from today’s EPDP Meeting. Thank you. Best regards, Marika, Berry and Caitlin QUESTION: Is ICANN.org considering doing a DPIA, given the need for them to sort out their role? RESPONSE: A similar question was asked by the EPDP Team on 1 October 2018 to which ICANN org provided a response, which restated John Jeffrey’s comment on an 8 October 2018 webinar. To recap: In general, a DPIA is designed to (a) describe the processing and purpose of processing of personal data, including where applicable the legitimate interest pursued by the controller, (b) assess the processing necessity and proportionality, and (c) help manage the risks to the rights and freedoms of data subjects resulting from the processing. The elements of a DPIA are more fully described in Article 35(7) of the GDPR. Under Article 35(1), a DPIA is only required where a type of processing is “likely to result in a high risk to the rights and freedoms of natural persons”. ICANN org considered conducting a DPIA since early in the discussion of GDPR and gTLD registration data. One of the issues is when to do a DPIA that is most timely and useful--should the DPIA be conducted on the original requirements in the registry and registrar agreements, on the Temporary Specification which is temporary, or on the new requirements being discussed in the EPDP? We continue to evaluate whether that assessment should be performed and, if so, when. We are preparing some FAQs to provide further background on this topic, which we plan to publish next week. We will share with the EPDP Team a link to the FAQs once published.