The annual impact assessment: what to send, and when

Every January, the same quiet panic goes around. Someone remembers the data protection impact assessment is due within the first 90 days of the calendar year, and the hunt begins for last year's file. It does not have to be like that. Done properly, the assessment is the clearest management report you will read all year, because it tells you exactly where your organisation could hurt somebody.

What the assessment is really asking

Strip away the formality and it asks four questions. What personal data do you hold? What could go wrong with it? How likely and how serious would that be? And what are you doing to reduce it? Everything else is structure around those four.

What to gather

• Your record of what personal data you process and why, updated for any new systems.
• Any new or changed processing from the past year: a new customer portal, closed-circuit television cameras, a payroll provider, a marketing list.
• Your risks, written plainly: a laptop that leaves the building, a shared password, a supplier with weak security, paper files anyone can reach.
• The controls you have put in place, and the ones you planned last year but have not finished.
• Any breaches or near misses, and what changed afterwards.

Writing it so people act on it

Keep it in the language your board speaks. For each risk, one line on what could happen, one on how bad it would be, and one on what you are doing. Give every action an owner by name and a date. A risk with no owner is a wish.

The quiet benefit

Organisations that take the assessment seriously tend to discover something useful: data they no longer need. Deleting it is free, lowers your risk and shortens next year's assessment. I have never seen a business regret a clear-out done properly.

If you would rather not start from a blank page

Download our free impact assessment template, or let our virtual data protection officer service run the assessment with you, write it up and keep the actions moving through the year.

This article is general guidance, not legal advice.