Data protection impact assessments

What is a data protection impact assessment?

Data protection impact assessments (DPIAs) (also known as privacy impact assessments or PIAs) are a tool which can help organisations identify the most effective way to comply with their data protection obligations and meet individuals’ expectations of privacy. An effective DPIA will allow organisations to identify and fix problems at an early stage, reducing the associated costs and damage to reputation which might otherwise occur.

While not a legal requirement under the DPA, the ICO has promoted the use of DPIAs as an integral part of taking a privacy by design approach. See the ICO’s Conducting privacy impact assessments code of practice for good practice advice.

When do I need to conduct a DPIA?

You must carry out a DPIA when:

• using new technologies; and
• the processing is likely to result in a high risk to the rights and freedoms of individuals.

Processing that is likely to result in a high risk includes (but is not limited to):

• systematic and extensive processing activities, including profiling and where decisions that have legal effects – or similarly significant effects – on individuals.
• large scale processing of special categories of data or personal data relation to criminal convictions or offences.
  
  This includes processing a considerable amount of personal data at regional, national or supranational level; that affects a large number of individuals; and involves a high risk to rights and freedoms eg based on the sensitivity of the processing activity.
• large scale, systematic monitoring of public areas (CCTV).

What information should the DPIA contain?

• A description of the processing operations and the purposes, including, where applicable, the legitimate interests pursued by the controller.
• An assessment of the necessity and proportionality of the processing in relation to the purpose.
• An assessment of the risks to individuals.
• The measures in place to address risk, including security and to demonstrate that you comply.
• A DPIA can address more than one project.