Compliance for DPIAs

What is a DPIA?

A DPIA is a process designed to help organisations identify and minimise the data protection risks of a project. Where the processing (eg obtaining or recording) of personal data (eg names, addresses and information about racial or ethnic origin) is likely to result in a high risk to individuals, a DPIA needs to be completed. For more information, read Data protection impact assessments.

Lawful basis for processing

Organisations will only be able to process personal data collected if at least one of the following six grounds has been met:

• consent - the data subject (ie the individual whose data is being processed) has given clear consent for the processing of their personal data for a specific purpose.

• performance of a contract - the processing is necessary for contract performance or to ‘take steps’ at the request of the data subject before entering into a contract.

• necessary for compliance - the processing is necessary to comply with the law (not including contractual obligations).

• protection of vital interests - the processing is necessary to protect someone’s life.

• public interest - the processing is necessary for the performance of a task in the public interest or for the organisation’s official functions, and the task or function has a clear basis in law.

• legitimate interest - the processing is necessary for the organisation’s or a third party’s legitimate interests unless there is good reason to protect the personal data which overrides those legitimate interests. Where this is the case, a legitimate interest assessment will need to be carried out.

The DPIA should set out which of these legal grounds for processing applies.

For more information, read Processing personal data.

Processing special category personal data

Special category personal data includes information about racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health or condition, sexual life, biometrics (eg fingerprint data/facial images) and genetics. Due to the sensitive nature of this data, it is given greater protection than other types of personal data (eg names and addresses). This means that, when processing special category sensitive data, further conditions for processing (see below) need to be met and recorded in a DPIA. 

Most of these further conditions revolve around the processing being necessary. Being ‘necessary’ doesn’t mean that the processing has to be absolutely essential, but it must be more than useful or habitual. It must also be a reasonable and proportionate way of achieving the purpose, and the organisation must not use more data than they need to achieve their purpose. See the Information Commissioner’s Office (ICO) guidance for more information.

Explicit consent

Where the data subject explicitly consented to the data processing. This means that consent must be freely given, specific, affirmative (opt-in), unambiguous, and able to be withdrawn at any time. Generally, for consent to be ‘explicit’, it:

• must be confirmed in a clear (verbal or written) statement (and not by another type of affirmative action)

• must specify the nature of the special category data

• should be separate from any other consent sought by the organisation

Read Consent under GDPR for more information. This condition applies to a wide range of circumstances, however, when relied upon, people need to be given a genuine choice over whether and how their data is used.

Employment, social security and social protection

The processing is necessary for the organisation to carry out its obligations and exercise specific rights in the field of employment and social security and social protection law in so far as authorised by the law. This condition is likely relevant for employers (eg to ensure the health and safety of staff). 

Associated conditions

For an organisation to be able to rely on this condition to process special category sensitive data, the following ‘associated conditions’ need to be met:

Vital interests

The processing is necessary to protect the vital interest of a data subject or another person where the data subject is physically or legally incapable of giving consent. This means that organisations should, where possible, ask for explicit consent. If a data subject refuses to give consent, this condition cannot be used as a fallback condition unless the data subject is physically/legally incapable of giving consent.

This condition generally only applies to matters of life and death and is likely relevant for emergency medical care (eg where personal data needs to be processed for medical purposes, but the individual is unconscious).

Not-for-profit bodies

Organisations can only rely on this condition if they:

• are a not-for-profit body (eg charities, trade unions, churches other associations if they have a political, philosophical, or religious aim).

• are processing special category data as part of their legitimate activities. This covers most conduct provided it does not stray outside the purposes and powers set out in the body’s constitution or governing documents.

• are only processing the data of members, former members, or other individuals in regular contact with them ‘in connection with their purposes’ (eg partners, supporters or beneficiaries). This means that the condition doesn’t apply to employee data or prospective member data.

• have appropriate safeguards in place (eg restricting data access, applying shorter retention periods, or providing individuals with an opt-out).

