The assessment has four required contents. Most of the documents we review answer the first and skip the second.
A data protection impact assessment describes the processing, assesses whether it is necessary and proportionate, assesses the risk to the people involved, and states the measures addressing that risk. The necessity and proportionality assessment is where most fall down, because it is the one that can conclude you should not do it.
- Four contentsThe minimum a DPIA must contain
- Three named casesWhere an assessment is specifically required
- High risk triggerLikely high risk to rights and freedoms
- Before processingIt is a design control, not a review
Six things that determine whether an assessment would stand up.
The trigger is likely high risk, not a category of data
The requirement arises where processing is likely to result in a high risk to the rights and freedoms of natural persons, in particular where new technologies are involved. That framing matters because it is about consequence to people rather than about whether the data feels sensitive, and it is why novel technology attracts the requirement even with ordinary data.
Three cases where it is specifically required
A systematic and extensive evaluation of personal aspects based on automated processing including profiling, where decisions produce legal or similarly significant effects. Processing on a large scale of special categories of data, or of criminal conviction and offence data. And systematic monitoring of a publicly accessible area on a large scale.
A systematic description of the processing and its purposes
The first required content, including where relevant the legitimate interests pursued by the controller. In practice this is the part organisations complete adequately, because it is descriptive. It is also the part that most often reveals that nobody had previously written down exactly what the system does with personal data.
Necessity and proportionality, which is the difficult part
The second required content is an assessment of the necessity and proportionality of the processing in relation to the purposes. This is the section most commonly skipped or reduced to a sentence, because a genuine answer can conclude that a less intrusive approach would achieve the same purpose, which is an uncomfortable finding to write about a project already underway.
Risk to the people, not risk to the organisation
The third required content is an assessment of the risks to the rights and freedoms of data subjects. That is a different exercise from an information security risk assessment, which asks what the organisation could lose. Both are legitimate. Substituting one for the other is the second most common defect in the assessments we review.
Measures, safeguards and mechanisms, stated specifically
The fourth required content is the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance. Specific measures with owners, not a general commitment to appropriate technical and organisational measures, which is a restatement of the obligation rather than a response to it.
Necessity and proportionality is a required content, and it can conclude no.
Of the four required contents, this is the one most often reduced to a sentence, and it is the one that makes the assessment a control rather than a record.
- The requirement is an assessment of the necessity and proportionality of the processing operations in relation to the purposes. Not a statement that the processing is necessary, an assessment of whether it is.
- A genuine assessment asks whether the purpose could be achieved with less data, with data held for less time, with aggregation rather than identification, or without the processing at all. Sometimes the answer is that it could, and that is precisely the value of doing the assessment before the system is built.
- This is uncomfortable when the project is already funded and underway, which is exactly why the assessment belongs at design stage rather than as a compliance step before go-live. At design stage a finding is a change. Before go-live it is a delay.
- It is also the section a supervisory authority or a regulator will look at hardest, because a description of processing tells them what you do and the necessity assessment tells them whether you thought about it.
Four things that make an assessment a control rather than a record.
We answer the necessity question properly, and early
Could the purpose be achieved with less data, shorter retention, or without identifying people. That question has a real answer, and at design stage the answer is a design change. Before go-live it is a delay, and after go-live it is a finding somebody has to explain. The timing determines the cost of every conclusion.
We assess risk to the people, not to the organisation
A privacy assessment asks what could happen to the individuals whose data this is. An information security risk assessment asks what the organisation could lose. Both are legitimate and they are different exercises. Substituting the second for the first is the most common structural defect in the assessments we review.
We write specific measures with owners, not general commitments
The requirement is the measures envisaged to address the risks, including safeguards, security measures and mechanisms to demonstrate compliance. A commitment to appropriate technical and organisational measures restates the obligation. Named measures with named owners and dates respond to it, and they are what an auditor can verify later.
We involve the people the regulation says to involve
The advice of the data protection officer is required where one is designated. The views of data subjects or their representatives are to be sought where appropriate, which in practice means workplace monitoring cases most often. Both are frequently skipped, and both are visible omissions if the assessment is ever examined.
Six UAE situations where an assessment is required or clearly advisable.
A business deploying a model that makes decisions about people
Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, where decisions produce legal or similarly significant effects, is one of the three specifically named cases. Screening, scoring, eligibility and prioritisation systems all fall here, and increasingly so does anything with a model in the decision path.
