Do we need a data protection impact assessment before deploying network monitoring?

Possibly, and it is worth doing a short one even when it is not strictly required. The GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). requires a data protection impact assessment (DPIA) where processing is likely to result in a high risk to people’s rights, and it names systematic monitoring among the cases to consider; national data protection authorities also publish lists of processing that always needs one. Monitoring a company network can fall into that area, especially where it covers employees’ devices or reaches personal use. A DPIA describes what you collect and why, checks that it is necessary and proportionate, lists the risks to the people concerned and the measures that reduce them, and records the decision. Ask your data protection officer, check your authority’s list and keep the result. Measures that help in your assessment: NetSenX records metadata rather than content, never decrypts traffic, reports AI use per device and program rather than per person, keeps data in the EU, and lets you limit who can open the account. It does not write the DPIA for you.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on Data residency and trustAll topics