Toolkit

Article 35(1) of the UK GDPR says:

"Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data."

DPIAs are a key part of your accountability obligations under the UK GDPR, and when done properly can help you assess and demonstrate how you comply with all of your data protection obligations.

As data analytics is likely to be classed as an innovative technology and profile individuals on a large scale, if you use it to process personal data, then you must carry out a DPIA. In any case, if you have a major project that involves the use of personal data, it is good practice to do a DPIA.

Article 36(1) of the UK GDPR says:

"The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk."

There is no explicit definition of ‘risk’ in the UK GDPR, but the various provisions on DPIAs make clear that this is about the risks to individuals’ interests. The concept of potential harm or damage to individuals links to risk. Recital 75 of the UK GDPR provides some examples of risks where processing may lead to physical, material or non-material damage, in particular where the processing may give rise to:

• discrimination;

• identity theft or fraud;

• financial loss;

• damage to the reputation;

• loss of confidentiality of personal data protected by professional secrecy;

• unauthorised reversal of pseudonymisation; or • any other significant economic or social disadvantage.