How to carry out a DPIA

A data protection impact assessment (DPIA) is a documented assessment of a project that uses personal data, carried out before the project starts. It describes what will happen to the information, tests whether the use is necessary and proportionate, identifies the risks to the people concerned and records the measures that will reduce them. The organisation responsible for the information (the controller) carries it out and takes the decisions in it.

The Janus DPIA tool carries out a DPIA in a conversation. This page sets out the method it follows. Each legal statement in the method is taken from the legislation or from the regulators’ published guidance, and the method is reviewed whenever the law changes (this page describes version 0.5.14).

When a DPIA is required

Under Article 35(1) of the GDPR (which applies in Ireland, and in the UK as UK GDPR), a DPIA is required where processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of individuals. Article 35(3) names three cases where one is required in particular: a systematic and extensive evaluation of people based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; processing special category data (such as health or biometric data) or criminal offence data on a large scale; and systematic monitoring of a publicly accessible area on a large scale.

The European data protection guidelines on DPIAs (WP248, endorsed by the European Data Protection Board) add nine criteria: evaluation or scoring; automated decisions with legal or similarly significant effect; systematic monitoring; sensitive or highly personal data; large scale; matching or combining datasets; vulnerable people; innovative technology; and processing that prevents people from exercising a right or using a service. Processing that meets two or more criteria will usually need a DPIA, and one can be enough. A count is never decisive on its own, so the tool records the reasons for its conclusion as well as the criteria.

The regulators also publish lists of processing that needs a DPIA. In Ireland, the Data Protection Commission’s list makes a DPIA mandatory for the following where a documented screening indicates a likely high risk:

1. Use of personal data on a large scale for a purpose other than the one for which it was collected.
2. Profiling vulnerable people, including children, to target marketing or online services at them.
3. Using profiling, algorithms or special category data to decide access to services, or with legal or similarly significant effects.
4. Systematically monitoring, tracking or observing people’s location or behaviour.
5. Profiling people on a large scale.
6. Processing biometric data to identify or authenticate people, combined with another of the European criteria.
7. Processing genetic data, combined with another of the European criteria.
8. Obtaining personal data indirectly where the transparency requirements are not being met.
9. Combining or linking separate datasets where this is used for profiling or behavioural analysis.
10. Large-scale processing for which the Data Protection Act 2018 requires suitable and specific measures.

In the UK, the ICO lists these as needing a DPIA:

1. Innovative technology, including AI and machine learning, combined with another of the European criteria.
2. Decisions about access to a product, service, opportunity or benefit based to any extent on automated decision-making or involving special category data.
3. Large-scale profiling.
4. Biometric data used to identify someone, combined with another criterion.
5. Genetic data, combined with another criterion (other than by a GP or health professional for direct care).
6. Combining, comparing or matching personal data from several sources.
7. Personal data not obtained from the person, where telling them would be impossible or involve disproportionate effort, combined with another criterion.
8. Tracking someone’s location or behaviour, including online (for location data, combined with another of the European criteria).
9. Using the personal data of children or other vulnerable people for marketing, profiling or automated decisions, or offering online services directly to children.
10. Processing where a personal data breach could put people’s physical health or safety at risk.

The tool screens against all of these and tells you the result in plain terms, with the reasons: a DPIA is required, recommended, or not required. When none is required, it produces a screening record that sets out the reasons and when the screening should be revisited.

How the tool carries out the assessment

The tool starts with what your organisation does and what you plan to introduce or change, and asks where your organisation is established and where the people affected are, so that it applies the right law. Early on it asks for any documents you have about the project: the contract or terms agreed with a supplier, the supplier’s product information, internal emails or plans, the privacy notice you give people and any policy that covers the project. It reads them, tells you what it has taken from each, and asks you to confirm or correct it. Where a useful document is missing it says so, and you can tell it you do not have it; it then asks the few questions the document would have answered.

It asks one question at a time, in everyday language, and explains any legal term it uses. As you answer, it drafts the DPIA beside the conversation, so you can read each section as it is written.

What the finished DPIA contains

Article 35(7) sets out the minimum content. The document the tool produces contains:

• the screening result and the reasons for it;
• a description of the processing and its purposes, including any legitimate interest relied on;
• the lawful basis, and the condition for any special category or criminal offence data;
• an assessment of necessity and proportionality, including less intrusive alternatives;
• the advice of your data protection officer, where you have one, and the views of the people affected or the reason they were not sought;
• a register of the risks to people, each scored for likelihood and severity, with the measures, the residual risk, an owner and a date;
• where AI is involved, a section on the system, automated decisions, accuracy and bias, human oversight and the AI Act duties;
• international transfers and the safeguards relied on;
• the outcome, the decisions taken and by whom, an action plan, and a review date with the changes that should trigger an earlier review;
• an annex listing the documents relied on and the assumptions you confirmed.

Risk scoring and prior consultation

Each risk is scored by how likely it is (remote, possible or probable) and how severe the harm would be (minimal, significant or severe), giving a rating of low, medium or high. It is scored again after the measures you have confirmed you will take. A score is lowered only for a stated reason, such as a measure already in place, and risks involving special category data, children or automated decisions with significant effects are not lowered below medium without a recommendation of professional review.

Where a high risk remains after the measures, the GDPR requires the controller to consult the regulator before the processing starts (Article 36). The European guidelines explain that consultation is required whenever the controller cannot find sufficient measures to reduce the risks to an acceptable level. In that case the tool says so plainly and prepares the information the regulator needs. It never recommends starting high-risk processing that has not been mitigated or consulted on.

What the tool does not do

The tool does not state or imply that processing is compliant, lawful or approved, and it does not take decisions for your organisation. If you describe something that raises a serious legal question, such as special category data with no available legal condition, it says so and recommends professional review before you go further.

If you describe a possible personal data breach, it pauses the DPIA. A controller must notify the regulator without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to people. The tool points you to our breach assessment and does not assess the breach itself.

Some rules fall outside a DPIA, such as the rules on sending marketing emails and texts and on recording calls. Where they are relevant, the tool notes them in the outcome and recommends checking them, but it does not assess them.

Your information

The conversation, your documents and the draft are kept in your browser on your device. They are stored on our servers only if you ask for a private link to continue on another device: your browser then encrypts the assessment before it is uploaded, and the stored copy is deleted 30 days after it was last saved, or sooner if you delete it. The privacy policy explains this in full.

Cost

Completing the assessment is free, and so is the screening record when no DPIA is required. Downloading a finished DPIA as a Word document costs £39. The tool is in beta: at the end, we ask for a rating and your comments, which we use to improve it. If you would like the assessment checked before you rely on it, a CIPP/E certified privacy professional reviews it, corrects it and returns it with a signed review note, from £120.

For organisations

If your organisation carries out DPIAs regularly, we can set the tool up for its own teams. Tell us how you carry out DPIAs today, for example whether you use your own template, risk scale or approval steps, and we will reply in writing with what we can offer. Tell us what you need.

Questions