DPIAs: When Does Your Project Need One?

What is a DPIA?

A Data Protection Impact Assessment (DPIA) is a structured way to identify and reduce privacy risks before a processing activity begins. It is not simply a form to complete at the end of a project. A well-run DPIA helps an organisation understand what it plans to do, who may be affected, and which safeguards are needed.

Under Article 35 of the UK GDPR, a DPIA is required before processing where the processing is likely to result in a high risk to the rights and freedoms of individuals. The question is not whether harm is certain; it is whether the proposed activity has features that should trigger a closer assessment.

When is a DPIA required?

The UK GDPR identifies three examples of processing that always require a DPIA:

• Systematic and extensive profiling that leads to decisions with legal or similarly significant effects.
• Large-scale processing of special category data or personal data about criminal convictions and offences.
• Large-scale systematic monitoring of a publicly accessible area.

The ICO also identifies other indicators of likely high risk, including innovative technology, large-scale profiling, biometrics, data matching, invisible processing, tracking, targeting children or other vulnerable people, and processing that could cause physical harm.

In practice, more than one risk indicator will often point strongly towards a DPIA, but there is no safe shortcut based only on counting factors. Consider the nature, scope, context and purpose of the processing, together with the likelihood and severity of possible harm. If in doubt, completing a DPIA is usually the more defensible course.

What should a DPIA contain?

A useful DPIA should explain:

• The nature, scope, context and purposes of the processing.
• The types of personal data and the people or groups affected.
• How information will flow through systems, suppliers and teams.
• The necessity and proportionality of the processing.
• The risks to individuals, including how those risks could materialise.
• The measures proposed to reduce the risks.
• Who owns each action and when the assessment will be reviewed.

A DPIA should be specific to the processing. Copying a generic template without testing its assumptions can leave important risks undiscovered.

A practical project workflow

1. Screen early. Add a privacy-risk screening step to project initiation and procurement. Do not wait until a system is ready to launch.

2. Map the processing. Identify the data subjects, data fields, purposes, recipients, retention periods, locations and access arrangements.

3. Assess necessity and proportionality. Ask whether the same objective can be achieved with less data, less monitoring or a less intrusive method.

4. Record and treat the risks. Assign actions, owners and deadlines. Residual high risks may require consultation with the ICO before processing begins.

5. Keep it alive. Review the DPIA when the processing, technology, supplier, purpose or risk profile changes.

Final checklist

Before signing off a new project, ask:

• Have we documented what the processing actually does?
• Have we considered vulnerable people and unexpected uses?
• Have we consulted the people who understand the technology and operations?
• Are the proposed safeguards concrete and testable?
• Is there an owner for residual risk and future review?

This article is general information, not legal advice. The correct DPIA decision depends on the facts of the proposed processing and the current guidance.

Further reading

• ICO: When do we need to do a DPIA?
• ICO: Data protection impact assessments (DPIAs)