Risk and controls
Screen an activity for a data protection impact assessment
Apply the screening criteria on creation and on change, and either document why an assessment is unnecessary or begin one.
A hospital introducing a new patient monitoring device does not need to guess whether a DPIA is required; the Assessment tab asks the screening questions the Article 35 guidance sets out, and the answer either closes the question or opens the wizard.
This is exercised on creation of every activity, and again whenever the activity changes materially, because a low risk activity today can become a high risk one after a change to scope, technology or scale.
The proof is that a negative screening decision carries its own reasoning, and that a positive one holds the activity back from going live until the assessment concludes.
- Regulation
- Article 35
- Registers
- Processing activity · DPIA · Risk · Audit and review
The steps
- 01Open the activity's Assessment tab.
- 02Answer each screening question in turn.
- 03Where the screening result is negative, state the reason in the field provided and confirm.
- 04Where the screening result is positive, use "Link a record" to attach an existing DPIA or select "Start assessment" to open the assessment wizard.
- 05Confirm the activity's state rail now shows the assessment as an outstanding requirement before In use.
Accepted when
- A negative screening decision has to state its reason.
- A positive screening decision blocks activation until the assessment concludes.
Documents that carry the evidence
- DPIA · Data protection impact assessment
- The description, the necessity and proportionality test, the risks to individuals and the measures adopted. Article 35.
These templates are issued when the register opens, so the document exists before the record that cites it.