Run an impact assessment

When one is needed

Article 35 asks for an assessment where processing is likely to result in a high risk to people. Prudence raises this as a gap on activities that are in use, and does not block the activity from being in use while the assessment is prepared.

Steps

The assessment is guided in six stages. Scope is inherited from the processing activities in use, so you do not restate it.

1. 01ScopeOpen the processing activity, click its Assessment tab, and start the assessment from there. On the Scope step, confirm the processing activities it covers; an assessment cannot be scoped to an activity that is not In use.
2. 02RisksOn the Risks step, click Link an existing risk to bring in risks already raised against the activity, or click Create a new one instead to raise one here, matched to the activities it arises from.
3. 03TreatmentOpen each linked risk and, on its Assessment tab, set Treatment strategy, the owner, the deadline, the evidence it will leave, Conclusion on the effectiveness of the measures and the residual rating. A risk rated high may not be carried untreated.
4. 04ConsultationOn the Consultation step, fill in Advice of the Data Protection Officer, Views of data subjects, or why they were not sought, and Advice that was not followed together with the justification.
5. 05DecisionOn the Decision step, fill in Decision of the controller, Who took the decision for the controller, Date of the decision, and Position on prior consultation under Article 36.
6. 06BaselineSelect Approved on the lifecycle bar and click Record as approved. This freezes the version, and later changes to the scoped activities are reported as drift against it.