How to conduct a data protection impact assessment

The Bottom Line

A Data Protection Impact Assessment (DPIA) is a formal process designed to help you identify and minimise data protection risks within your business. Under UK GDPR, you are legally required to conduct a DPIA for any processing activity that is likely to result in a high risk to individuals—such as large-scale financial monitoring, profiling, or using new technologies to handle personal data.

When do you need a DPIA?

You don't need a DPIA for every single thing you do, but in the world of fintech and business services, you will likely need one if you are:

• Using systematic and extensive profiling of customers to make automated decisions.
• Processing sensitive personal data on a large scale (e.g., financial history or biometric data).
• Monitoring a publicly accessible area on a large scale.
• Using new technologies or AI to process personal information.

Tip: If you aren't sure whether your project is 'high risk,' the Information Commissioner's Office (ICO) provides a screening checklist on their website to help you decide.

Steps to complete your DPIA

1. Identify the need: Explain why you are doing the assessment. What is the project, and why do you think it might involve high-risk data processing?
2. Describe the processing: Map out how data flows through your system. Where does it come from? Who has access to it? How long do you keep it? It is often helpful to draw a simple flow chart here.
3. Assess necessity and proportionality: Ask yourself if you really need all this data to achieve your goal. Is there a less intrusive way to get the same result? Compliance is about doing the minimum necessary.
4. Identify and assess risks: Think about what could go wrong. Could data be leaked? Could someone be unfairly denied a service based on an algorithm? Rate these risks based on how likely they are to happen and how severe the impact would be.
5. Identify measures to reduce risk: For every risk you found, decide how you will fix or reduce it. This might include encryption, anonymisation, or strict access controls for staff.
6. Sign off and record: Once you've decided on your mitigations, record the outcome. You must keep this document as evidence that you have considered the risks.

Best practices for a successful DPIA

Don't treat the DPIA as a 'one and done' box-ticking exercise. It should be a living document that you update as your technology or business processes evolve. Here are a few final tips:

• Start early: Conduct your DPIA at the design stage of your platform (Privacy by Design) rather than trying to retro-fit security later.
• Consult your team: Talk to your developers and any data protection experts to ensure you haven't missed a technical loophole.
• Be honest: The goal isn't to prove there is zero risk, but to show you understand the risks and have a plan to manage them.

If your DPIA identifies a high risk that you cannot mitigate, you must consult the ICO before you start the processing. However, in most cases, a thorough assessment will lead you to solutions that keep both your business and your customers safe.