Data protection impact assessment
A data protection impact assessment identifies and reduces privacy risks before processing that is likely to create high risk for people.
Do it while the plan can still change
A DPIA is required before processing that is likely to result in high risk to people's rights and freedoms. It is also good evidence for a borderline proposal because it forces the employer to describe the purpose, necessity, effect and safeguards before deployment.
The ICO's DPIA guidance gives examples including systematic and extensive profiling, large-scale sensitive data and systematic monitoring. Workplace biometric identification is a specific case where a DPIA is required.
Describe the real processing
Map the data collected, source, people affected, systems, recipients, transfers, retention and decisions it supports. Explain why the outcome needs personal data and why a less intrusive method would not meet the purpose.
Assess both likelihood and severity of harm. Employment risks can include unfair exclusion, inaccurate decisions, loss of confidentiality, discrimination, distress or a worker being unable to exercise a right. Consult affected people or their representatives where appropriate, unless there is a recorded reason not to.
Resolve or escalate the residual risk
Name each measure, owner and due date, then reassess the risk after those measures. If high residual risk remains and cannot be reduced, consult the ICO before starting the processing.
Approve the assessment through a named decision-maker and link it to the processing record, contract and privacy information. Revisit it when the purpose, data, technology, provider, scale or affected group changes. A signed document is a checkpoint, not permanent approval.
Start free with your first 10 people.
Bring your team over from a spreadsheet. There is no card, no sales call and no lock-in. For up to 10 people, everyday HR is free.