Beyond the Checkbox: Getting Real Value from Data Protection Impact Assessments

By Gail Thomas a Senior Compliance Advisor at Cardiff University

Data Protection Impact Assessments have a habit of cropping up just when a project is starting to gather momentum. A DPIA is often seen as a form to complete, a hurdle to clear, or a document that sits in a project folder and is never looked at again. It can feel like something you have to do rather than something that helps you do your work better.

In practice, however, a DPIA can be far more than a compliance exercise: it can help shape a more robust and trustworthy project.

The most valuable DPIAs focus on understanding what you are trying to achieve, how information moves through your activity, where things could go wrong, and what you can do about it. When approached in the right way, a DPIA becomes less of a checkbox exercise and more of a planning tool.

Start with the journey, not the form

When people first look at a DPIA, they often worry that they don’t know enough about data protection law. What I have found is that researchers often know much more than they think they do.

Researchers understand their activities better than anyone else. They know what information they need, who they are working with, what systems they use and what outcomes they are trying to achieve. A good DPIA simply captures that understanding.
Researchers are often surprised by how much of a DPIA they have already completed without realising it. If you have a well-developed Data Management Plan, you may already be halfway to completing your DPIA. A DMP should contain much of the information needed to understand the lifecycle of the data: what information will be used, where it comes from, who can access it, how it will be secured, how it will be shared and published, and how long it will be retained. Rather than starting from a blank page, a DPIA builds on this foundation. Ethics applications, participant information sheets, consent forms and funding applications then help provide the broader context, ensuring that the use of personal data is not only well managed, but also fair, transparent and accountable.

One of the most useful exercises is to map the journey of the personal data from beginning to end:

• Who is involved in collecting, using and accessing the data?
• What personal data is being used? Does it include special category or criminal offence data?
• Why do you need the data, and why might another organisation need it?
• Where does the data come from, where is it stored and where does it go?
• When is the data collected, shared, retained and disposed of?
• How will the data be protected and managed throughout its lifecycle?

Answering these questions can reveal process improvements, security gaps, duplication, unnecessary complexity and opportunities to reduce risks to individuals.

A DPIA can create value in unexpected ways. It may identify information that is not needed to answer the research question or reveal that participants were never told their information could be reused in a particular way. It may also highlight dependencies that have been overlooked, such as the need for a data sharing agreement, appropriate contractual controls with a transcription provider, or assurance that a third-party platform used to store or process data meets the required standards.

These are not simply compliance considerations. Addressing them early can prevent delays, strengthen working relationships and improve the research.

Understanding the journey of personal data is key to identifying the pitfalls, risks and opportunities along the way. A DPIA can help shine a light on how to balance research needs and legal requirements while remaining fair to the individuals whose personal data you are using.

Ask the difficult questions early

The most important thing you can do from the outset when processing personal data is to define your purpose. Once you are clear about what you want to achieve, you can ask whether the data is necessary, whether the proposed use is fair and what safeguards should be built into the project.

A DPIA may be the answer if:

• You want to access data from an external source and need to provide assurances about how they will be used.
• You need to satisfy an ethics committee, sponsor or funder that privacy risks have been addressed.
• You are reusing existing data for a new purpose and want to understand whether individuals would reasonably expect that use.
• You are handling sensitive data and need to demonstrate that your research is worthy of public trust.
• You are using a new technology, AI tool or novel methodology and want confidence that the privacy implications have been properly considered.
• You want to identify and address privacy risks while changes are still practical to make.

The process of asking these questions early gives researchers time to test their assumptions, reconsider decisions and address potential issues before they become an obstacle to the research.

Secondary data, primary responsibilities

Secondary data can present some of the most interesting data protection challenges in research. Unlike a questionnaire or interview study, researchers may never meet the individuals whose information they are using. The data may have been collected years earlier by another organisation for an entirely different purpose.

Increasingly, researchers are also turning to publicly available information. This may include material on websites, social media platforms, public registers, online forums or other open sources. Publicly available does not mean risk-free. The fact that information can be accessed by anyone does not automatically mean it can be used for any purpose. Individuals may have very different expectations about how their information will be collected, analysed, combined with other datasets or used in research.

A DPIA helps researchers move beyond the question of “Can we access this information?” and consider the more important question: “Should we use it in this way?” By exploring fairness, transparency, reasonable expectations and potential impacts on individuals, a DPIA helps ensure that publicly available information is used responsibly, ethically and in a way that maintains public trust.

Whether information is obtained from another organisation, a public source or directly from participants themselves, a DPIA provides a structured way to understand where the data came from, what people might reasonably expect, and whether additional safeguards are needed. The absence of direct contact does not remove responsibility; it makes careful consideration of fairness and transparency even more important.

Building trust, not paperwork

A DPIA provides a clear record of why personal data is being used, who can access it and what safeguards are in place. It can help researchers explain to an ethics committee, sponsor, funder, data provider or partner organisation how privacy risks have been considered and managed.

In practice, that record can prove invaluable. A sponsor may ask how privacy risks were assessed before approving a study. A data provider may seek assurance before granting access to a dataset. An ethics committee may want to understand how participant expectations have been considered. Rather than answering each question from scratch, a well-prepared DPIA can provide a consistent and evidence-based response.

At its heart, a DPIA serves three practical purposes:

• It helps researchers design better projects
• It provides evidence that privacy risks have been properly considered
• It demonstrates accountability to participants, funders, regulators and partner organisations.

Trust is increasingly important in research. Participants, funders, partners and the public want confidence that information will be used responsibly. A DPIA helps demonstrate that difficult conversations about privacy, fairness and risk have taken place before data are collected or shared.

Beyond compliance

Data Protection Impact Assessments became a formal requirement in May 2018 when the EU GDPR came into force. The Information Commissioner’s Office describes a DPIA as “a process to help you identify and minimise the data protection risks of a project” and notes that it is also good practice for other major projects involving personal data, even where there is no strict legal requirement to complete one.

A DPIA must be completed where processing is likely to result in a high risk to individuals. What constitutes high risk depends on the circumstances, but examples could include decisions about healthcare or the use of large volumes of deeply personal information, such as information about mental health.

The UK data protection framework is intended to enable responsible uses of personal data. A DPIA records how privacy risks will be approached, what will be done to reduce their impact, and how the benefits of the proposed research have been balanced against the possible effects on individuals.

A DPIA is not a destination; it is a route map

Research projects do not always follow a straight line. New collaborators join, additional datasets become available, technologies evolve and research questions develop over time. A DPIA provides a route map that researchers can return to when the direction of travel changes. Revisiting it at key points in a project helps ensure that assumptions made at the outset remain valid, that new risks have been considered and that appropriate safeguards are still in place. In this sense, a DPIA is not simply a tool for managing privacy risks; it is a tool for navigating change throughout the research lifecycle.

Far from being a form-filling exercise, a DPIA is a practical tool for making better decisions about the use of personal data. Its real value lies not in completing the document, but in the conversations, challenge and improvements that happen along the way.

Note: Header image imagined from the text by artist Chris Glynn