Context
The ICO has an ‘Impact Assessment Framework’ which sets out when we do and don’t carry out impact assessments (IAs).
In ICO25, the ICO’s strategic plan, we made a commitment to develop an online tool that supports people to make subject access requests (SARs) in a way that enables businesses and organisations to respond effectively. SARs are a legal right under UK GDPR that enables people to request access to their personal data from organisations. There are many different ways people can request their personal data, one of which could be through an online tool.
The first version of the tool we committed to developing is now live on the ICO’s website and has replaced the existing document-based template. It provides an online form for requesters to fill-in the information relevant to their request with pointers for things to include. It also helps requesters identify where to send requests and sends them directly to organisations with instructions to help them respond quickly and simply.
The tool has been delivered using an agile project management approach. This approach allows the project delivery team to deliver useful outputs more quickly and gather feedback to inform future development of the tool or other supporting materials. It is currently in beta phase and is therefore subject to change throughout the ICO25 period (October 2022 to October 2025).
The project aims to deliver significant impacts to the interests of both data subjects and data controllers by making it easier to request personal data and respond to SARs. As stated in the IA Framework, we are more likely to carry out an IA where there are significant impacts on these two groups. In terms of proportionality, we expect the significant impacts of the tool to be positive and, given the agile approach to its development, risks and uncertainty are being mitigated as the project progresses. For this reason, we have opted for a lighter touch impact assessment that can be revisited as required.
The initial assessment of impacts is summarised in Section two and the initial theory of change is provided in Figure 1 in Section three. It is important to note that we do not intend for the summary to provide an exhaustive assessment of impacts. It is an initial overview of our considerations thus far.