Preparing A Data Privacy Impact Assessment

A data privacy impact assessment or a data protection impact assessment (DPIA) is an analysis of current systems in order to determine how secure certain data is. The General Data Protection Regulation (GDPR) requires businesses that are impacted by the GDPR to conduct a DPIA when it is deemed necessary. 

Regardless of whether it is a requirement, a DPIA is a great way to check whether the data you have been storing is secure. Once you’ve completed the assessment, you can take further steps to protect that data of your business and your consumers. 

As a business, having good data protection principles is not only necessary to run a secure business, but putting in the effort to make sure your customers’ data remains protected can build a better and more trusting relationship with them. 

In this article, we’ll go through the details of a data privacy impact assessment and how it can benefit your business. 

What Is Data Protection? 

In its broadest sense, data protection is the act of keeping personal and private information safe. 

Only the parties that have authorised access to the information (such as the collector) should be able to view it. If a party does not have the authority to access certain data, but they are able to view it somehow, this constitutes a data breach. 

Example Cherie runs a health supplement business online. In order to gain a better understanding of what products to recommend to her customers, Cherie gives them an optional questionnaire to fill out where they are able to divulge personal information about their health.  Once her customers have filled it out, Cherie has an online chat with them to further discuss which product could help them. As her customers are trusting her with private health information, Cherie is required to take great care in making sure only she is able to view the answers to their questions and nobody else has access to it.

Privacy And Data Protection Principles

The right to privacy is protected by the law. According to regulations, businesses that collect the information of their customers have a responsibility to ensure that information is kept securely and only collected with the permission of their users. 

Every website that engages in the collection of any kind of personal information (such as names, email addresses, bank details and phone numbers) needs to have a Privacy Policy in place that lets their customers know how their information will be used. 

What Is The General Data Protection Regulation?

The General Data Protection Regulation (GDPR) is a set of rules that have been created to go along with the Data Protection Act 2018. Among many things, the GDPR details when a business should have a privacy policy and what that privacy policy should include – it’s important to be in compliance with the GDPR in order to avoid legal consequences. 

If you need assistance or guidance on how the GDPR affects your business and how you can comply with privacy laws, chat with our privacy lawyers today. 

What Is A Data Privacy Impact Assessment?

A data privacy impact assessment is a study of the data protection systems a business currently has in place to assess whether they are adequate, as well as any risks they might be exposed to. 

There are no strict guidelines on how to conduct the assessment. Rather, all data privacy impact assessments should include: 

• A description of the data that is being processed 
• Identify the risk threshold the data in question falls under
• Prepare a consultation with any stakeholders and experts
• Check regulatory compliance 
• Look at the measures in light of necessity and proportionality to see if they are justified 
• Assess the effectiveness of current systems
• Address any risks 
• Make recommendations on any additional measures that need to be taken 
• Review and respond to the findings and recommendations 

When Should A Data Privacy Impact Assessment Be Undertaken?

It is recommended that a data privacy impact assessment is conducted as early on as possible. If your business begins a new project that will include securing data of any kind, the privacy assessment should be undertaken at the start of the project, or whenever it becomes feasible to do so.

Your business may have an appointed data protection officer who can conduct this assessment, otherwise, there is always the option to consult a professional to carry out this assessment for you. 

How Can I Protect My Business’ Data?

Businesses store a lot of data that is key to the businesses operations – this can include supply chain information, employee details, business plans, trade secrets, contracts with third parties and so forth. 

It’s important to protect this information as it details how your business functions and includes the organisations or individuals that associate with your business. You don’t want this information getting out, especially to potential competitors!

In order to protect this data, it’s important to organise it and keep it secured in one place. Most businesses choose to digitise a lot of their important documents and keep them protected behind firewalls and passwords (Sprintlaw offers an e-signature tool and platform where you can keep all of your documents in one place – chat to our team to sign up to our Sprintlaw Membership today!)

It’s quite common for businesses to have appropriate  and to invest in strong cyber security systems. 

How Can I Protect Consumer Data?

If you are collecting the data of your consumers, then you are likely to fall under the regulations of the GDPR and the Data Protection Act 2018. 

Again, it is crucial that you protect your data by limiting access to that information. 

Taking proactive steps to protect that data your business holds is important, however, it’s also important to be prepared for a scenario where data is unintentionally exposed or given to unauthorised parties. 

A Data Breach Response Plan is a predetermined system which determines the roles of every individual and the steps that need to be taken when data privacy is compromised. Having a plan in place for this makes the response much more efficient, as once there has been a data breach, time is of the essence to come up with a solution.  

Another proactive way to prevent data breaches is to have NDAs (as we discussed earlier) or confidentiality clauses in your agreements to ensure private information is not disclosed to unauthorised people. 

This also ensures that key information that is vital to your competitive edge does not end up in the wrong hands. 

How Do I Protect My Intellectual Property?

There are many ways you can protect your intellectual property. This way, you can minimise the risk of breaches of key information or trade secrets. 

Your intellectual property includes work that isn’t tangible which can take the form of trademarks, logos, personal photos, designs and materials that you have created from scratch. 

As great as it is to have your own original work out there, it can be subject to copycats and others who might like stealing ideas. The Intellectual Property Office is where you can get your trade marks, patents and designs registered. Having your intellectual property registered gives you, the owner, exclusive rights to use and licence that particular form of intellectual property. 

Licensing your intellectual property is a great way to make profits from your original work, but it’s important to have the details of this arrangement in writing to avoid any legal mistakes or problems with the other party – this is where you’d need an IP Licence (our lawyers can draft one up for you if needed!). 

Example Henry has designed a unique logo for his business. In the months since opening, his business has been doing relatively well. As things have taken off, Henry decides to register his trademark so he can secure it.  Upon filing his application, Henry is informed that there already is another business operating under the same category as him with a very similar trademark. As they registered before him, Henry’s options are severely limited.

Key Takeaways

Protecting the data of your business and consumers is an important art of running a firm enterprise. It can also aid your compliance with data protection laws and other relevant privacy regulations. 

To summarise what we’ve discussed: 

• A DPIA is an assessment on the current systems that are used to protect your data
• Once the assessment has been conducted, you can then identify any risks and work on mitigating them 
• The GDPR and the legislations require businesses to protect the data of their customers 
• It’s also important to look into protecting any intellectual property associated with your business to avoid disappointment later

If you would like a consultation on your options going forward, you can reach us at 08081347754 or [email protected] for a free, no-obligations chat. 

---