How do we complete a data protection impact assessment (DPIA)?
The steps you’ll need to take to complete a data protection impact assessment (DPIA) as a small organisation are similar to how you’d approach many other workplace decisions. Firstly, look at the situation you’re in and the options available to you. Then, weigh up the risks and opportunities, and describe your way forward. The ICO has template you can use and you can find it here.
When competing your DPIA, you’ll describe what you plan to do including whose data will be used. You will need to explain why you need to do it that way. You’ll then assess whether the processing is necessary and proportionate. In other words, a plan that’s balanced and makes sense. Then you can set out the measures you’ll put in place to ensure your plan complies with data protection laws.
If you think there are any risks to the rights and freedoms of data subjects, you need to make a record of this. You will also need to record any mitigations or solutions you’ve found. If you think your plans are high risk but you haven’t found any mitigations or solutions, you must take advice before you put your plans in action. This may involve consulting the ICO also.
If you are unsure, then contact us on 03333 22 1011 or via our contact form and we will be happy to help you.
