Lesson 13 of 26

Samira drafts a data protection impact assessment

For: Data Protection OfficerAbout 8 min

What you will be able to do

This lesson is for the Data Protection Officer. New processing that is likely to be high risk, such as analysing shoppers on CCTV, needs a data protection impact assessment, a DPIA, before it starts. Samira, the AI agent for data protection, drafts it from the template, asks you the facts only you know, and sends it to you for approval. You will ask for the DPIA, answer Samira's questions and find the draft waiting for your approval.

Before you start

  • You are signed in as the Data Protection Officer of Meridian Souq Trading LLC.
  • The record of processing activities lists In-store CCTV with footfall analytics, marked as needing a DPIA.

Steps

  1. 1

    Ask Samira for the DPIA

    In the AI team's Chat for Meridian Souq Trading LLC, type @ and pick Samira, the data protection agent, and type: we're adding footfall analytics to the store CCTV (the 'In-store CCTV with footfall analytics' activity in our register). Please draft the DPIA and send it to me for approval.

    • Type Message to the AI team: @Sam
    • Choose SSamiraAIData protection officer
    • Type Message to the AI team: @Samira we're adding footfall analytics to the store CCTV (the 'In-sto…
  2. 2

    Select Send

    Select Send. Samira's card under your message is marked Working.

    • Select Send
  3. 3

    Read Samira's to-do list

    Samira writes her to-do list: create the DPIA linked to the register entry, wait for the AI draft and review it, fill in the answers the records support, get the missing facts from you, and submit it for your approval.

    The screen at step 3: Read Samira's to-do list
  4. 4

    Answer Samira's questions and go-ahead

    After drafting most of the answers from the records, Samira asks the four facts the register doesn't hold, in one message, each with why she needs it and the possible answers: where the analytics data is processed and kept, whether shoppers can avoid the analytics, whether access to footage is limited to named roles, and whether footage is deleted automatically after 30 days. Type your answers together in the box under her question and select Send. A go-ahead to submit the DPIA for approval follows: select Approve.

    • Type Your answer: 1) Sentrix estimates age group and gender from body shape and clothing…
    • Select Send
    • Select Approve
  5. 5

    Read Samira's answer

    Samira's green Answer says the DPIA is waiting for your approval in the Approvals inbox, linked to the register entry, with all required answers filled in. It sums up the draft: high inherent risk, the lawful basis for the analytics not yet confirmed, and a recommendation to approve only on condition that the analytics stay off until signage, a signed processor agreement and the other measures are in place. It also lists what is still open, such as adding the analytics provider to the processor register and updating the register entry.

  6. 6

    Find the DPIA in Data Protection

    In the left menu, open Data Protection and DPIAs. The DPIA for the CCTV footfall analytics is there, pending approval, and Approvals in the left menu shows it waiting for you. You read it and decide.

How to check it worked

Data Protection, DPIAs lists the DPIA for the CCTV footfall analytics, pending your approval in the Approvals inbox. Samira's answer lists the risks, the measures and what you still need to decide.

Common mistakes

  • Approving the DPIA because the agent drafted it. You approve it as the DPO, after reading it.
  • Guessing answers to the agent's questions. If you don't know, say so; Samira records it as open.
  • Switching the analytics on before the DPIA is approved and the measures are in place.

Check your understanding

  1. 1. Who approves the DPIA Samira drafts?

    1. A.Samira
    2. B.The DPO
    3. C.The store manager
    4. D.Nobody
    Show answer

    Answer: B. The DPO

    The agent drafts and submits; the DPO decides.

  2. 2. Samira asks how long footage is kept. Why?

    1. A.To fill a form field
    2. B.Retention is a fact that changes the risk, and only you know it
    3. C.To delete the footage
    4. D.It is not needed
    Show answer

    Answer: B. Retention is a fact that changes the risk, and only you know it

    Agents ask for facts they can't find in the records, rather than guessing.