Overview#
Before any law enforcement agency switches on facial recognition, bulk analytics, or systematic surveillance, the law requires a completed Data Protection Impact Assessment, and a regulator can halt the deployment if one is missing or inadequate. This module runs the entire DPIA obligation under GDPR Article 35 inside the platform, from a pre-populated template to a formal officer opinion.
Data protection officers and compliance teams have traditionally managed these assessments in spreadsheets and word-processor documents that drift out of date, lose their audit history, and disconnect the risk analysis from the processing activity it covers. This module replaces that with a governed lifecycle: open a template appropriate to the processing, refine a structured risk register, record mitigation measures with named owners and deadlines, route the assessment for review, and capture an approval or a prior-consultation flag. Every assessment is linked to the Record of Processing Activity it concerns, giving regulators an auditable chain from the risk assessment to the live operational data flow.
The capability reflects the real obligations on competent authorities. It distinguishes the standard GDPR regime from the Law Enforcement Directive transposed into the Data Protection Act 2018, derives an overall risk level from a quantified matrix rather than subjective judgement, and surfaces exactly when a supervisory authority must be consulted before processing begins.
Key Features#
-
Article 35 Lifecycle State Machine: Each assessment moves through a defined sequence of draft, submitted, officer review, and a final outcome of approved, rejected, or prior consultation required. Transitions are enforced so an assessment cannot skip review or be approved without an officer opinion on record.
-
Quantified Risk Matrix: Every identified risk is scored on a one to five likelihood against a one to five impact, producing a risk score from one to twenty-five. The platform derives the overall assessment risk level from the highest scoring risk, mapping to low, medium, high, or very high bands automatically rather than relying on a reviewer's gut feeling.
-
Mitigation Tracking with Residual Scoring: Against each risk, teams record one or more mitigation measures, each scored for residual likelihood and residual impact to show the risk that remains after the control is applied. Every measure carries a named owner and a due date, turning the assessment into an accountable action plan rather than a static document.
-
Formal Officer Review Step: A dedicated review stage captures the data protection officer's written opinion and the reviewer's identity and timestamp, satisfying the requirement that the officer's advice on a DPIA be sought and recorded.
-
Article 36 Prior Consultation Flagging: When residual risk remains high, the review can flag that prior consultation with the supervisory authority is required before processing proceeds, moving the assessment into a distinct holding state until that consultation is complete.
-
Five Pre-Built Templates: Ready-made templates cover general law enforcement processing, biometric identification, surveillance including CCTV and body-worn cameras, the Irish Law Enforcement Directive regime under Part 5 of the Data Protection Act 2018, and bulk data and intelligence analytics. Each opens pre-populated with a processing description, a necessity and proportionality justification, and a starter set of domain-appropriate suggested risks.
-
Record of Processing Linkage: Every assessment can be bound to the Record of Processing Activity it covers, connecting the risk analysis directly to the operational processing it governs and giving auditors a traceable chain from assessment to data flow.
-
Tenant-Isolated and Authenticated: All assessments, risks, and mitigations are scoped to the owning organisation and reachable only through authenticated, permission-checked requests, so no compliance record is ever visible across tenant boundaries.
Use Cases#
Biometric Identification Deployment#
A police service preparing to deploy facial recognition opens the biometrics template, which arrives pre-loaded with the characteristic risks of false-positive identification, algorithmic bias against ethnic minority groups, breach of a highly sensitive biometric store, and scope creep beyond the original purpose. The officer team refines these, records mitigations such as human confirmation thresholds and enhanced access controls, and routes the assessment for a formal opinion before any live use.
Systematic Surveillance and Body-Worn Cameras#
Agencies introducing CCTV, aerial surveillance, or body-worn cameras use the surveillance template to assess the proportionality of monitoring in public spaces, the chilling effect on lawful assembly, and the controls on footage sharing and retention, producing a documented justification that withstands regulatory scrutiny.
Bulk Data and Intelligence Analytics#
Teams running large-scale analysis of communications or financial data use the bulk data template to assess automated profiling risks, the consequences of a large breach, and the danger of repurposing analytics beyond the authorised intelligence remit, with human-review controls captured as named mitigations.
