UK GDPR Data Protection Impact Assessments

Article 35 states that a DPIA is in particular required for systematic and extensive automated evaluation on which legal or similarly significant decisions are based; large-scale processing of special-category or criminal-conviction and offence data; and systematic monitoring of a publicly accessible area on a large scale.

Also check the ICO's Article 35(4) list and high-risk indicators. Relevant indicators include evaluation or scoring, significant automated decisions, systematic monitoring, sensitive or highly personal data, large scale, combining datasets, vulnerable people, innovative technology, and preventing access to a right, service, or contract. Two indicators often point to a DPIA, but that is not a strict threshold; one may be enough.

At minimum, describe the processing and purposes, including any legitimate interest; assess necessity and proportionality; assess risks to people's rights and freedoms; and describe measures that address those risks, including safeguards, security, and mechanisms demonstrating compliance.

The controller remains responsible for the DPIA. Seek the DPO's advice where a DPO is designated, obtain processor and technical input, and consult affected people or their representatives where appropriate unless doing so would be disproportionate or prejudice commercial or public interests.

If the completed DPIA shows that processing would result in high risk in the absence of measures and the controller cannot reduce that risk, Article 36 requires prior consultation with the ICO before processing. Do not accept or sign off unresolved high residual risk as a business choice and launch anyway.

Review the DPIA when the risk represented by the processing changes. Triggers include new purposes, data, recipients, models, profiling, decisions, vulnerable groups, transfers, security architecture, incidents, complaints, or evidence that a control is ineffective.