Carry out a data protection impact assessment
Information governance, information security and data protection officer: Carry out a data protection impact assessment. Starts when: New processing is likely to be high risk. Steps: Describe the processing; Assess necessity and risk; Set mitigations; DPO advises; Sign off or consult the ICO. Done when: The DPIA is signed before processing starts and the DPO advice is recorded. Rules that apply: UK GDPR Article 35.