Data Protection Impact Assessment

Confidential

Submitting controller details
Name of controller	University of Warwick
Title of project, software, etc.
Relevant reference numbers, etc.
Description
Name of DPO	Director of Legal and Compliance Services
Step 1: Identify the need for a DPIA Explain what your project does and why it might affect people’s personal data
Explain broadly what the project aims to achieve and what type of processing it involves. You may find it helpful to refer or link to other documents, such as a project proposal. Summarise why you identified the need for a DPIA.
Have you completed a DPIA screening questionnaire, and if so, what was the outcome? This helps decide if a full DPIA is needed
Step 2: Describe the processing
Describe the nature of the processing
How will you collect, use, store and delete data?
What is the source of the data?
Will you be sharing data with anyone (you might find it useful to refer to a flow diagram or other way of describing data flows), and have you agreed data processing agreements?
Will you appoint any processors, and if so, have you agreed data processing agreements? Processors are essentially third parties helping you handle data; do you have agreements with them?
What types of processing identified as likely high risk are involved? Are you doing anything sensitive or unusual with the data?
Describe the scope of the processing
What is the nature of the data, and does it include special category or criminal offence data? Special category data includes health, race, religion, etc: What is special category data? | ICO
How much data will you be collecting and using?
How often will you collect and use data?
How many individuals are affected?
How long will you keep it?
What geographical area does it cover?
Describe the context of the processing
What is the nature of your relationship with the individuals?
How much control will they have?
Would they expect you to use their data in this way?
Do they include children or other vulnerable groups?
Are there prior concerns over this type of processing or security flaws?
Is it novel in any way?
What is the current state of technology in this area?
Are there any current issues of public concern that you should factor in?
Are you signed up to any approved code of conduct or certification scheme?
Describe the purposes of the processing
What do you want to achieve?
What is the intended effect on individuals?
What are the benefits of the processing for you, and more broadly?
Step 3: Consultation process
Consider how to consult with relevant stakeholders
Describe when and how you will seek individuals’ views – or justify why it’s not appropriate to do so.
Who else do you need to involve within your organisation?
Do you need to ask your processors to assist?
Do you plan to consult information security experts, or any other experts?
Step 4: Assess necessity and proportionality
Describe compliance and proportionality measures
What is your lawful basis for processing?	☐ Consent ☐ Contractual performance ☐ Compliance with a legal obligation ☐ Vital interests ☐ Performance of a task carried out in the public interest or exercise of official authority ☐ Legitimate interests [If so, you must complete a Legitimate Interests Assessment, and can only proceed if you are satisfied that your legitimate interests are not overridden by those of the data subjects]
Does the processing actually achieve your purpose?
Is there another way to achieve the same outcome? Consider less intrusive methods or alternatives that reduce personal data use
How will you prevent function creep?
How will you ensure data quality and data minimisation?
What information will you give individuals?
How will you help to support their rights?
What measures do you take to ensure processors comply? For example, do you intend to use contracts with clear data protection obligations and monitor processor activities?
Will there be any international transfers of personal data?	☐ Yes [If so, you must complete an International Data Transfer Impact Assessment] ☐ No
Step 5: Identify and assess risks, and identify measures to reduce risk In this step, identify potential risks to the rights and freedoms of individuals resulting from the data processing activity. Assess the likelihood and severity of each risk. Then, for each identified risk, outline appropriate measures to eliminate or mitigate the risk to an acceptable level. Complete the risk assessment section of the Excel spreadsheet, detailing each risk, its likelihood, impact, overall risk level, proposed mitigation measures
Step 6: Sign off and record outcomes
Consultation with the Information Commissioner’s Office required	☐ Yes ☐ No
Proposed review date or frequency; and reasons for review	[Insert proposed review date or state recommended frequency of review]
Assessment completed by	[Insert name of Information Asset Owner]
Assessment approved on behalf of CIDO	[Insert name] [Position]
Assessment approved on behalf of DPO	[Insert name] [Director of Legal and Compliance Services / Senior Legal Counsel / Legal Counsel / Junior Legal Counsel]
Assessment approved on behalf of ICO (if relevant)	[Insert name] [Position]
Date of approval	[Insert date]
Comments or recommendations	[Insert comments or recommendations by the approving person (if any)]

Appendix 1

Please complete this appendix if the proposal will engage the Information Commissioner’s Age-Appropriate Design Code (the Children’s Code).

The Children’s Code applies to information society services likely to be accessed by children. “Children” means anybody aged under 18 years. “Information society services” means any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services e.g. ed-tech and e-learning platforms.

Describe how you comply with the Children’s Code. What specific measures have you taken to meet each of the standards in the code?
Best interests of the child?
Data Protection Impact Assessment?	The Children’s Code has been considered in the preparation of this Data Protection Impact Assessment.
Age-Appropriate application?
Transparency?
Detrimental use of data?
Policies and community standards?
Default settings?
Data minimisation?
Data sharing?
Geolocation?
Parental controls?
Profiling?
Nudge techniques?
Connected toys and devices?
Online tools?