Start a DPIA and find your way around it

Steps

1. 1

   Open the section named DPIAs and select New DPIA

   In Data Protection, select the section, then the New DPIA button. An impact assessment is a written assessment of the risks an activity creates for the people whose data is used, and of the measures that reduce them.

   • Select DPIAs0 (0)
   • Select New DPIA
2. 2

   Type the title and describe the risk

   In Title, type a name that says which activity is assessed. It is the only required field. In Risk Description, say in a sentence or two what could go wrong for the people concerned.

   • Type Title *: Loyalty programme profiling DPIA
   • Type Risk Description: Each member's purchases are profiled to set a loyalty tier and target…
3. 3

   Link the processing activity

   Open Link to processing activity and choose Loyalty programme membership. The link is what lets the approval of this DPIA return the activity to Active.

   • Select Select activity (optional)
   • Choose Loyalty programme membership
4. 4

   Score the likelihood and the severity

   Score how likely harm is and how severe it would be, each from 1, very low, to 5, very high. Type 4 and 4. The two scores are multiplied to give the risk level: sixteen is High.

   • Type Likelihood score (1–5): 4
   • Type Severity score (1–5): 4
5. 5

   Choose the template

   Under Template, eight sets of questions are offered. General DPIA is the standard assessment. The others add questions for special cases, such as children's data, employee monitoring, health data, or marketing and profiling. A Suggested tag marks a template that fits the linked activity, with the reason under it. Here the main risk is profiling, so choose Marketing and profiling.

6. 6

   Decide about the AI draft

   Also request an AI draft of the narrative is ticked to start with, and the button reads Request AI draft. Untick it to write the assessment yourself. The note changes to say that no AI draft will be generated, and the button now reads Create DPIA. A later lesson shows the AI draft.

   

7. 7

   Select Create DPIA

   Select the button. The form closes, and a message tells you to open the new assessment, fill it in and submit it for approval.

   • Select Create DPIA
8. 8

   Read the DPIA in the list

   The DPIA is listed with its risk level, High risk, the status Draft, the scores and the linked activity. On the right are Unlink, Re-draft AI, View Details and Void, which is for a DPIA entered in error. Select the title to show or hide its details.

9. 9

   Select View Details

   Select View Details. The DPIA opens on its own page. The heading shows the title and the status Draft. Below it, the processing activity is named, with Change to link a different activity and Unlink to remove the link.

   • Select View Details
10. 10

    Read the Overview tab

    The page has three tabs. Overview shows the Risk Assessment card: the two scores, the overall risk level and your risk description. Once the questionnaire is filled in, the assessment's main answers appear here too.

11. 11

    Open the Risk Actions tab

    Select Risk Actions. It is empty for now. Risk actions are created automatically when the DPIA is approved: each mitigation you write becomes an action that can be assigned and tracked.

    • Select Risk Actions
12. 12

    Open the Questionnaire tab

    Select Questionnaire. The top card names the template and the rated risk, with Export and Submit for approval. Submit stays greyed out until every required question is answered. The bar below counts the required questions answered. The next lesson fills them in.

    • Select Questionnaire