A data protection impact assessment (DPIA) is a written, systematic review your business must carry out before starting a data processing project that is likely to create a high risk for the people whose data is involved. It is a mandatory part of the European Union's General Data Protection Regulation (EU) 2016/679 (the GDPR) and its UK counterpart, the UK GDPR, and it applies to Australian businesses that fall within the reach of those laws.
The GDPR has applied since 25 May 2018 to Australian businesses of any size that have an establishment in the EU, offer goods or services to individuals in the EU, or monitor the behaviour of individuals in the EU. The UK GDPR, which retained the GDPR in UK law after Brexit, imposes the same DPIA requirement for processing connected with the UK.
This article explains:
- What triggers a DPIA: the "high risk" test and the processing types that almost always require one.
- What a DPIA must contain: the minimum content the law prescribes.
- Who is responsible: the controller's obligations and the processor's supporting role.
- What happens next: mitigation, regulator consultation and the consequences of getting it wrong.
When Does the DPIA Obligation Arise?
Article 35 of the GDPR requires a controller to carry out an impact assessment before processing where a type of processing, in particular one using new technologies, is likely to result in a high risk to the rights and freedoms of individuals. The test is a screening question, not proof that harm will actually occur. If the processing has features that point to the potential for high risk, you need a DPIA to examine the likelihood and severity of the harm in detail.
Article 35(3) sets out three types of processing that always require a DPIA:
- Systematic and extensive evaluation: automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the individual.
- Large-scale sensitive data: processing on a large scale of special category data, such as health, biometric or genetic data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, or sex life or sexual orientation, or of data about criminal convictions and offences.
- Public monitoring: systematic monitoring of a publicly accessible area on a large scale, such as a public CCTV network.
Regulators add to this list. Each data protection authority must publish the processing operations it considers to require a DPIA. The United Kingdom's Information Commissioner's Office (ICO), for example, lists innovative technology including artificial intelligence, biometrics, large-scale profiling, tracking of location or behaviour, data matching, and the targeting of children or other vulnerable individuals as operations likely to require a DPIA. European guidelines set out nine screening criteria, and where two or more apply to the same project, a DPIA is usually needed.
Two qualifiers are worth noting. First, "large scale" is not defined in the legislation; guidance points to factors such as the number of individuals involved, the volume of data, the duration of the processing and its geographic reach. Second, the GDPR allows a single DPIA to cover a set of similar processing operations that present similar high risks, so you are not required to start from scratch for every project in a series.
What Must a DPIA Contain?
Article 35(7) prescribes the minimum content of a DPIA. It must include:
- A description of the processing: a systematic description of the envisaged processing operations and their purposes, including any legitimate interest relied on.
- A necessity and proportionality assessment: whether the processing is necessary and proportionate in relation to the purposes you are trying to achieve.
- A risk assessment: the risks the processing poses to the rights and freedoms of the people whose data is involved.
- Mitigation measures: the measures envisaged to address those risks, including safeguards, security measures and mechanisms to demonstrate compliance.
There is no prescribed form or template. Regulators describe the DPIA as a flexible and scalable tool, with the level of rigour proportionate to the risks involved. Where appropriate, the controller must also seek the views of the people affected by the processing, for example employees who will be monitored, before finalising the assessment.
A DPIA is also a living document. The GDPR requires the controller to review it at least when there is a change in the risk posed by the processing, so a significant change to how or why data is processed should prompt a fresh look.
Who Is Responsible for the DPIA?
The controller, the business that decides why and how personal data is processed, carries out the DPIA. A processor, which handles data on the controller's instructions, does not conduct the assessment itself but must assist. Article 28(3) of the GDPR requires the contract between controller and processor to stipulate, among other things, that the processor assists the controller in complying with its obligations under Articles 32 to 36 of the GDPR, which include the DPIA and prior consultation duties. In practice, that means the data processing agreement should record the processor's obligation to help with the assessment and to provide the information needed to complete it.
Where the controller has designated a data protection officer, which is required only in certain cases, the controller must seek the officer's advice when carrying out the DPIA.
What Happens if the Risk Cannot Be Reduced?
The DPIA is not the end of the road. Where the assessment indicates that the processing would result in a high risk even after the proposed measures are applied, the controller must consult the relevant data protection authority before processing begins. The authority then has up to eight weeks, extendable by a further six weeks, to provide written advice.
