Data Protection Impact Assessment Template

Use the Data Protection Impact Assessment Template to evaluate data processing activities, data sharing processes, facilitate international transfers, etc.

Download as free PDF

Library
IT & Data Center
Data Protection Impact Assessment Template

1.1 Proposal/Project/Activity Title

1.2 Information Asset Title(s) (if Applicable)

1.3 Information Asset Owner(s) (IAO)

1.4 Person Completing DPIA On Behalf Of The IAO (Named At 1.3 Above)

1.5 DPIA Commencing Date

1.6 Date Processing Activity To Commence (if Known):

1.7 Information Asset Register Reference (if Applicable):

1.8 DPIA Version

1.9 Linked DPIAs

1.10 DPIA Proposed Publication Date (where Applicable, And If Known)

Section 2: Personal Data

16. 2.13 (For law enforcement processing only) Will it be possible to easily distinguish between different categories of individuals (e.g. persons suspected of having committed an offense, victims, witnesses, etc.) as well as between factual and non-factual information (as per s.38 DPA)?

Photo Comment

Section 3: Purpose Of The Processing

6. 3.3 If you have selected ‘legal obligation’ or ‘performance of a public task’ for general processing (for Q3.2.a), OR if the processing is for a law enforcement purpose, indicate below the legal basis and relevant legislation authorizing the processing of the data:

Photo Comment

Section 4: Processing Activity

Section 5: Risks Of The Processing

6.1 External Contact Details For Data Exchange/ Processing

Technical Impact And Viability

Security

Section 7: International Transfers

5. 7,4 a) If ‘yes’, does the arrangement cover the purpose(s) for which you need to share data? Does the arrangement recognize the rights of data subjects? Does it include effective legal remedies for data subjects’ rights; set out important reasons of public interest and how those reasons are legally founded; or set out why the transfer is necessary in individual cases for a law enforcement purpose? (If yes go to Section 8)

Photo Comment

8.1 Referral To The ODPO

8.2 ODPO Review Complete

8.3 IAO Sign-Off

9.1 Criteria For Referral To The HO Data Board:

1. Has ODPO identified a risk that, in its opinion, requires escalation to the ICO (regardless of risk severity? Is guidance produced in due course once examples indicate how this might be revealed? Will the view of the Chair of the Data Board be sought in advance of any such escalation?

Photo Comment

Specific Referral Circumstances

9.2 Referred To The HO Data Board Secretariat

9.3 Action Taken By The Respective IAO(s)

Summary Of The Processing

1. Does the proposal/project/activity involve the processing of personal data, or is new legislation that relates to the processing of personal data being considered? (If the answer to this question is ‘No’, then the rest of the form does not need to be completed. If the answer is ‘Yes’, please continue.)

Photo Comment

Screening Questions

7. Does the processing activity include automated decision-making with legal or similar significant effects? i.e. processing that is intended to make decisions about data subjects that will produce “legal effects concerning the natural person” or which could “significantly affect the natural person”.

Photo Comment

10. Does the processing activity involve data processed on a large scale? (If sharing with a third party external to the Home Office, large scale is defined as 1,000 plus pieces of personal data in a single transaction or in multiple transactions over a cumulative 12-month period. )

Photo Comment

15. Is the introduction of new legislation or a legal regulatory measure that relates to the processing of personal data being considered? (If you have answered ‘yes’ to more than one of the above screening questions (Q 3 to 12), a DPIA must be completed. If you have answered ‘no’ to each of the screening questions but feel the planned policy/process/activity is significant, or carries reputational or political risk, you should complete the full DPIA.)

Photo Comment

Is this sample what you are looking for?
Sign up to use & customise this template, or create your own custom checklist:

Checklist by GoAudits.com – Please note that this checklist is intended as an example. We do not guarantee compliance with the laws applicable to your territory or industry. You should seek professional advice to determine how this checklist should be adapted to your workplace or jurisdiction.

Easy inspection app for your digital checklists

Conduct inspections anytime, anywhere - even offline
Capture photos as proof of compliance or areas needing attention
Instantly generate and share detailed reports after the inspections
Assign & track follow-up tasks, view historical trends on a centralized dashboard

Data Protection Impact Assessment Template

Use the Data Protection Impact Assessment Template to evaluate data processing activities, data sharing processes, facilitate international transfers, etc.

1. Is the access and use of the MACP portal for Migrant Help under the Advice, Issue, Reporting and Eligibility (AIRE) contract?

1. Are there any information asset titles available?

1. What is the email address?

2. What is the name?

3. What is the telephone number?

4. What is the information asset title?

1. What is the email address?

2. What is their name?

3. What is their telephone number?

4. What is their Business Unit/Team?

1. When did the DPIA commence?

1. What is the data processing activity commence date (if known)?

1. What is the information asset register reference (if applicable)?

1. What is the DPIA version?

1. What are the linked DPIAs?

1. What is the DPIA proposed publication date (where applicable, and if known)?

1. 2.1 What Personal Data is Being Processed?

2. 2.2.a Is the general processing regime (UK GDPR/Part 2 DPA) applied?

