Data Protection Impact Assessment Services (DPIA) Services for UK Organisations
A data protection impact assessment is designed to identify and reduce the risks involved in a particular project you intend to carry out.
A Data Protection Impact Assessment helps identify and reduce privacy risks before a new project, system or use of personal data is introduced.
WDPS can help you establish whether a DPIA is required, carry out an initial screening assessment or support you through the full DPIA process.
Where a full assessment is needed, we review the proposed processing, identify risks to individuals, consider whether the processing is necessary and proportionate, and recommend practical measures to reduce those risks before the project goes live.
DPIAs are commonly considered for projects involving AI, employee monitoring, biometrics, large-scale processing or special category data. These factors do not automatically mean that a DPIA is required in every case; the question is whether the proposed processing is likely to result in a high risk to individuals.
A Data Protection Impact Assessment helps you identify, assess and reduce privacy risks before introducing processing that could have a significant impact on individuals.
If you’re launching a new system, using AI or biometric services such as facial recognition or fingerprint identification to monitor employees, or handling special category data, this will likely to result in a high risk Data Protection Impact Assessment.
Are you aware that it’s the data controllers responsibility to carry out a DPIA.
We help you assess the risks involved, decide whether a DPIA is the right approach and carry out and document your reasoning, and ensure your approach aligns with the UK GDPR and the Data Protection Act 2018.
Clara Westbrook
25+ Years PQE
Founder | Qualified Solicitor | Data Protection Specialist
07976 939 016
Do we actually need a DPIA?
Not every new system, technology or change in the way you use personal data requires a full DPIA. The key question is whether the proposed processing is likely to result in a high risk to the rights and freedoms of individuals.
A DPIA may be needed where, for example, you are:
- introducing new or innovative technology;
- using AI, profiling or automated decision-making;
- monitoring employees, customers or other individuals;
- using biometric data such as facial recognition or fingerprints;
- processing health or other special category data;
- processing personal data on a large scale;
- combining information from different datasets or sources; or
- introducing processing which could have a significant effect on individuals.
Can you screen the project before we commission a full DPIA?
Yes. If it is not clear whether you need a full DPIA, we can review the proposed processing first. We will look at what you intend to do, the personal data involved, who will be affected and the potential risks. If a DPIA is required, we can then carry out the full assessment. If it is not, we can help you document why you reached that conclusion.
This can avoid carrying out a full DPIA where one is not necessary, while still providing a record that the risks were properly considered.
What information will you need from us?
We normally start with a conversation about the project and review any documents you already have.
- what the project or system is intended to do;
- what personal data will be collected or used;
- where the information comes from;
- whose information will be processed;
- how the information will be used and shared;
- any suppliers or processors involved;
- international transfers;
- retention periods;
- security measures;
- whether AI or automated decision-making is involved; and
- any existing contracts, privacy information or data protection documentation.
You do not need to have all of this mapped out before speaking to us. Part of our role is identifying the questions that need to be answered.
How our DPIA process works
- Assess
Tell us about the project and what you are proposing to do.
We review the processing, establish whether a DPIA is required and identify the areas that need closer assessment. - Identify the risks
We consider how the processing could affect individuals and assess both the likelihood and potential severity of those risks.
We also consider whether the processing is necessary and proportionate and identify safeguards that could reduce the risk. - Document & advise
We prepare a clear, structured DPIA documenting the processing, risks and proposed safeguards.
Where changes are needed, we provide practical recommendations so that these can be considered before the project goes live.
Costing structure
We offer both a fixed fee and variable pricing. If you have any specific requirements please get in touch.
Fixed Fee | From £750 – £2,500 + VAT | Fixed |
Hourly Rate | £375 + VAT | Ongoing |
Daily Rate | From £1,000 + VAT | Better for long-term projects which may take a few days to a few weeks |
Retainer | Ongoing | Ongoing legal support |
DPIA timelines
A DPIA will typically take between one and four weeks, depending on the complexity of the processing, the number of stakeholders and suppliers involved, and how much information is already available.
We agree the scope and information required at the outset. Where issues emerge during the assessment, we identify these early so that they can be considered before the project progresses further. A DPIA should also be kept under review where the nature, scope, context or risks of the processing materially change.
Assess > Identify Risk > Document & Advise
When a DPIA may not be required
A full DPIA is not required simply because personal data is involved.
Routine, low-risk processing may not justify a full assessment. Equally, an existing DPIA may sometimes cover new processing if the nature, scope, context and risks are substantially the same.
Where a DPIA is not required, it can still be sensible to document the decision and the reasons for it.
If you are unsure, we can carry out an initial screening assessment before you commit to a full DPIA.
Why organisations use WDPS for DPIAs
A DPIA is most useful when it is carried out early enough to influence the project.
A common issue we see is the assessment being considered only after the system has been selected or the project is close to launch. At that stage, changing the proposed processing, supplier arrangements or technical design can be considerably more difficult.
Our approach is therefore to establish first whether a DPIA is actually required, identify the questions that need to be answered and focus the assessment on the risks arising from the proposed processing.
Request a DPIA consultation
Speak directly with a data protection solicitor +44 (0)7976 939 016 (Mon – Fri: 9:00 am – 6:00 pm Sat: 10 – 4pm). If you would like us to call or email you, please leave your details, and we will be in touch.
Westbrook Data Protection Services Limited,
2nd Floor, Midas House, 62 Goldsworth Road Woking, Surrey, GU21 6LQ
View our Privacy Policy here
Explore More Data Protection and Privacy Services
Our team have a deep understanding of the following areas of law and continue to add value to our clients’ businesses.
Latest Insights
- The GDPR Accountability Principle: From Paper to Practice
Accountability principle As a new consultant at Westbrook Data Protection Services, one of the first […] - Changes to employment law and the rise in Data Subject Access Requests
Changes to employment law and the rise in Data Subject Access Requests Employment Rights Act […]