DPIAs that are technically rigorous, legally defensible, and practically implementable.
Identify, score, and mitigate privacy risks before UK GDPR processing begins. Expert-led assessments designed to meet strict ICO standards without stalling your product launch.
What Is a DPIA and When Is It Legally Required?
A Data Protection Impact Assessment (DPIA) is a structured process required under UK GDPR Article 35 before processing likely to result in high risk to individuals. It identifies, assesses, and mitigates the privacy risks of a specific processing activity, and you must complete it before that processing begins.
The ICO has published a further list of processing it considers likely to result in high risk, including biometric and genetic data, tracking people's location or behaviour, and innovative technology such as AI. Some items on that list only trigger a DPIA when combined with other high-risk factors.
In practice, many organisations conduct DPIAs too narrowly or treat them as paperwork completed after processing has already started. That approach leaves them exposed if the ICO asks questions.
ARTICLE 35(3) STATUTORY TRIGGERS
Why Paper-Exercise DPIAs Fail Regulatory Scrutiny
DPIAs are frequently completed as a paper exercise: templates get filled in, risks are acknowledged at a high level, and the document is filed. A DPIA that stands up to ICO scrutiny shows that the organisation genuinely assessed the risks of the specific processing activity, identified concrete mitigations, assigned ownership, and evaluated residual risk before processing began. The ICO's list requires a DPIA for innovative technology, including AI and machine learning, when combined with another high-risk criterion. For AI systems, the assessment has to reflect how the model and its data pipelines actually work, not how the project plan describes them.
Why KEWDATA's DPIA Methodology Stands Apart
KEWDATA's DPIA methodology is built to meet strict accountability standards. Our process goes beyond standard policy reviews and questionnaire templates to look directly at the code and transport layers.
Processing Architecture Review
We examine the technical design of the processing activity, including data flows, system integrations, data storage, and access controls, rather than relying solely on what project teams describe in meetings.
Developer & Product Interviews
We engage directly with the engineers and product managers building the system to identify processing behaviours that may not be captured in project documentation.
Third Party Dependency Mapping
Many high-risk processing activities involve SaaS platforms, analytics tools, and third party APIs. We map the external data flows and assess their compliance status.
Concrete Mitigation Design
Our mitigations are specific and workable, not generic recommendations. Where technical controls are required, we work with your engineering team to define exactly what needs to be built or changed.
When Do You Need to Commission a DPIA?
Some processing always needs a DPIA, either under Article 35(3) or because it appears on the ICO's high-risk list. Other activities need screening first. An API integration or a new analytics project doesn't automatically require a full DPIA; it depends on the actual processing and whether it meets the ICO's risk criteria. If screening shows a DPIA isn't needed, record that decision and the reasons behind it. The scenarios below are common reasons to start that screening.
Deploying AI & Machine Learning
UK organisations integrating artificial intelligence, neural networks, or automated decision-making engines that inform profiles and classifications of individuals.
Employee Monitoring & Tracking
UK employers rolling out worker productivity tracking, keystroke logging, email screening, or geolocation tracking tools.
Profiling & Behavioural Targeting
Launching user profiling databases, cross-device tracking, custom personalisation engines, or real-time behavioural ad targeting networks.
Special Category & Criminal Offence Data
Processing health data, genetic data, biometric data used to identify people (such as facial recognition), data revealing racial or ethnic origin, or criminal offence data on a large scale.
Data Aggregation Platforms
Building platforms or central data lakes that combine and cross-reference personal records gathered from multiple separate sources.
Data Science & Analytics Pipelines
Introducing new database analytics, processing pipelines, or sandboxes that let researchers query large consumer datasets.
Third Party API Integrations
Integrating third party SaaS products or custom APIs where personal data is regularly transferred to external controllers or sub processors.
Governance Requirements
UK businesses documenting a formal privacy risk assessment to present to board members, investors, partners, or regulatory authorities.
The Scope of a KEWDATA DPIA Assessment
Every DPIA is tailored to your technical project, mapping necessity, risk thresholds, and concrete engineering mitigations.
Necessity & Proportionality
- Clear description of processing, purposes, and categories of data.
- Verification that processing is limited to what is required.
- Lawful basis analysis under Article 6 (and Article 9 if special category).
Risk Identification
- Identification of risks to data subjects: unauthorised access, profiling bias, loss of control.
- Technical factors: data minimisation gaps, database retention, insecure API transfers.
- Supply chain review: processor and sub processor risk exposure.
Risk Severity Scoring Matrix
- Each risk scored for likelihood and severity using a structured methodology.
- Inherent risk scoring (before mitigations) compared to residual risk scoring (after mitigations).
- Visual mapping of risks against ICO DPIA guidance.
Mitigation Design
- Specific mitigation steps for each identified risk.
- Clear ownership assigned to named project roles or teams.
- Technical control specifications defined for system engineers.
Residual Risk Evaluation & ICO Consultation
- Assessment of residual risk after mitigations are applied.