3. 2.2.b Is the law enforcement processing regime (Part 3 DPA) applied?

4. 2.3 Does the processing include any of the following special categories or criminal conviction data?

5. 2.4 Does it include the processing of data relating to an individual aged 13 years or younger?

6. 2.5 If yes, what additional safeguards are necessary for this processing activity?

7. 2.6 Will data subjects be informed of the processing? If ‘no’, why?

8. 2.7 If yes, how will they be informed/ notified?

9. 2.8 Which HO staff and/or external persons will have access to the data?

10. 2.8a How will access be controlled?

11. 2.9 Where will the data be stored?

12. 2.10 If the data is being stored electronically, does the storage system have the capacity to meet data subject rights (e.g. erasure, portability, suspension, rectification, etc)? If ‘no’, why?

13. 2.11 If ‘Yes’ how are these requirements met?

14. 2.12 (For law enforcement processing only) If the data is being stored electronically, does the system have logging capability (as per s.62 DPA)?

15. If ‘no’, what action is being taken to ensure compliance with the logging requirement?

16. 2.13 (For law enforcement processing only) Will it be possible to easily distinguish between different categories of individuals (e.g. persons suspected of having committed an offense, victims, witnesses, etc.) as well as between factual and non-factual information (as per s.38 DPA)?

17. If ‘no’, what action is being taken to ensure compliance with s.38 DPA?

18. 2.14 What is the retention period for the data?

19. 2.15 How will data be deleted in line with the retention period and how will the deletion be monitored?

20. 2.16 If physically moving/sharing/transferring data outside the Home Office, how will it be moved/shared?

21. 2.17 What security measures will be put in place to ensure the transfer is secure?

22. 2.18 Is there any new/additional personal data being processed? If yes, what are they?

23. 2.19 What is the Government Security Classification marking for the data?

24. 2.20 Will your processing include the use of cookies? If ‘no’ go to section 3.

25. If ‘yes’, what sort of Cookies will be used?

26. 2.20a If cookies fall into categories 2) & 3) how will you ensure data subjects are aware and can give active consent to the use of cookies?

1. 3.1 What is the purpose of the processing?

2. 3.1a.1 Is the General processing regime (UK GDPR/Part 2 DPA) applied?

3. 3.1a.2 Is the Law enforcement processing regime Part 3 DPA applied ?

4. 3.2a (General processing only) What is the (UK GDPR Article 6) lawful basis for the processing?

5. 3.2b (Law enforcement processing only) What is the (Part 3 DPA) lawful basis for the processing?

6. 3.3 If you have selected ‘legal obligation’ or ‘performance of a public task’ for general processing (for Q3.2.a), OR if the processing is for a law enforcement purpose, indicate below the legal basis and relevant legislation authorizing the processing of the data:

7. 3.4a (General processing only) If processing special category data or criminal convictions data, what is the (UK GDPR Article 9) condition for processing the special category data?

8. 3.4b (Law enforcement processing only) If processing sensitive data for a law enforcement purpose, what is the (DPA Schedule 8) condition for the processing?

9. 3.5 Is the purpose for processing the information described in 3.1 above the same as the original purpose for which it was obtained by the Department?

10. If ‘no’, what was the original purpose and lawful basis?

1. 4.1 Is the processing replacing or enhancing an existing activity or system? If 'yes', specify the details.

2. 4.2 If no, is the processing a new activity? Specify the details.

3. 4.3 Is this a one-off activity, or will it be frequent and/or regular?

4. 4.4 Does the processing directly relate to the processing of personal data that includes new legislative measures, or of a regulatory measure based on such legislative measures?

5. 4.5 If the answer is yes, please explain what that processing activity is, including whether or not the HO will be accountable for the processing of personal data

6. 4.6 Does the processing activity involve another party?

7. 4.6.a In what capacity is the other party acting?

8. 4.7 Will any personal data be transferred outside the country?

9. 4.8 Does the proposal involve profiling that could result in an outcome that produces legal effects or similarly significant effects on the individual?

10. 4.9 Does the proposal involve automated decision-making?

11. 4.10 Does the processing involve the use of new technology?

12. 4.11 If ‘yes', describe the new technology, including details of the supplier and technical support.

13. 4.12 Are the views of impacted data subjects and/or their representatives being sought directly in relation to this processing activity?

1. 5.1 Are there any other known, or anticipated risks associated with the processing of personal data that have been identified by the project/ program /initiative owner, which have not been captured in this document?

2. 5.2 What steps have been taken to mitigate these risks?

3. 5.3 Can you demonstrate that the risks to the individuals are sufficiently balanced by the perceived public protection benefits?

4. 5.4 Are these risks included within a risk register?

1. What is their name?

2. What is their grade?

3. What is their organization?

4. What is their Business Unit/Team?

5. What is the email address?

6. What is their telephone number?

7. 6.2 What is the legal basis/power/statutory gateway for the processing activity?

8. 6.3 How long will the data be retained by the receiving organization or processor for the purpose for which it is received?

9. 6.4 How will it be destroyed by the receiving/ processing organization once it is no longer required for the purpose for which it has been received?