Failing to carry out a required DPIA is itself an infringement. Under the GDPR, breaches of the controller's obligations in Article 35 can attract administrative fines of up to €10 million or 2% of total worldwide annual turnover, whichever is higher. The UK GDPR carries an equivalent maximum of up to £8.7 million or 2% of global annual turnover. Regulators also treat the DPIA as part of a broader accountability obligation: being able to show a properly run assessment is evidence that your business took data protection seriously, while the absence of one makes enforcement easier.
A Worked Example
Consider a Melbourne telehealth provider that treats patients in Australia, the UK and several EU countries. Because it offers services to individuals in the EU and the UK, the GDPR and UK GDPR apply to its processing of those patients' data. Health data is a special category, so the provider already sits inside the large-scale sensitive data trigger. When it decides to introduce an AI triage tool that assesses patient symptoms and recommends urgency levels, at least two more screening criteria are engaged: innovative technology and evaluation or scoring. A DPIA is required before the tool goes live.
The DPIA would describe how the triage tool works and what data it uses, assess whether it is necessary and proportionate to achieve the clinical benefit sought, and identify the risks to patients, including incorrect triage advice, discrimination against particular groups and unauthorised access to health records. It would set out the safeguards, such as clinician oversight of the tool's recommendations, pseudonymisation where possible, strict access controls and retention limits, and the provider would seek the views of patients and clinicians.
If, after those measures, the residual risk to patients remained high, the provider would have to consult the relevant data protection authority before launching the tool.
Common Misconceptions
A few misconceptions about DPIAs recur in practice:
- "DPIAs are only for large technology companies": The trigger is the nature of the processing, not the size of the business. An SME rolling out biometric time and attendance for its staff is a classic case: biometrics feature on regulators' lists, and employees are treated as vulnerable because of the power imbalance with their employer.
- "The GDPR does not apply to Australian businesses, so I can ignore this": The GDPR applies to Australian businesses of any size that offer goods or services to individuals in the EU or monitor their behaviour in the EU, and the UK GDPR applies in equivalent terms for processing connected with the UK. If that describes your business, the DPIA obligation applies.
- "The processor handles the DPIA": The controller is responsible for carrying it out. The processor's role is to assist and to supply information, as its contract requires.
- "It is just paperwork": Regulators are explicit that a DPIA is not a rubber stamp. Its outcomes must feed back into the project design, and failing to carry one out is separately enforceable.
- "Australian privacy law does not require this, so it is irrelevant here": The Privacy Act 1988 (Cth) does not impose a general, mandatory DPIA on private businesses. But the Office of the Australian Information Commissioner (OAIC) notes that privacy impact assessments, mandated in certain circumstances under the GDPR, are expected in similar circumstances in Australia. The Commissioner can direct government agencies to produce a privacy impact assessment under s 33D of the Privacy Act 1988 (Cth) where a proposed activity might have a significant impact on privacy, and a legislated review is due to consider whether that power should extend to private organisations. The OAIC also publishes a guide to undertaking privacy impact assessments and recommends them for high privacy risk projects.
How a Privacy Lawyer Can Help
The hardest part of a DPIA is often the threshold decision: whether a project is likely to result in a high risk so that a DPIA is required at all. A privacy lawyer can work through the screening criteria with you, run the DPIA itself, and make sure the four minimum elements are properly addressed. Where employee or customer consultation is needed, a lawyer can help structure it so that it meets the legal requirement without exposing commercially sensitive details.
Where a DPIA leaves a residual high risk, legal advice becomes important earlier rather than later, because the regulator consultation that follows has strict timelines and the authority can use its full range of powers in response. A lawyer can prepare the assessment for that consultation, deal with the authority's questions, and coordinate the GDPR or UK GDPR assessment with your obligations under the Privacy Act, so you are not running separate, inconsistent processes.
The Screening Question to Ask Before Any New Project
Before any new project that collects or uses personal data, the question to answer is whether the processing is of a type likely to result in a high risk to individuals. If biometrics, profiling, large-scale sensitive data, tracking, data matching or the targeting of vulnerable people are involved, treat that as a red flag and carry out the DPIA before the project starts. Where the risk cannot be reduced to an acceptable level, factor in a regulator consultation before you go live. The cost of a DPIA done properly and early is small next to the cost of enforcement action, or of a regulator ordering you to stop processing.