A Data Protection Impact Assessment (DPIA) is a structured review of processing that is likely to create a high risk to individuals’ rights and freedoms. Under the UK GDPR, an organisation must complete one before starting that processing. The assessment records what data will be used, why it is needed, who may be affected, how risks will be managed and whether the proposed safeguards reduce the remaining risk to an acceptable level.
A DPIA is not simply a compliance form. It should influence the design of a product, service or internal process. For example, a business introducing employee monitoring, biometric access controls, large-scale profiling, location tracking or an AI system using personal data should assess necessity, proportionality, transparency, retention, security and access rights at an early stage. The ICO’s guidance on DPIAs and high-risk processing provides a useful starting point for identifying when an assessment is required.
Begin by describing the processing in plain terms, including the data sources, purposes, systems, recipients, retention periods and international transfers. Identify the lawful basis and any special category data involved. Then consult the people responsible for security, product delivery, operations and affected individuals where appropriate. Map each privacy risk to a specific control, such as data minimisation, access restrictions, encryption, human review, deletion rules or clearer privacy information.
The final document should state who approved the assessment, which actions remain outstanding and when the assessment will be reviewed. If high risks remain and cannot be reduced, the organisation must consult the ICO before processing begins. A DPIA also needs updating when the nature, scope, context or purpose of processing changes. Harper James is a UK full-service commercial law firm advising businesses on data protection and Data Protection Officer support under the laws of England and Wales.
DPIAs are increasingly relevant to AI procurement, workplace analytics, connected devices, online identity checks and services aimed at children. A vendor’s security certification or standard privacy wording does not replace the customer’s own assessment. The organisation deciding how and why personal data is processed remains responsible for examining the risks, documenting its decisions and checking that contractual and technical safeguards match the proposed use.
A useful working method is to keep a DPIA register, assign an owner, link each control to an implementation task and schedule reviews alongside product or supplier change management. This turns the assessment into an operational record rather than a one-off document. The level of detail should reflect the nature and scale of the processing, but every conclusion should be supported by clear evidence and a recorded decision.