Harper James advises ambitious UK businesses on privacy assessments for digital products under the laws of England and Wales. A well-run assessment gives product, engineering and commercial teams a clear record of what personal data is collected, why it is needed, who receives it and how risks are controlled.
Start with a data map covering user journeys, analytics, cookies, account data, payments, location information, children’s data, support tools and third-party software. Confirm the controller and processor roles, the lawful basis for each processing activity, retention periods, international transfers and user rights. A Data Protection Impact Assessment (DPIA) is required where processing is likely to result in a high risk to individuals, such as large-scale profiling, biometric identification or the use of sensitive data. Businesses should also check PECR requirements for cookies and electronic marketing.
The assessment should run alongside product development rather than appear at launch. Record the proposed feature, identify the privacy risks, test less intrusive alternatives, assign mitigations and obtain approval from the responsible owner. Practical privacy assessment resources can support this work, but the assessment still needs to reflect the product’s actual data flows and commercial model. Evidence should include the data inventory, supplier due diligence, security controls, privacy notice changes, consent design and any DPIA decision.
Current assessments increasingly address generative AI, automated decision-making, connected devices and children’s access to digital services. Teams should document training data sources, prompts and outputs, human review, accuracy testing, profiling logic and deletion processes. For products used by children or likely to attract them, the ICO’s Age Appropriate Design Code remains a key reference point. Privacy by design also means minimising default settings, limiting access internally and building deletion and data export into the product architecture.
A useful assessment ends with decisions, owners and review dates. Revisit it when the business introduces a new supplier, changes the business model, launches in another market, adds an AI feature or experiences a security incident. This approach turns privacy from a launch checklist into an operating control that supports responsible product growth.