Data Protection Impact Assessment

Please note, the Data Protection & Freedom of Information Office (DP&FOI Office) provide advice and recommendations in relation to Data Protection Impact Assessments that are shared with them for review and comment. The DP&FOI Office do not “approve” or “sign off” on DPIAs. It is the responsibility of the PI/ Project Leader to either accept or overrule the recommendations issued by the DP&FOI Office. If the latter, this should be justified and recorded on the DPIA form.

  • What is a DPIA: A tool for building and demonstrating compliance and trust and for protecting the rights and interests of data subjects. A DPIA is a legal requirement when conducting research or projects involving human participants, or when the processing is likely to result in a high risk to data subjects.
  • When is a DPIA carried out: At the start of any major project/service that will process personal data, or when making a significant change that affects the risk level to personal data.  Assess and integrate DPIA actions into your project plan, and deliver on them. Examples of when a DPIA may be required include:
    • undertaking research involving human data subjects
    • building or migrating to new IT systems for storing or accessing personal data
    • developing or amending a policy or strategy that has privacy implications
    • embarking on new data sharing initiatives with other organisations
    • using data for new purposes  

  • Why carry out a DPIA: As stated above a DPIA is a legal requirement in certain circumstances. A DPIA allows you to assess and integrate DPIA actions into your project plan, and deliver on them so that appropriate technical and organisational measures are put in place to mitigate risks to personal data.

  • Who carries out the DPIA: For research projects, the Principal Investigator is responsible for the DPIA. For non-research projects/initiatives the project lead is responsible for the DPIA. The DPIA should be retained with all other project documentation for the duration of the project.

Where guidance or further information is necessary, consult the University DP Office at dp@glasgow.ac.uk and where relevant external stakeholders and experts. Please be advised that the DP Office will only review DPIAs involving human data subjects that are classified as high risk. Review the Information Risk Classifications to determine if you are working with high risk data. 

Later when your new process is in place, your DPIA will provide valuable evidence to the University’s Information Asset Register for on-going review and evidence to the ICO.

Due to high demand, the current turnaround time on DPIA reviews will be in excess of 8 weeks.  Depending upon the complexity of your project, there may also be extensive follow-up discussion before your DPIA is finalised. Please ensure that you leave enough time ahead of project initiation to accommodate this.

 

Data Protection Impact Assessment Template 

To evidence compliance with best practice, UofG has adopted the ICO Data Protection Impact Assessment (available to UofG staff by GUID login.)