Harper James advises businesses on data protection obligations under the laws of England and Wales, including Data Protection Impact Assessments (DPIAs) for mobile and web applications. A DPIA records how an app processes personal data, assesses the effect on individuals and identifies measures to reduce privacy risks before processing begins.
Under UK GDPR, a DPIA is required where processing is likely to result in a high risk to individuals. Common triggers for apps include large-scale processing of special category data, such as health or biometric information; precise location tracking; profiling or behavioural monitoring; systematic monitoring of users; processing children’s data; and the use of new technologies that create significant privacy risks.
The assessment should begin during the design stage, before the app is launched or a material change to its processing takes effect. It should cover the purpose and legal basis for processing, the categories of personal data and users, data flows, retention periods, recipients, international transfers, and the role of processors such as cloud hosting, analytics and customer-support providers.
A practical DPIA explains why each category of data is necessary and considers whether the same purpose can be achieved with less data or less intrusive methods. It should assess risks such as unauthorised access, excessive collection, inaccurate profiling, loss of confidentiality, discrimination and the inability of users to exercise their rights.
The business should then document safeguards, including data minimisation, access controls, encryption, pseudonymisation, retention limits, privacy notices, consent controls where relevant, user rights procedures, testing and incident response arrangements. The Data Protection Officer should be involved where one is appointed, and relevant processors or internal teams should provide information about the app’s technical and operational design.
A DPIA does not replace the need for a lawful basis, transparent privacy information, appropriate contracts or security measures. It is a recorded decision-making process that should be approved by the organisation’s accountable owner and retained with the project documentation. The assessment should be reviewed when the app introduces a new feature, changes its data uses, adds a new supplier or begins operating in a different context.
If significant residual risk remains after mitigation, the organisation must consult the Information Commissioner’s Office before starting the processing. Keeping the DPIA current also gives product, compliance and legal teams a clear record of the controls supporting the app’s data processing.