Deciding when formal assessment is required.
WHAT TRIGGERS ONE
Processing likely to result in high risk to individuals.
WHAT INDICATORS TYPICALLY APPLY
Systematic and extensive evaluation of people Large-scale processing of sensitive data Systematic monitoring of public areas New technologies applied to personal data Data matched or combined from several sources Data about vulnerable people Processing preventing people accessing a service
WHAT TO DO
Screen new processing against those indicators.
WHEN TO SCREEN
Before building.
WHAT A SCREENING LOOKS LIKE
A short set of questions, answered and recorded.
WHAT THE OUTCOME IS
Either an assessment is required, or a recorded decision that it is not.
WHY RECORD THE NEGATIVE DECISION
It demonstrates you considered it.
WHAT TO AVOID
Deciding no assessment is needed because it would delay a launch.
WHY
That reasoning is visible afterwards.
WHAT TO DO WHEN ONE IS REQUIRED
Carry it out properly, involving the people who understand the processing.
WHAT TO DO WITH THE FINDINGS
Change the design, where risk can be reduced.
WHY THAT IS THE POINT
An assessment that changes nothing was not an assessment.
WHAT TO REVIEW
Assessments, when processing changes.
WHAT TO KEEP
All of them, indexed.
