Data Protection Impact Assessments

A DPIA is essentially a risk assessment for projects concerning personal data. The impact assessment identifies the risks, for example, of a data breach or a breach of data protection principles, and seeks to find practical ways to address and mitigate those risks if possible.

The DPIA does not have to be made public; however, it helps to reassure your stakeholders and the regulator, the Information Commissioner’s Office (ICO), that you can demonstrate accountability in terms of your decision-making. Many organisations will not have the necessary expert knowledge in-house to carry out effective DPIAs. Our Data Protection team can help you undertake DPIAs, minimising data processing risks for your organisation. 

Under UK GDPR, a data controller is required to carry out a DPIA when the anticipated processing of personal data is likely to result in a high risk to an individual’s rights and freedoms. The practical situations where a DPIA is required are numerous and many organisations are choosing to carry out a DPIA as a matter of good practice, even if they are not strictly required. DPIAs help you build trust with customers, clients, and staff, and can highlight potential problem areas before time and money is heavily invested.

At Thorntons, our specialist Data Protection team can advise you on when you need to carry out a DPIA and help you undertake the assessment.

In order to complete a DPIA, it is recommended you consult with all the relevant stakeholders, for example the project lead, your Data Protection Officer (DPO), Information Security Officer and Procurement Department (as appropriate).

A DPIA must contain and document all of the following:

1. A systemic description of the envisaged processing operations and the processing purposes, including any legitimate interest relied on by your organisation
2. An assessment of the necessity and proportionality of the proposed processing operation
3. An assessment of the risks to the rights and freedoms of individuals
4. Measures you have adopted to address any risks, including safeguards, security measures and mechanisms

You may consult the data subjects involved if you feel their input would be valuable in terms of building trust or gaining insight. In cases where the risks cannot be mitigated, you should consult the ICO. Thorntons can provide expert advice and guidance on any DPIA to ensure your organisation’s compliance with data protection law.