Every care agency processing health data is legally required to have a DPIA under Article 35 UK GDPR. We produce yours — bespoke to your service.
A Data Protection Impact Assessment (DPIA) is a mandatory legal document under Article 35 of UK GDPR. It is a systematic process for identifying and minimising the data protection risks of a project or system.
A DPIA is not optional. Under Article 35, you must carry out a DPIA before any processing that is "likely to result in a high risk to the rights and freedoms of natural persons."
Processing special category data (including health data) automatically triggers this requirement. Every care agency processes health data — diagnoses, medications, mental capacity assessments, care plans. You need a DPIA.
Care agencies face unique data protection risks that other sectors do not:
Key safe codes that could let anyone into a vulnerable person's home. This is the highest-risk data category in domiciliary care.
Real-time location monitoring of carers — often via personal mobile phones. This is systematic monitoring requiring a DPIA.
Medication Administration Records containing detailed health information. Often stored on tablets, phones, or shared drives.
Log my Care, Nourish, PCS, Birdie — cloud-based systems holding vast amounts of special category data with third-party processors.
The ICO specifies 7 mandatory steps that every DPIA must complete. We follow all of them:
Establish whether a DPIA is required and document the decision.
Document what data is processed, how, why, and by whom.
Identify who should be consulted (data subjects, DPO, experts).
Is the processing necessary? Is it proportionate to the purpose?
What are the risks to individuals' rights and freedoms?
What safeguards will you put in place?
Document decisions and get approval from senior management.
£1,500
£1,800
Delivered within 10 working days
From receipt of your completed intake questionnaire.
£8.7m
Under Article 83(4) UK GDPR, failure to carry out a mandatory DPIA carries a maximum fine of £8.7m or 2% of global annual turnover. The Advanced Computer Software Group was fined £3.07m in 2022 after a ransomware attack exposed home care clients' personal data.