Data Protection Impact Assessment (DPIA) Compliance Check

Why this matters

A Data Protection Impact Assessment is a mandatory risk assessment under Article 35 of the UK GDPR whenever you plan to process personal data in a way that is likely to result in a high risk to individuals. The ICO publishes a list of processing types that always require a DPIA, including large-scale profiling, use of biometric or genetic data, tracking of individuals’ location or behaviour, and combining datasets from different sources. With more small businesses adopting AI tools, CCTV analytics, employee monitoring software and customer-tracking systems, many are now carrying out processing that triggers this requirement without realising it.

A DPIA must be completed before the processing begins, and it must describe the processing, assess necessity and proportionality, identify risks to individuals and set out measures to mitigate them. Where high risk remains after mitigation, you must consult the ICO before going ahead under Article 36. Failing to carry out a DPIA when required can attract fines of up to £8.7 million or 2% of global annual turnover, whichever is higher, under the Data Protection Act 2018, and a missing DPIA is often the first thing the ICO asks to see after a complaint or breach. Checking now is far cheaper than retrofitting an assessment after a system has gone live.

What you'll need

• Whether you are planning or already running any new system, tool or project that uses personal data
• Whether you use profiling, AI tools, biometrics, tracking, CCTV analytics or monitoring
• Whether you process children's or special category data, or data on a large scale
• Whether you have a DPIA template or process and who signs it off
• Who your Data Protection Officer or data protection lead is, if any

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.