Harper James advises UK businesses on data protection compliance under the laws of England and Wales, including when a Data Protection Impact Assessment (DPIA) is required. A DPIA is a documented process for identifying and reducing privacy risks before an organisation begins high-risk processing of personal data.
Under the UK GDPR, an organisation must complete a DPIA where processing is likely to result in a high risk to individuals. Common examples include large-scale monitoring of publicly accessible areas, systematic and extensive profiling, large-scale processing of special category data, and the use of new technologies that create significant privacy risks. A DPIA is also appropriate for substantial changes to an existing processing activity.
The organisation should first screen the proposed processing against the Information Commissioner’s Office (ICO) guidance and record the reasons for deciding whether a DPIA is required. The assessment should begin before the processing starts, not after a system, supplier or project has been implemented.
A DPIA should describe the processing, its purpose, the types of personal data involved, the people affected, retention periods, data flows and the parties with access to the information. It should explain why the processing is necessary and proportionate, and assess the potential impact on individuals, including risks such as unlawful disclosure, loss of confidentiality, discrimination, inaccurate decisions or excessive surveillance.
The business should then identify measures to reduce those risks. These can include data minimisation, access controls, encryption, retention limits, pseudonymisation, accuracy checks, staff training, contractual controls for processors and procedures for handling individual rights. The assessment should name the person responsible for each action and record the residual risk after controls are applied.
The Data Protection Officer should be involved where the organisation has one, and the views of affected individuals or their representatives should be considered where appropriate. The project owner, information security team, procurement function and relevant suppliers also need defined roles. A DPIA is not a one-off form. It should be reviewed when the processing, technology, supplier, purpose or level of risk changes.
If high risks remain after mitigation, the organisation must consult the ICO before starting the processing. The final DPIA should be approved by an accountable senior manager and retained with the project records. Used properly, it gives the business a clear decision trail, supports responsible product and procurement decisions, and provides evidence of compliance with the UK GDPR’s accountability principle.