Data Protection Impact Assessment

1.We provide training so that our staff understand the need to consider a DPIA at the early stages of any plan involving personal data.

2.Our existing policies, processes and procedures include references to DPIA requirements.

3.We understand the types of processing that require a DPIA, and use the screening checklist to identify the need for a DPIA, where necessary.

4.We have created and documented a DPIA process.

5.We provide training for relevant staff on how to carry out a DPIA.

• evaluation or scoring;
• automated decision-making with significant effects;
• systematic monitoring;
• processing of sensitive data or data of a highly personal nature;
• processing on a large scale;
• processing of data concerning vulnerable data subjects;
• innovative technological or organisational solutions;
• processing that involves preventing data subjects from exercising a right or using a service or contract.

• use systematic and extensive profiling or automated decision-making to make significant decisions about people;
• process special-category data or criminal-offence data on a large scale;
• systematically monitor a publicly accessible place on a large scale;
• use innovative technology in combination with any of the criteria in the European guidelines;
• use profiling, automated decision-making or special category data to help make decisions on someone’s access to a service, opportunity or benefit;
• carry out profiling on a large scale;
• process biometric or genetic data in combination with any of the criteria in the European guidelines;
• combine, compare or match data from multiple sources;
• process personal data without providing a privacy notice directly to the individual in combination with any of the criteria in the European guidelines;
• process personal data in a way that involves tracking individuals’ online or offline location or behaviour, in combination with any of the criteria in the European guidelines;
• process children’s personal data for profiling or automated decision-making or for marketing purposes, or offer online services directly to them;
• process personal data that could result in a risk of physical harm in the event of a security breach.

• confirmed whether the DPIA is a review of pre-GDPR processing or covers intended processing, including timelines in either case;
• explained why we needed a DPIA, detailing the types of intended processing that made it a requirement;
• structured the document clearly, systematically and logically;
• written the DPIA in plain English, with a non-specialist audience in mind, explaining any technical terms and acronyms we have used;
• set out clearly the relationships between controllers, processors, data subjects and systems, using both text and data-flow diagrams where appropriate;
• ensured that the specifics of any flows of personal data between people, systems, organisations and countries have been clearly explained and presented;
• explicitly stated how we are complying with each of the Data Protection Principles under GDPR and clearly explained our lawful basis for processing (and special category conditions if relevant);
• explained how we plan to support the relevant information rights of our data subjects;
• identified all relevant risks to individuals’ rights and freedoms, assessed their likelihood and severity, and detailed all relevant mitigations;
• explained sufficiently how any proposed mitigation reduces the identified risk in question;
• evidenced our consideration of any less risky alternatives to achieving the same purposes of the processing, and why we didn’t choose them;
• given details of stakeholder consultation (e.g. data subjects, representative bodies) and included summaries of findings;
• recorded the advice and recommendations of our DPO (where relevant) and ensured the DPIA is signed off by the appropriate people;
• agreed and documented a schedule for reviewing the DPIA regularly or when we change the nature, scope, context or purposes of the processing;
• consulted the ICO if there are residual high risks we cannot mitigate.