GDPR Data Protection Impact Assessment DPIA Template | Assessment Requirements and Stages | Evaluate Privacy Solutions | Template for FCA Applications and Authorised Firms

1 Introduction

The terms Privacy Impact Assessment (PIA) and Data Protection Impact Assessment (DPIA) are often used inter-changeably within the security and privacy worlds but can sometimes have different meanings. The PIA is a long-standing term for an assessment that looks at the effects and risks of the privacy of a project or process, with privacy being considered and not just the data protection implications. Whereas DPIA is the term the GDPR utilises for the risk-based approach and pre-assessments for high-risk processing.

For the purposes of this document, [Your Company Name] (hereinafter referred to as the “Company”) expands upon the GDPR/DPA18 (collectively referred to in this document as GDPR) requirements as set out in the Regulations and encompasses data protection and privacy, with all aspects and facets being included and considered. We use the DPIA reference, but aim to exceed the Regulation requirements, using the European Data Protection Board (formerly The Article 29 Working Party) ‘Guidelines on Data Protection Impact Assessment (DPIA)‘, as well as the ICO reference to “Privacy Impact Assessments” (PIA).

2 Data Protection Impact Assessments (DPIA)

Data Protection Impact Assessments (DPIA) are a requirement of the GDPR and a tool that can assist those with data protection obligations in identifying the risks associated with data processing and posed to data subjects. It enables a pre-emptive approach to assess the risks and apply corrective actions and mitigating controls before a breach occurs.

This Data Protection Impact Assessment (DPIA) document accompanies our GDPR Policy & Procedures and aids in the privacy by design ethos advocated in the General Data Protection Regulation (GDPR) (EU)2016/679). Article 35 of the Regulation provides the situations and provisions for DPIAs and require those obligated under the GDPR to have processes in place to assess data protection risks and identify when a DPIA is required.

The overall aim of the Company DPIA is to apply solutions and mitigating actions where a processing activity is deemed likely to cause a high risk to one or more individuals. The mitigating actions are then implemented into the project plan and then reassessed to ensure that the risk(s) has been eliminated or reduced to an acceptable level. The overall scope of the risk solutions is to either: –

• Eliminate
• Reduce
• Accept

Where an impact assessment report indicates that the processing involved will or is likely to, result in a high risk to an individual(s) and we are unable to mitigate such risk(s) with appropriate measures or controls, we consult the Supervisory Authority prior to the processing taking place.

2.1 Assessment Requirements

Individuals have an expectation that the privacy and confidentiality of their information will be upheld and respected whilst their data is being stored and processed by any organisation. When the risks of processing are high, we employ the use of impact assessments to assess the risk, the impact and the likelihood, and to document the origin, nature, particularity and severity of that risk, along with the processing purpose, reasons and mitigating measures and/or proposed solutions.

We rely on the Article 35(3) conditions and accompanying Recitals as to when completing an impact assessment is necessary. This list is included below; however, it is not exhaustive, and we assess each process activity on its own merits and carry out a DPIA where we believe that the processing is likely to result in high risk.

Pursuant to Article 35(3) and Recitals 84, 89-96, we consider processing that is likely to result in a high risk to include: –

• Systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person(s)
• Processing on a large scale of special categories of data
• Processing on a large scale of personal data relating to criminal convictions and offences
• Systematic monitoring of a publicly accessible area on a large scale (i.e. CCTV)
• Where a processing operation is likely to result in a high risk to the rights and freedoms of an individual

• Those activities or processing operations  involving the use of new technologies
• New processing activities not previously used
• Processing considerable amounts of personal data at regional, national or supranational level, which could affect many data subjects

• Processing activities making it difficult for the data subject(s) to exercise their rights

The ICO have published a list of the processing operations that the Supervisory Authority requires an organisation to complete a DPIA for. The operations on this list have been deemed as ‘likely to result in high risk’.

The examples included in the list are non-exhaustive and a robust assessment is always conducted by the Company in the first instance to ascertain if any of the operations being performed should/will require a DPIA to be completed.

[Refer to the full list of examples and descriptions on the ICO website or use the EDPB guidelines.]