Irish Law Enforcement Directive Compliance#
A competent authority operating under Part 5 of the Data Protection Act 2018 opens the Ireland template, which frames the assessment around the Law Enforcement Directive principles of purpose limitation, lawful basis, access logging, and restrictions on international transfers, and surfaces victim-notification obligations, giving the Data Protection Commission a regime-specific record.
Cross-Border and Multi-Jurisdiction Teams#
Compliance functions operating across the United Kingdom and Ireland select the template matching the applicable transposition of the Law Enforcement Directive, keeping each assessment grounded in the correct statutory basis and supervisory authority.
Integration#
The capability is exposed through the platform's GraphQL service, the same authenticated interface used across the rest of the platform. Customer applications and compliance tooling can create assessments from a chosen template, list and retrieve assessments filtered by status, add risks and mitigation measures, and drive the review steps that move an assessment towards its outcome, all without leaving their own systems.
Assessments bind to Records of Processing Activities by reference, so a compliance dashboard or regulator-facing report can resolve from any operational processing activity to the assessment that covers it, and back. Risk and mitigation records follow a stable, normalised model: a risk carries its likelihood, impact, derived score, and category, and a mitigation carries its residual likelihood, residual impact, derived residual score, owner, and due date. These shapes are consistent across assessments and safe for partner systems to persist and report on.
Access is governed by OAuth 2.0 and JWT bearer tokens scoped to the tenant, so an integrator plugs the DPIA workflow into an existing portal or governance pipeline using the same authentication it already holds, with no separate credential model to manage. The benefit to the customer is a single auditable home for impact assessments that connects directly to operational data flows, replacing disconnected documents with a governed, machine-readable compliance record.
Open Standards#
-
GDPR Article 35 (Regulation EU 2016/679), the Data Protection Impact Assessment obligation. The lifecycle, risk register, and officer review implement the assessment that controllers must complete for high-risk processing.
-
GDPR Article 36 (Regulation EU 2016/679), prior consultation with the supervisory authority. The review step can flag that processing requires prior consultation, moving the assessment into a dedicated holding state until consultation is complete.
-
EU Directive 2016/680 (Law Enforcement Directive), the regime for processing by competent authorities for criminal law enforcement. Dedicated templates frame assessments around the Directive's principles, including purpose limitation under Article 5(1)(e), lawful basis under Article 8, access logging under Article 25, and international transfer rules under Articles 35 to 40.
-
Data Protection Act 2018, Part 5 (Sections 71 to 76, and Section 41(b)), the United Kingdom and Ireland transposition of the Law Enforcement Directive. The Ireland template grounds its necessity and proportionality text in these provisions, covering the data protection principles and lawful cross-purpose disclosure.
-
EU Victims' Directive 2012/29/EU, minimum standards on the rights of victims of crime. The law enforcement template surfaces victim-notification obligations as a tracked risk category.
-
EDPB DPIA Guidelines, the European Data Protection Board taxonomy for assessment. The risk categories follow this guidance, spanning data breach, unlawful access, loss of rights, discrimination, financial harm, reputational harm, physical harm, and loss of control.
-
OAuth 2.0 / JWT (RFC 6749 / RFC 7519), the open token framework used for all interface authentication and tenant-scoped authorisation.
Security and Compliance#
Every assessment, risk, and mitigation is scoped to the owning organisation. No record is visible, listable, or modifiable outside the tenant that created it, and all access requires an authenticated, permission-checked request.
The lifecycle is enforced rather than advisory. An assessment cannot be approved without first passing through officer review, and the officer opinion, the reviewer's identity, and the review timestamp are captured at the moment of decision, producing a defensible record for any subsequent regulatory examination by the Data Protection Commission or the Information Commissioner's Office.
Overall risk level is derived from the quantified matrix rather than asserted, so the rating an assessment carries is always reproducible from its underlying risks. Where residual risk remains high, the prior-consultation flag holds the assessment short of approval until the supervisory authority has been engaged, keeping the platform aligned with the legal sequence that high-risk processing must not begin before that consultation concludes.
Last Reviewed: 2026-05-26 / Last Updated: 2026-05-26