• don’t disclose this data to third parties without the data subject’s (explicit) consent.

Made public by the data subject

The processing relates to personal data that has been made public by the person to whom it relates. This condition doesn’t cover all special category data made public - it only covers personal data that the individual themselves has made public. Organisations need to be confident that individuals themselves actively chose to make their special category data public and that this was unmistakably a deliberate act on their part (eg blogging about a health condition).

Further, the data must be ‘manifestly made public’. This means that it must realistically be accessible to the public. Organisations should ask themselves whether any hypothetical interested member of the public could access this information (not whether it is theoretically available to the public, such as being mentioned in court).

When relying on this condition, organisations should keep a record of the data source, to help demonstrate that it was manifestly made public by the individual.

Legal claims or judicial acts

For legal claims, organisations must show that the purpose for processing is to establish, exercise or defend legal claims. Legal claims are not limited to current legal proceedings, but include processing necessary for:

• actual or prospective court proceedings

• accessing legal advice

• establishing, exercising or defending legal rights in any other way

Judicial acts apply where a court or tribunal is acting in its judicial capacity. Courts can apply this condition whether they are processing special category data in their judicial capacity. Where the processing is not part of their judicial capacity this condition doesn’t apply and a different condition is required.

Substantial public interest

The processing is necessary for reasons of substantial public interest.  Being of ‘substantial public interest’ means the public interest needs to be real and of substance. Due to the inherent risk of special category personal data, organisations cannot say that the processing is in the public interest for vague or generic reasons. Instead, organisations need to be able to make a specific argument about the concrete wider benefits of the processing. For example, organisations may wish to consider how the processing of sensitive personal data would benefit the public including:

• the amount of benefit experienced from the processing (even if only experienced by a small number of people)

• the number of people who would benefit from the processing

Organisations should focus on demonstrating that their overall processing purpose has substantial public interest benefits. Each time the organisation undertakes the processing they do not typically need to make a new public interest argument to demonstrate the specific benefits of processing, provided that the overall purpose for processing is of substantial public interest (as demonstrated initially).

Associated conditions

For an organisation to be able to rely on this condition, certain ‘associated conditions’ need to be met. For the substantial public interest condition, at least one of the 23 substantial public interest conditions set out in the Data Protection Act 2018 (DPA) need to be met. In most cases, the organisation will also need to have in place an APD. For more information on these associated conditions, read Substantial public interest for DPIAs.

Health or social care

The processing is necessary for health or social care purposes (eg the provision of medical diagnosis and the provision of social care, such as social work). 

Associated conditions

For an organisation to be able to rely on this condition, the following ‘associated conditions’ need to be met:

Public health

The processing is necessary due to public interest in public health. This condition may be relevant to public vaccination programmes, clinical trials and public health monitoring.

Associated conditions

For an organisation to be able to rely on this condition, the following ‘associated conditions’ need to be met:

Archiving, research and statistics

The processing is necessary for statistical or archiving purposes, scientific or historical research purposes and is in the public interest. This means that not all research is covered by this condition - only scientific or historical research that is in the public interest is covered.

Associated conditions

For an organisation to be able to rely on this condition, certain ‘associated conditions’ need to be met. To rely on this condition, the organisation must demonstrate that:

For more information on the conditions for processing special category personal data, see the ICO guidance.

Processing criminal offence data

Criminal offence data is personal data that relates to criminal convictions and offences or related security measures. Any information about criminal offences is treated separately to personal data and special category special data and is subject to even tighter controls that need to be recorded in a DPIA. 

Organisations must have a lawful basis for processing, be fair and transparent about the processing and comply with the data protection principles and requirements of the UK GDPR. Further, criminal offence data can only be processed under the control of official authority or where authorised by domestic law (the DPA sets out 28 conditions for processing criminal offence data). Organisations will need to determine whether they can process criminal offence data. For more information, read Criminal offence data for DPIAs.

If you have any questions about carrying out a DPIA or require assistance, Ask a lawyer.