2.2 Impact Assessment Team

A lead is appointed to carry out the DPIA, follow the process, record the necessary information and report the results to the [Insert Name/Dept/Director/Senior Management Team/Data Protection Officer]. All DPIAs are carried out in conjunction with the Data Protection Officer who provides advice and support for the compliance of the processes with the GDPR rules. Where there are systems and/or new technologies involved, the DPIA team also includes an I.T representative.

If the screening questions indicate that an impact assessment is required, the DPIA Team Lead will assess the processing operations involved in the DPIA (using the positively answered screening questions) and decide if any further team members are required. This includes choosing specific team members who: –

• Understand the project’s aims and the organisations’ objective
• Authority to influence the design and development of the project and participate in decisions
• Expertise in data protection and compliance matters
• Ability to assess and suggest solutions to risks and develop mitigating actions
• Ability to communicate effectively with stakeholders and management

The DPIA Team Lead can at any point in the PIA process, engage other members to assist in specific areas as they deem fit or necessary.

3  DPIA Stages

We have divided the Data Protection Impact Assessment into stages to ensure that all aspects are covered, reviewed and documented. Each stage is covered in detail under its category heading.

[AUTHOR NOTE: We have also provided the complete impact assessment templates in an Excel format so that you can assess each DPIA project in an alternate format if required.]

• Stage 1. Identify the Need for a Data Protection Impact Assessment – review the GDPR Article 35(3) conditions and use the screening questions to ascertain if the processing is likely to result in high risk to individuals
• Stage 2. Project Brief & Plan – description of the information flows, what data is being processed, where it is coming from, who it is going to etc
• Stage 3. Identify the Risks – risks will include those to individuals, the organisation and compliance (law/regulation breaches) and after speaking to management, employees and stakeholders
• Stage 4. Identify and Evaluate Privacy Solutions – develop and document corrective actions, solutions and mitigating controls that can reduce or eliminate the risks. Evaluate costs and benefits of each solution
• Stage 5. Integrate Outcomes – the solutions and actions to reduce/remove the risks must be added back into the project plan so that the risks can be reassessed with the mitigating actions in place
• Stage 6. Authorisation & Recording – all stages of the DPIA must be recorded using the provided templates and sign off must be obtained from the DPIA Lead, DPO and Director/Senior Manager

3.1 Identify the Need for a Data Protection Impact Assessment

Not all processing activities will require a DPIA to be completed, it is therefore essential that we carry out a check and use our predefined screening questions to ascertain which (if any) of the high-risk operations we intend to carry out, will require an impact assessment to be completed.

The questions provided in the screening template cover most of the risks that could be classed as high to a data subject and can be used prior to each assessment proposal, however we also judge each processing operation on its own merits and add questions if they are specific to the project or objective.

We also start our internal and external consultations at this stage and involve stakeholders, employees, senior management and any associated third parties who play a part in the processing or can lend insight and feedback to the processing operation and proposed risks. If any risks are identified via consultations, these are also added to our impact assessment template.

[Author Note:] The below screening questions apply to all business types and sectors; however, you are free to add/edit/remove any questions as application to your company. [End Note]

3.2 Project Brief & Plan

Where data is obtained and how it is processed, stored and destroyed, is an essential part of a data protection impact assessment and as such, we utilise our existing Information Audit data to complete this part of the assessment.

The information audit enables us to identify, categorise and record all personal information obtained, processed and shared by our company in our capacity as a controller/processor and includes: –

• What personal data we hold
• Where it came from
• Who we share it with?
• Legal basis for processing it
• What format(s) is it in
• Who is responsible for it?
• Access level (e. full, partial, restricted etc)

We use the data on the existing Information Audit to help us populate the below project brief and plan. This plan serves as the basis for carrying out the audit and for demonstrating our compliance with the GDPR impact assessment requirements. We understand that an incomplete understanding of how information is obtained, processed and stored, can be a risk itself and must be documented to ensure a full assessment is possible.

Examples:

a. If we do not know how data has been obtained, we are unlikely to be able to verify the consent.
b. If we have not documented and evidenced that we have met all the lawfulness of processing conditions when the data was obtained, we may be unfairly processing information or be preventing an individual from exercising their data protection rights.

