What is a DPIA?

Since the implementation of the GDPR, consumers have become increasingly data protection savvy. People want to know that businesses have the right safeguardsWhen transferring personal data to a third country, organisations must put in place appropriate safeguards to ensure the protection of personal data. Organisations should ensure that data subjects' rights will be respected and that the data subject has access to redress if they don't, and that the GDPR principles will be adhered to whilst the personal data is in the... in place. Data breaches can be devastating. They destroy trust and confidence, along with an organisation’s reputation. 

A Data Protection Impact AssessmentA formal documented assessment which allows decision-makers to identify, manage and mitigate any data protection risks associated with a project. (DPIA) is a processA series of actions or steps taken in order to achieve a particular end. used by privacy professionals to identify and mitigate data protection risks associated with the processing of personal dataInformation which relates to an identified or identifiable natural person.. Essentially, DPIAs are a risk assessment tool to help organisations evidence compliance with the principles of the GDPR and help reduce the likelihood of a data breach. 

Privacy legislation is constantly evolving, and it can often be confusing for companies to understand their obligations, particularly when it comes to carrying out a DPIA. 

DPIAs are a legal requirement when processing data that is likely to present a high risk to the rights and freedoms of individuals. But what constitutes high risk, and how often should a DPIA be performed? To help answer these questions and give a useful overview, we have put together this handy guide. 

The importance of DPIAs 

DPIAs are a vital tool for robust data protection. By conducting these assessments, companies can proactively identify the risks and analyse potential impacts associated with personal data processing. In some circumstances they are a legal requirement, but many companies choose to carry out a DPIA due to the additional risk reduction benefits they can bring. 

DPIAs offer many advantages, including:

• Instilling confidence among stakeholders and investors 
• Identifying measures which can lead to increased consumer trust (e.g. transparency and choice) 
• Heightening data protection awareness among employees 

DPIAs go beyond compliance. The assessment process is a cost-effective way to integrate data protection into the core of a business and build a good reputation. Proper implementation can identify privacy risks early in a project and allow for better processes at project inception, rather than treating data protection as an afterthought. 

Privacy by design is a data protection buzzword. It means an integration of personal data safeguards and processes into the design and development of products, business systems and technologies, from the very beginning. The goal of privacy by design is for data protection to become an essential part of the overall operation of an organisation. 

Paul Griffiths, DPO at The DPO Centre has worked with many companies, reviewing and advising on data protection frameworks, and he confirms,

“DPIAs can help to develop a culture where privacy is considered early in new project, products or services, thus embedding privacy by design in all business processes. These proactive assessments are vital for developing an effective privacy program.” 

When is a DPIA required?

Under the GDPR and UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU., a DPIA is required whenever the activity of processing EU and/or UK personal data is likely to result in a high risk to the rights and freedoms of individuals. To qualify as high risk, the data processing activities will meet certain criteria. 

The following are considered high risk activities, and when a DPIA must be undertaken: 

• Systematic and extensive evaluation/profiling that will have significant effects: this is the processing of substantial amounts of data and making decisions based on evaluations or profiles that could significantly affect individuals 
• Large scale processing of special category or criminal conviction data: this is data that includes sensitive information such as race, ethnic origin, health data, and religious beliefs 
• Systematic monitoring of public areas: for example, surveillance/CCTV cameras in busy places 

Other guidance gives details of situations that may indicate high risk. In these cases, you may not be mandated to carry out an assessment, but it would be best practice: 

• Evaluating or scoring individuals: for example, building a profile of individuals’ preferences to inform commercial marketing decisions 
• Processing information about people considered vulnerable: this includes, children, the elderly, or individuals with disabilities 
• Automated decision making with legal or significant effects: for example, the use of systems to approve/reject credit applications 
• Matching or combining information from multiple sources: such as collecting multiple datasets and combining them into one 
• Processing data on a large scale 
• Using individuals’ biometric or genetic information 
• Invisible processing: this is processing where the individual does not know you have their information  
• Tracking individuals online or using technology to track people in the real world 
• Any time there is a risk of physical harm to people  

DPIA best practices

Effective DPIAs require careful planning and execution to ensure they serve their purpose in analysing, identifying and mitigating data protection risks. An experienced Data Protection Officer (DPO) will advise on the best course of action and preparation, but here are some general guidelines to consider: 

1. Involve relevant stakeholders and if using third parties, you may wish to also involve them 
2. Carry out a screening assessment to determine if the activity is high risk, and if so, you must proceed to a DPIA 
3. Assess all risks, technical and non-technical and decide if a DPIA is required 
4. Reduce risks, either by implementing new processes, procedures or by gathering less data 
5. Review throughout the lifecycle of a project, especially when there are any company or legislation changes  

It is extremely important to document your decision-making throughout the entire process and detail why you believe risks have been reduced appropriately.  

Examples of complex DPIAs

A DPIA can sometimes be deemed “complex”, and this can bring additional challenges to the process. A complex DPIA refers to an assessment of a project which has complicated aspects, usually because the data processing activity is intricate, vast, deals with sensitive information, or uses new technologies.  

Complex DPIAs require skilled management and a diverse range of expertise. Organisations need to have careful consideration of the potential impacts on privacy rights and usually need help with these types of DPIAs from specialised data protection professionals. 

Here are a couple of real-life business examples of complex DPIAs, with links to the case studies: 

London Borough Barking & Dagenham Council: The council contacted The DPO Center to help them solve a particularly complex data governance problem, involving the application of a new technology to assist elderly and vulnerable residents. 

Clinisupplies: This organisation is part of a global healthcare group and provides medical devices and clinical nursing services within the UK. The DPO Centre’s outsourced DPO and team completed a complex DPIA that included an assessment of cloud hosting platforms. 

How to apply DPIA findings to your business 

You’ve completed a DPIA – what next? 

As we have discussed, DPIA’s are an essential part of a data protection strategy. However, a data protection impact assessment is only effective if actions are taken in response to the findings. 

Here’s how you can apply the evaluations effectively: 

• Develop an action plan – based on the findings, this could include implementing new processes, technologies or training programmes 
• Implement changes – Communication is key and relevant personnel and stakeholders should be informed of any steps being taken 
• Monitor and review – this will help you to ensure the mitigation strategies are working as intended and, if not, can be adjusted accordingly 
• Document everything – this is important for demonstrating compliance with data protection regulations 

Summary 

As we’ve explored in this guide, DPIAs are not only a legal requirement under the GDPR for high-risk data processing but also a proactive step to prevent data breaches, maintain customer trust, and strengthen the reputation of the business. 

Understanding when a DPIA is required and following best practices is essential. DPIAs are not a one-time process. Instead, they should be seen as a tool for continuous improvement and revisited as your business evolves, new technologies are adopted, or regulatory requirements change. 

If you would like to find out more about our data protection services and how we can support you with completing DPIAs, please complete the form below. 

FOR MORE UPDATES AND NEWS, FOLLOW US ON LINKEDIN