There is no obligation to make a DPIA report public. However, there is an obligation to inform the person concerned that his or her data is being processed (Article 5(1)(a) and Articles 12 to 14 AVG).
However, it is permissible to disclose a DPIA, and it can be useful, for two reasons. First, in the context of transparency. Disclosing a report often promotes a person's confidence in the process and in the organization. Second, disclosing a DPIA can help other organizations conduct their own. Since many organizations use the same systems, this way not everyone has to conduct identical DPIAs. In addition, it can be instructive for both organizations if people give each other feedback on a previously conducted DPIA and then improve it.
If an organization chooses to disclose a DPIA, however, it must first be redacted. To protect confidential business data, all confidential data must be extracted. This includes, for example, security settings and system setup unique to the company.
Finally, organizations adopting a DPIA from someone else should obviously check carefully when using it whether the conclusions can be adopted or whether they need to be modified.