How information audits are documented is bespoke to each business and can involve several methods to ensure a complete profile of the data is obtained and accessible. We use one or more of the below methods for recording the personal information obtained, processed, stored and transferred by us: –

• Information Audit
• Data maps
• Information flow charts
• Information asset register

• [Add/Delete as applicable to your business]

The project brief and plan templates also consist of the project background information, such as objectives, purpose, proposals, consultation reviews, outline/summary and previous DPIAs. This gives an overall picture of the project and enables a better assessment of the privacy impact and risks.

The third part of the project brief and plan template is the main assessment questions which provide the basis for identifying the risks. The questions are predefined; however, we do add to these if the project requires specific questions or assessment criteria.

A DPIA is intended to be flexible and can accommodate any form of processing assessment. The responses to the assessment questions then give us the issues and associated risks that are transferred over to the Privacy Issues and Risks template, detailing who is impacted, how they are impacted and providing a risk rating.

3.3 Identify the Risks and Privacy Issues

Using the responses obtained from answering the assessment questions, we are now able to identify the privacy issues and associated risks and record who these risks will impact. Risks will usually fall into one of three categories: –

• Risks to Individuals – Any risk that affects a data subject, their data, their privacy or their rights is classed as a risk to an individual. Inadequate disclosure controls, consent issues, processing purposes and surveillance methods are just a few of the issues that may result in risks to individuals.
• Compliance Risks – These can arise where the assessment response indicates that a breach of laws, legislation and/or regulations will occur if the processing goes ahead. This can include non-compliance with the GDPR, PECR or human rights legislation.
• Corporate Risks – Risks that will affect the business, including reputation, revenue, fines and sanctions. These will mainly arise where the initial collection, consent, disclosures, sharing and storage of the personal information have not been complied with or where record keeping is ineffective.

Once the risks have been identified, the below risk matrix is used to give the risk a rating based on the severity of the impact and the likelihood of the risk occurring. This rating provides an easy to see colour code for how severe the risk could be to the privacy of individual and therefore the necessity of putting mitigating actions into place, or reassessing using the processing activity.

The risk rating table below uses the common ‘Red, Amber, Green (RAG)’ matrix, where each risk is given a RAG score based on the likelihood versus the impact.

• GREEN – Where an assessment outcome is Green, we still work to see if we can develop and implement any solutions or mitigating actions that can be applied to reduce the risk impact down as far as possible. However, most green rated risks are acceptable and so focus should be placed on those with higher ratings. Even where a green RAG rating has been given at the risk/privacy identification stage, this risk is still to be added to the mitigating actions template for continuity and to ensure that all risks have been recorded and assessed.
• AMBER – Where an assessment outcome is Amber, mitigating actions are always proposed and outcomes envisaged, before processing is approved. The aim is to reduce all risks down to a green (acceptable) level, however there will be occasions when processing must take place for legal/best interest reasons and so some processing with risks will go ahead and must be accepted into the project. All solutions and mitigating actions must first be considered, tried and applied if possible.
• RED – Where an assessment outcome is Red, it indicates that either or both impact and/or likelihood scores are unacceptable, and that complete solutions and mitigating actions would be required to bring both indicators down to an acceptable level. Some processing activities are eliminated at this point as the impact to individuals is considered to high risk to proceed.

However, in instances where the activity is essential or is a legal requirement, the proposed solutions and mitigating actions are applied and a further DPIA to see if the subsequent DPIA results in a Green and/or acceptable level of risk. If a high risk still exists and the processing activity is authorised, we always consult the Supervisory Authority (SA) prior to processing and advise that the DPIA indicates that the processing would result in a high risk and there is an absence of measures that can be taken mitigate the risk. We then await written advice from the SA and provide all information requested by them during this period.

The above process enables us to devise ways to reduce or eliminate privacy risks and assess the costs and benefits of each approach, as well as looking at the impact on an individual’s privacy and the effect on the processing activity outcomes. This enables us to document our identification and assessment of the risk, the solutions and mitigating actions used to reduce or eliminate the risk and records privacy risks which have been accepted as necessary for the project to continue.

