How to carry out a DPIA

Screen every new or changed processing activity against the high-risk triggers and record the answer. Where a DPIA is needed, describe the processing, test that it is necessary, identify and score the risks to people, choose measures, and have a senior person accept the residual risk. Consult the regulator first if the risk stays high.

When you need this

UK GDPR Article 35(1) requires a DPIA before processing that is likely to result in a high risk to people, especially with new technology. UK GDPR Article 35(3) names three cases that always need one: extensive profiling with legal or similarly significant effects; large-scale processing of special category data or criminal offence data; and large-scale systematic monitoring of a public area. UK GDPR Article 35(4) lets the regulator list more, and the ICO does. Article 35(7) sets the minimum content, and UK GDPR Article 36 requires prior consultation when high risk remains. EU GDPR Article 35(1), 35(3) and 36 are the same.

Triggers include a new product feature, a new supplier processing sensitive data, staff monitoring and any use of AI on personal data. A privacy lead usually runs it with the product owner.

This is guidance to help you understand the requirement, not legal advice.

Before you start

You need the project owner, someone who understands the data flows (often an engineer), your data protection officer if you have one, and the decision-maker who will accept the residual risk. Have the design documents, the supplier contracts and the relevant entry in your record of processing to hand.

Screening takes 30 minutes. A full DPIA for a significant feature takes two to five days of work spread over a few weeks, because consultation and design changes take time. Start at design, while the answers can still change the product.

Steps

1. Screen the processing against the screening questions below. Done when the answer and its reasoning are recorded, including when no DPIA is needed.
2. Describe the processing: the data, the people, the sources, the systems, the suppliers, the retention and the purposes. Done when a data flow diagram or table exists.
3. Consult the people who can see the risks: your data protection officer (UK GDPR Article 35(2)), processors, and, where appropriate, the people affected or their representatives (UK GDPR Article 35(9)). Done when each view is recorded with its date.
4. Assess necessity and proportionality. Check the lawful basis, that each data item is needed, and that a less intrusive way would not do. Done when every data item has a reason.
5. Identify the risks to individuals, not to the business: harm, discrimination, loss of control, financial loss, distress. Done when each risk names who is affected and how.
6. Score each risk for likelihood and severity on a fixed scale. Done when every risk has both scores and an overall rating.
7. Choose measures for each high or medium risk, each with an owner and a date. Done when every such risk has at least one measure.
8. Record the residual risk after measures and the decision-maker’s sign-off. Done when the DPIA is approved with a date and any advice not followed is explained.
9. Consult the regulator before starting if any residual risk stays high (UK GDPR Article 36). Done when the consultation is sent; the ICO has up to eight weeks to respond, extendable by six (UK GDPR Article 36(2)).
10. Integrate the outcomes into the design and review the DPIA whenever the processing changes (UK GDPR Article 35(11)). Done when the next review trigger is written on the DPIA.

The screening questions

Screening decides whether you need a full assessment. Ask, and write down the answer to each:

• Does it fall in one of the three Article 35(3) cases?
• Does it match an entry on the ICO’s list of ten types of high-risk processing, published under UK GDPR Article 35(4), such as innovative technology, large-scale profiling, data matching, invisible processing, tracking or targeting children?
• How many of the nine criteria in the European Data Protection Board’s endorsed DPIA guidelines (WP248 rev.01) does it meet? They include evaluation or scoring, sensitive data, large scale, vulnerable people and new technology. Two or more usually means a DPIA.
• Could it stop someone using a service or exercising a right?

If every answer is no, record that and stop. If the answer is uncertain, do the DPIA: a short assessment is cheaper than explaining a missing one.

Common screening mistakes

Teams screen only new systems and miss changes, such as adding a new data source to an existing CRM. They also treat “we already do this” as a reason to skip, when a growing scale is itself a trigger.

Worked examples

Checklist

• Every new or changed processing activity has a recorded screening decision.
• The DPIA was started before the design was fixed.
• The processing description includes data flows, suppliers and retention.
• Each data item has a stated reason it is needed.
• The data protection officer’s advice is recorded with a date.
• Risks are written as risks to people, not to the business.
• Each risk has a likelihood, a severity and an overall rating.
• Each high or medium risk has a measure with an owner and a date.
• The residual risk is signed off by a named decision-maker.
• Prior consultation was made where residual risk stayed high.
• The DPIA names what will trigger its next review.

How Sted helps

Related standards

• Data protection impact assessments: Articles 35 and 36 in full, with the UK and EU lists.
• Lawful basis for processing: the necessity test step 4 relies on.
• Records of processing activities: where each DPIA links to its activity.
• How to run a risk assessment: the scoring method, used here for risks to people.
• DPIA: the term defined.
• Documents: where you can keep your own DPIA beside Sted’s knowledge base.

Frequently asked questions