Harper James advises ambitious UK businesses on data protection compliance under the laws of England and Wales, including when a Data Protection Impact Assessment (DPIA) is required. A DPIA is a structured way to identify and reduce privacy risks before an organisation starts processing personal data that is likely to create a high risk to individuals.
Under the UK GDPR, a DPIA is required before high-risk processing begins. Common examples include large-scale monitoring, biometric or genetic data, profiling that produces significant effects, processing children’s data, combining datasets from different sources, and deploying new technology that changes how personal information is collected or assessed. AI tools, workplace monitoring, facial recognition and large-scale analytics therefore deserve early review. The ICO’s practical data protection resources provide useful reference material for building an internal process.
The assessment should explain what data the organisation will process, why it needs the data, who will access it, where it will be stored, how long it will be retained and which suppliers are involved. It should also test necessity and proportionality. A project does not satisfy UK GDPR requirements simply because it has a lawful basis. The organisation must show that the processing is appropriate for its purpose and that less intrusive options have been considered.
Start with a clear description of the proposed processing and map the data flow from collection to deletion. Identify risks such as excessive collection, unauthorised access, inaccurate outputs, discrimination, loss of confidentiality and difficulty responding to subject rights. Rate each risk by its potential impact and likelihood, then assign practical controls, such as access restrictions, encryption, retention limits, human review, supplier contract terms and an incident response procedure.
Record who owns each action, the target date and the residual risk after controls are applied. The Data Protection Officer, where one is appointed, should provide advice and record their view. Product, security, procurement and operational teams also need to contribute because many risks arise from system design or supplier arrangements rather than from the privacy notice alone.
The business should not begin high-risk processing until the DPIA has been completed and approved by the appropriate decision-maker. If the assessment identifies a high residual risk that cannot be reduced, the organisation must consult the ICO before proceeding. A DPIA is not a one-off document. Review it when the purpose, data fields, technology, supplier, user group or retention period changes, and set a scheduled review for projects that operate continuously. This approach gives directors and project leaders an evidence-based record of their decisions while keeping privacy controls connected to the way the business actually works.