ICO publishes Code of Practice and template for Privacy Impact Assessments

This article was produced by Olswang LLP, which joined with CMS on 1 May 2017.

The ICO has just published its code of practice on conducting privacy impact assessments (PIAs), following a consultation last year. Although PIAs are not yet mandatory, they are regarded by the ICO as a helpful tool in identifying and reducing risk in systems and processes which involve personal data. The Code provides generic guidance on conducting a PIA and a very high level template and questions. The ICO suggests that organisations use the guidance to develop bespoke PIAs. Whether or not PIAs do eventually become mandatory under the proposed EU GDPR, it makes sense to risk assess significant new projects. With data security still top of the agenda, and the supply chain only as strong as its weakest link, PIAs are particularly important when selecting and contracting with suppliers who will process data on an organisation's behalf. The 49 page Code is available on the ICO website here