3.4 Identify and Evaluate Privacy Solutions

Once all privacy issues and risks have been identified and rated, we begin identifying and evaluating solutions and mitigating actions. We address each issue and document measure and controls that will reduce the risk impact. It is not possible to eliminate all risks, but we aim to reduce them to an acceptable level. Where unable to reduce risks to this level, we decide on cancelling the project or, accepting the risk if there is a legal/best interests’ requirement.

Our aim is always to assess whether the impact on privacy is proportionate to the objectives of the project and to ensure that individuals and their privacy remains our priority. We consider any solution that may reduce risk and balance the aims with the impact.

When applying the solutions to the template, we use the risk rating obtained in the Risk Identification process to ensure that we know the current risk and what an acceptable level would be. Once all solutions have been added, we are then able to repeat the assessment of the risk and ascertain its eliminated, reduced or accepted result. The new risk rating is then added to the template.

Some of the steps we may use or consider reducing risks include: –

• Changing the personal information collected to reduce the privacy level when processing
• Carry out all processing in-house to avoid transfers or data sharing
• Utilise systems/technology to make the processing more accessible
• Creating new procedures for areas such as retention, destruction methods, exercising rights
• Developing new security measures for a specific project that align with its aims
• Ensuring that adequate and effective training is provided to staff of the data protection regulations and the project processing
• Publishing guidance manuals and supporting documents for use by those involved in the project
• Creating new materials and website content to enable us to better communicate with individuals
• Carrying out higher level of due diligence on any processors used for the project
• Producing data sharing agreements and transfer contracts
• Having all involved in the project sign non-disclosure and confidentiality agreements

We also assess the costs and benefits associated with all solutions to ensure that they are viable, feasible and proportionate to the privacy impact. All solutions also involve a review and input from the Data Protection Officer, who reviews them against the GDPR and any codes of conduct that we follow in accordance with data protection laws.

3.5 Integrate Outcomes

Once all risks and privacy issues have been identified and mitigating actions and solutions applied to reduce, eliminate or accept the risks, making the project viable, we then integrate the outcomes back into the project and create an action plan for developing and implementing the solutions.

The integrated outcomes template enables us to record what actions must now be taken to put the solutions identified above, into place. We also detail who has overall responsibility for ensuring that the actions are on track and completed, an estimated completion date and the status of the progress, so that any delays can be recorded, and other parties can see how far along we are in the process.

The action plan also allows us to ensure that all risks and solutions have been accounted for and are being mitigated against and that no actions are missed or stall. If at any point in the project, the objectives or processing operations change or need to be amended, we repeat the screening questions to ascertain if any new risks or privacy issues have been identified and then add these to the DPIA and provide solutions and action plan for them also.

The screening questions and assessment questions are revisited after all actions are complete to ensure that they are still appropriate and that solutions have reduced or eliminated the risks.

4 Authorisation & Recording

All stages and aspects of a Data Protection Impact Assessment are recorded and retained for 6 years after the project implementation date. These are also used again should a similar project or technology be utilised in the future.

The stages in the DPIA aim to demonstrate that we are carrying out effective assessments when high risks to privacy are involved and that the security and privacy of personal data is one of our main priorities. Keeping records of all stages enables us to evidence that we have identified, assessed and mitigated at every stage and that all risks have been evaluated.

Where there is a requirement for us to send a copy of the DPIA report to the Supervisory Authority, we do this within the deadlines and await their authorisation to proceed before going ahead with any processing. Such disclosures include the full report, along with a summary of the project, risks and proposed solutions.

The finalised DPIA is authorised by the Data Protection Officer, DPIA Lead and a member of the Director/Senior Management team.

DPIA LEAD:

Print Name:    ________________________                  Date:    ___________________

PIA Authorised:          Yes/No                                      Signed:    ___________________

DATA PROTECTION OFFICER:

Print Name:    ________________________                  Date:   ___________________

PIA Authorised:          Yes/No                                      Signed:   ___________________

DIRECTOR/SENIOR MANAGER:

Print Name:    ________________________                  Date:   ___________________

PIA Authorised:          Yes/No                                      Signed:   ___________________