- Where residual risk remains high, documentation of the need for ICO consultation under Article 36.
- Preparation of the consultation request and supporting documents.
- DPIA register entry mapping: assessment date, key findings, review triggers.
Our DPIA Assessment Process: Step by Step
Here is how we guide your teams from initial system mapping through to final sign off.
1. Processing Mapping and Discovery
We document the full technical and operational scope of the processing activity. This includes interviews with technical leads, review of architecture diagrams, and identification of all data flows, including third party systems.
2. Necessity and Proportionality Assessment
We assess whether the processing is limited to what is necessary for its stated purpose and whether the same objective could be achieved with less privacy-invasive means. This is the foundation of a defensible DPIA.
3. Risk Identification
We identify privacy risks to data subjects from the specific processing design, not just generic risks. Technical, operational, and third party risks are assessed separately.
4. Mitigation Design
For each identified risk, we design specific mitigations. Where technical changes are required, we define them precisely enough for an engineering team to build without ambiguity.
5. Residual Risk Assessment & Sign Off
We evaluate residual risk after mitigations are applied and document the rationale for the processing decision. Where residual risk is high, we advise on ICO consultation requirements.
6. Completion and Ongoing Review Triggers
We hand over the completed DPIA and recommend triggers for review, such as changes to data flows, new sub processors, or product changes that materially alter the processing.
What You Receive at the End of the Assessment
Our DPIA deliverables are structured to satisfy board accountability standards and give engineering teams clear tickets to work from. KEWDATA supports the assessment, but your organisation stays responsible for the DPIA and makes the final decision on whether the processing goes ahead, as the ICO's guidance on carrying out a DPIA makes clear.
| DELIVERABLE ASSET | TARGET AUDIENCE | COMPLIANCE VALUE |
|---|---|---|
| Article 35 DPIA Dossier | DPO & ICO REGULATORS | Formal proof of proactive pre-processing risk scoring. |
| Risk Register & Matrix | LEGAL & SECURITY | Likelihood and severity values mapping out system vulnerabilities. |
| Mitigation Action Plan | PRODUCT & DEVS | Clear technical checklist tickets for product mitigations. |
Tom S.
Medical Practice
"Improved control over sensitive medical data"
"Practical guidance on access controls and data protection. Helped define structured access policies and introduced tokenisation for patient identifiers used in analytics."
Sarah S.
Retail, Enterprise
"Reliable partner for telecom data protection"
"Quickly understood telecom data complexity; helped classify sensitive datasets and apply protection measures for subscriber, usage, and billing data."
Pauliina H.
Entertainment, Enterprise
"Effective support for securing customer data"
"Identified where sensitive data lived and applied tokenization and anonymization strategies in a complex telecom environment."
Jordan R.
Computer Networking
"Practical approach to safeguarding e commerce"
"Helped protect PII, payment data, and order histories with tokenization and anonymization; advised on GDPR compliance for international operations."
Charmaine S.
Int. Trade & Development
"Systematic Approach Enhances Data Security"
"Methodical approach through discovery, planning, and implementation; implemented Microsoft Purview for a scalable compliance framework."
Kateryna H.
IT and Services
"Practical approach to protecting sensitive Data"
"Structured data discovery and classification combining technical analysis with finance data privacy expertise; strong masking and tokenization policies."
Snow D.
Market Research
"Practical expertise for telecom information"
"Introduced tokenization and controlled access strategies for subscriber data while still supporting analytics and reporting."
Laura H.
Hospital & Health Care
"Valuable expertise in healthcare protection"
"Strong expertise in healthcare data security; introduced anonymization techniques for safely using patient data in research and reporting."
Frequently Asked Questions
Standard questions regarding regulatory mandates and KEWDATA risk assessment support.
Under GDPR Article 36, if you cannot put mitigations in place that reduce the risk below a high level, you must consult the ICO before starting the data processing. KEWDATA prepares your prior consultation request, documents your justifications, and guides you through the consultation process.
Legally, a DPIA must be conducted before you begin processing data. Ideally, it should start during the design phase of a project ("Privacy by Design"). Conducting it retrospectively after systems are built makes applying mitigations much harder and more costly.
No, you do not need to submit every completed DPIA to the ICO. You are required to hold them internally as part of your accountability records. The only time submission is mandatory is if your residual risk remains high, prompting an Article 36 consultation request.
A DPIA should be treated as a living document. Review and update it whenever there is a material change to the processing activity, such as introducing a new database, transferring data to a new sub-processor, or altering access privileges.
No. A DPIA is project-specific and carried out before a processing activity begins. A GDPR audit reviews your overall compliance programme across all your processing activities. They're different accountability tools, and they work best together.
Planning a new product launch, AI feature, or data migration?
Make sure your risk assessment stands up to regulatory scrutiny. Speak with a KEWDATA specialist today.
Book a Free DPIA Scoping Call