DPIA Support

What a DPIA is

A Data Protection Impact Assessment (DPIA) is a structured process for identifying and reducing the data protection risks of a project before you start it. Under UK GDPR it is mandatory whenever processing is likely to result in a high risk to individuals, and it is good practice for anything new or significant even where the risk is lower.

A DPIA is not a form. It is a record of thinking: what you plan to do with personal data, why it is necessary, what could go wrong for the people involved, and what you will do about it. The written document is the output; the value is in the questions it forces you to answer while the design can still change.

When a DPIA is required

The ICO’s list of processing that always requires a DPIA includes:

• Large-scale processing of special category data, such as health, disability or safeguarding information
• Systematic monitoring of a publicly accessible area, including CCTV
• Use of innovative technology, including AI-driven tools, biometrics and new forms of tracking
• Profiling or automated decisions with legal or similarly significant effects
• Processing that could deny people a service or benefit
• Matching or combining datasets from different sources
• Processing children’s data for profiling or marketing
• Tracking location or behaviour

In practice, for the organisations we work with, this means:

Sector	Projects that usually need a DPIA
Care providers	New care-planning software, remote monitoring or sensors, CCTV in communal areas, body-worn cameras
GP, dental and pharmacy practices	Online consultation tools, new clinical systems, patient apps, sharing with new partners
Charities	Case-management systems, wealth screening, helpline recording, sharing with statutory partners
SMEs and software companies	Employee monitoring, AI features, analytics, any product that processes customer data at scale

If you are unsure, a short screening assessment answers the question and gives you a documented reason either way.

The steps of a DPIA

1. Describe the processing. What data, about whom, from where, for what purpose, shared with whom, kept for how long. Suppliers and sub-processors included.
2. Consult. The people who will use the system, the people whose data it is (or their representatives), your DPO, and where relevant your IT provider and suppliers.
3. Assess necessity and proportionality. Could you achieve the purpose with less data, less intrusion or a shorter retention period? What is the lawful basis, and the special category condition if one is needed?
4. Identify and assess risks. To the individuals, not just to the organisation: loss of confidentiality, inaccurate decisions, discrimination, distress, loss of control over their data.
5. Identify measures to reduce each risk. Technical (access control, encryption, pseudonymisation), organisational (training, procedures, contracts) and design choices (collect less, keep less, share less).
6. Record the outcome and sign off. Who approved it, what residual risk remains, and when it will be reviewed.
7. Consult the ICO if a high risk remains. If you cannot bring a high risk down to an acceptable level, you must consult the ICO before you begin.

Our DPIA guide walks through each step, and the free DPIA template gives you the structure.

Evidence and documents involved

A DPIA draws on, and often improves, the rest of your data protection foundations: your record of processing activities, privacy notices, retention schedule, supplier contracts and data sharing agreements. Where those are missing, the DPIA is usually where the gap is found. The completed assessment should be kept with the project records and revisited whenever the processing changes materially.

Common mistakes

• Doing it after go-live, when the design cannot change and the assessment becomes a justification rather than an evaluation.
• Assessing risk to the organisation (fines, reputation) instead of risk to the individuals.
• Treating the supplier’s DPIA as yours. A vendor’s document describes their product; your DPIA has to describe your use of it.
• Not consulting the DPO or not recording their advice, where you have one.
• Filing it and forgetting it, so nobody checks whether the agreed measures were ever implemented.
• Skipping the screening step, so the organisation cannot show it considered whether a DPIA was needed.

How it relates to the other standards

The DPIA is a core UK GDPR obligation and one of the specific tasks of a DPO, who must be consulted and whose advice must be recorded. For health and care providers, the DSPT expects DPIAs for new processing, and the same assessment supports both. Within an ISO 27001 ISMS, DPIAs feed the risk assessment for any system that handles personal data. Terms such as special category data, processor and pseudonymisation are explained in our glossary.

How 360 Cyber Compliance helps

We run the DPIA with you rather than for you, because the people who understand the processing are your project owner and the staff who will use the system. We supply the structure, the questions, the knowledge of what the ICO expects and the experience of what usually goes wrong. You supply the facts.

A typical engagement is a screening call, one or two workshops, a review of supplier documentation, and a completed DPIA with agreed measures, owners and a review date, at a fixed fee agreed up front. For organisations with several projects a year, DPIA support is included in our outsourced DPO retainer. We give honest advice about residual risk, including telling you when a project needs ICO consultation before it starts. Get in touch to talk through a project you have in mind.