Data protection impact assessment—DPIA


Published by a ³ÉÈËÓ°Òô Risk & Compliance expert
Precedents
Data Protection Toolkit

Data protection impact assessment—DPIA


Published by a ³ÉÈËÓ°Òô Risk & Compliance expert

Precedents
Data Protection Toolkit
imgtext

    1. 1

      Project overview

      Project summary[Summarise the project, eg new IT system for storing and accessing personal data, or proposal to identify people in a particular group or demographic to predict their buying needs]
      Processing purposes[Insert the purposes of the processing, eg improve the quality and accuracy of employee personal data and implement an improved process for deleting data that is no longer required]
      Lawful ground for processing[Insert lawful ground. Where the organisation intends to rely on legitimate interests as the lawful ground for processing, describe those legitimate interests and also confirm that a legitimate interest assessment has been undertaken.]

    1. 2

      Identify the need for a DPIA

      1. 2.1

        Project aims and benefits

        What does the project aim to achieve?[State what the project aims to achieve]
        What are the anticipated benefits to the organisation, individuals and/or other parties?[Describe anticipated benefits]

      1. 2.2

        Preliminary screening

        QuestionAnswer/comment
        Does the project involve one or more of the following:
        —systematic and extensive evaluation of personal aspects relating to natural persons based on automated processing (including profiling) on which decisions are based that produce legal effects for or similarly significantly affect
Powered by Lexis+®
Jurisdiction(s):
United Kingdom
Key definition:
Data protection definition
What does Data protection mean?

In an employment context, this refers to the obligation on an employer to protect the data of its employees and ensure that it complies with the law on how it uses the employees' data.

Read more

Popular documents

If a multinational company with entities in a number of EU states has registered a data protection

If a multinational company with entities in a number of EU states has registered a data protection officer (DPO) with the Information Commissioner’s Office (ICO), does it need to register a DPO in the other EU states where it has entities or is registration in one country sufficient?Under Article 37

Training materials—GDPR and data protection compliance—for staff

Training materials—GDPR and data protection compliance—for staffThis Precedent presentation has been designed as an aid to train your staff on the general principles of data protection and how to manage this in the workplace. This Precedent is of general application, but incorporates the

How do I calculate the time limit for responding to a data subject request?

How do I calculate the time limit for responding to a data subject request?The General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR) provides for enhanced rights for data subjects, including providing rights of access, rectification, erasure and restriction of processing, data

Data subject access request form

Data subject access request formPlease complete this form if you wish to request access to your personal data. You do not have to use this form, but it will help us to deal with your request as quickly and effectively as possible if you do.You can also use this form if you are requesting access to