A helps you identify and minimise the data protection risks of a project. A is the person who advises, monitors compliance, and supports your organisation's UK GDPR obligations where appointment is required.
A and a solve different problems. The controller or processor remains responsible for compliance; a DPO advises and monitors without owning the processing decision.
Complete a before processing likely to result in a high risk to people's rights and freedoms. Consult the ICO before starting if measures cannot reduce the residual high risk. Separately, appoint a if Article 37 applies to the organisation's status or . A project may need a DPIA even where no DPO is required, and appointing a DPO does not transfer the controller's or processor's responsibility.
1
Section 1
What should teams decide about DPIAs and DPOs under the UK GDPR?
A is a process for identifying and minimising the data protection risks of a project. Under the UK GDPR, you must do one before processing that is likely to result in a high risk to individuals, including some specified types of processing such as systematic and extensive profiling with significant effects, large-scale processing of special category or criminal offence data, or systematic monitoring of a publicly accessible area on a .
Screen before design choices become fixed. Consider the processing's nature, scope, context, purposes, use of new technology, likelihood of harm, and severity of possible harm. The three Article 35 examples are not the only triggers; the ICO's published high-risk list and relevant combinations of risk factors also matter.
A is required for a public authority or body, except a court acting in its judicial capacity, or where require large-scale regular and systematic monitoring, or large-scale processing of special category or criminal-offence data. These appointment duties apply to controllers and processors.
Decide whether the project is likely to result in a high risk and therefore needs a .
Identify the nature, scope, context, purposes, necessity, proportionality, risks, and mitigation measures.
Decide whether the ICO must be consulted because the residual high risk cannot be reduced.
Check whether the organisation must appoint a because of its status or the nature, purpose, and scale of its .
Keep the decision, the rationale, and any review date in your records.
Binding Articles 35 to 39 on DPIAs, prior consultation, and DPO appointment, position, and tasks.
2
Section 2
Who should own DPIAs and DPOs, and what evidence should prove the decision?
The controller owns the decision and is responsible for carrying it out. The , where one is appointed, advises, monitors compliance, and supports the assessment but does not replace the controller's responsibility.
The must describe the processing and purposes, assess necessity and proportionality, assess risks to people's rights and freedoms, and state the measures that address those risks and demonstrate compliance. Seek the 's advice where one is appointed, consider consulting affected people or their representatives where appropriate, and record disagreements and sign-off.
For appointment, record the applicable Article 37 trigger or the reason no trigger applies. If the appointment is voluntary, the Article 37 to 39 requirements still apply to the role. Publish the DPO's contact details and communicate them to the ICO; the public contact details do not have to include the person's name.
A mandatory or voluntary must report to the highest management level, work independently, receive adequate resources and access, and avoid conflicting duties. A role that decides the purposes and means of processing, often a senior operational, finance, HR, IT, or marketing post, may conflict with the DPO's monitoring function; assess the person's actual authority rather than the job title alone.
Name the controller owner and the reviewer, if one is appointed.
Keep the screening checklist, template, approval notes, and review date together.
Record the reasons for any decision not to do a , and revisit that decision if the project changes.
Document why the organisation must appoint a , or why no appointment is required.
Keep the 's contact details current, publish them, provide them in privacy information, and communicate them to the ICO.
Document any decision not to follow the 's advice; the controller or processor owns that decision.
Binding accountability, DPIA-content, consultation, and DPO requirements.
3
Section 3
Which borderline cases need closer review?
New technology alone does not automatically require a , and there is no fixed numerical definition of . Assess the number of people, data volume and range, geographical extent, duration or permanence, monitoring frequency, vulnerability, and possible effects. A single risk factor may be enough where potential harm is serious.
are the organisation's primary objectives, not ordinary support functions such as its own payroll. The same processing may be core for a service provider. A health insurer's large-scale health-data processing or a large service's continuous behavioural tracking can trigger a appointment; an individual clinician's patient records ordinarily do not amount to .
High-risk screening must cover the operation as a whole. Examples that may require closer assessment include combining datasets from different sources, invisible processing, tracking location or behaviour, biometric identification, processing about children or other vulnerable people, and using new technology to make decisions that deny a service. An example is not an automatic result unless the statutory or ICO high-risk test is met on the facts.
Review the project again if the purpose, scale, data categories, or recipients change.
Use the early, before processing starts, and update it when the risk changes.
Consult the ICO if the shows a high risk that you cannot mitigate.
Make sure the can perform their tasks independently and has adequate resources.
If the screening does not require a , record why; doing one may still be appropriate for a major or uncertain use of personal data.
Check separate DPA 2018 regimes for law-enforcement or intelligence-services processing rather than assuming the UK GDPR test controls.
Start the while the project is still being designed. Describe what the processing does, why it is needed, what risks it creates, and what controls reduce those risks. If the remaining risk is still high, stop and consult the ICO before starting processing. Article 36 gives the ICO up to eight weeks to provide written advice, extendable by six weeks for complexity; the clock can be suspended while requested information is outstanding.
If you must appoint a , involve the DPO early, publish and notify the contact details, provide resources and access, protect independence, ensure direct access to the highest management level, and prevent conflicting duties. The DPO may be an employee, an external provider, or shared where the role remains effective and accessible.
Build the record around the processing description and purposes, necessity and proportionality, risks to people, and measures to address those risks. The linked workflow supplies fields for each part, advice, approval, and review.
Document why the project needs a or, if not, why it does not.
Keep a review schedule and reopen the when the project changes.
List the 's contact details in privacy information and relevant records.
Treat the as an adviser and monitor, not as the owner of the processing decision.
Reopen the when the nature, scope, context, purposes, technology, recipients, or risk changes.
Screen before design is fixed, complete and approve the DPIA before high-risk processing starts, consult the ICO where residual high risk remains, and document an independent DPO arrangement where Article 37 applies.