When do teams need a DPIA for UK GDPR processing?
Teams need a DPIA before processing when the type of processing, including the use of new technologies, is likely to result in a high risk to the rights and freedoms of natural persons. Article 35 also says a single DPIA may cover a set of similar processing operations that present similar high risks.
The UK GDPR gives examples of processing that usually requires a DPIA: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, where decisions produce legal effects or similarly significant effects; processing on a large scale of special category data or criminal conviction data; and systematic monitoring of a publicly accessible area on a large scale.
- Do the DPIA before launch, not after the processing has started.
- Use the DPIA to describe the processing, assess necessity and proportionality, identify the risks, and set out the safeguards.
- If the DPIA still shows a high risk after mitigation, consult the Commissioner before processing begins.
Primary source for when a DPIA is required and what it must contain.
Primary source for the examples of processing that require a DPIA.
Primary source for prior consultation if the risk remains high.