An organisation deploying cameras across a site or a portfolio
Systematic monitoring of a publicly accessible area on a large scale is named directly. In the UAE, camera systems across malls, campuses, compounds and mixed-use developments meet that description comfortably, and the assessment is where the retention period and the access model get decided rather than assumed.
A healthcare organisation processing health data at scale
Special categories of data processed on a large scale is the second named case. Health data qualifies, and so does biometric data processed for the purpose of uniquely identifying a person. Both are common in UAE healthcare, and the assessment is a requirement rather than a best practice in those circumstances.
An employer introducing workplace monitoring
This is where the requirement to seek the views of data subjects or their representatives most often becomes relevant. Monitoring introduced without that step, and without a documented necessity assessment, is both a compliance exposure and an industrial relations problem, and the second usually arrives first.
A business introducing biometric access or identification
Biometric data processed to uniquely identify a person is a special category, and access control deployments frequently process it at a scale that meets the threshold. The necessity question is particularly pointed here, because a card or a credential usually achieves the same access control purpose with far less exposure.
A firm launching a product that uses customer data in a new way
The general trigger is processing likely to result in a high risk to rights and freedoms, in particular using new technologies. A new product that uses existing customer data for a purpose customers would not expect meets that description regardless of whether the data itself is sensitive, and the assessment belongs in the product design.
How UAE organisations handle privacy assessments.
| Feature | Assessment at design stage | A template completed before go-live | No assessment |
|---|---|---|---|
Processing described systematically | Yes | Yes | No |
Necessity genuinely assessed | Yes | Rarely | No |
Less intrusive alternatives considered | Yes | No | No |
Risk assessed to people, not the organisation | Yes | Sometimes | No |
Measures specific with owners | Yes | Generic | No |
Residual risk accepted by a named person | Yes | No | No |
Data protection officer advised | Yes | Sometimes | No |
Data subject views sought where appropriate | Yes | Rarely | No |
Has ever changed a design | Yes | No | Not applicable |
Cost of a finding | A design change | A delay | An incident |
The general trigger, the three named cases, and what they look like in practice.
| Case | What the regulation says | What it looks like here | |
|---|---|---|---|
| General trigger | Processing likely to result in a high risk to the rights and freedoms of natural persons, in particular using new technologies | Any new system that makes decisions about people, or that handles their data in a way they would not expect | |
| Automated evaluation and profiling | Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, producing legal or similarly significant effects | Credit and eligibility decisions, automated screening, scoring models, and increasingly anything with a model behind it | |
| Special categories at scale | Processing on a large scale of special categories of data, or of personal data relating to criminal convictions and offences | Health data, biometrics used for identification, and background screening operations | |
| Systematic public monitoring | Systematic monitoring of a publicly accessible area on a large scale | Camera systems across a site or a portfolio, footfall analytics, and vehicle recognition | |
| Advice of the data protection officer | The controller shall seek the advice of the data protection officer, where designated | Where a data protection officer exists, their involvement is a requirement rather than a courtesy | |
| Views of data subjects | Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing | Employee representatives for workplace monitoring, which is where this most often applies |
Five steps, and the earlier it starts the cheaper every finding is.
- 1
Confirm whether an assessment is required, and under what
Against the general trigger of likely high risk to rights and freedoms, the three specifically named cases, and the local obligation, which we confirm against UAE law for your circumstances rather than assuming it mirrors another regime. That answer determines whether this is mandatory, advisable or unnecessary.
- 2
Describe the processing systematically
The categories of data, the people involved, the purposes including any legitimate interests pursued, the lawful basis for each element, everybody with access including processors and anybody offshore, the retention and the reason for it. This is descriptive work and it frequently produces the first surprise.
- 3
Assess necessity and proportionality honestly
Could the purpose be achieved with less data, a shorter retention, aggregation instead of identification, or not at all. The least intrusive alternative has to be considered in order to be rejected. This is the section that makes the assessment a control, and it is run with the people who own the project rather than about them.
- 4
Assess risk to the individuals and design the measures
What could happen to the people whose data this is, stated concretely rather than as a category. Then the measures envisaged to address those risks, including safeguards, security measures and mechanisms to demonstrate compliance, each specific and each with an owner and a date.
- 5
Take advice, record acceptance and keep it live
The advice of the data protection officer where one is designated, and the views of data subjects or their representatives where appropriate. Residual risk accepted by a named person with the authority to accept it. Then a trigger for review, because an assessment describes a system as designed and systems change.
What organisations ask about privacy impact assessments.
Fifteen questions the assessment has to answer.
Describing the processing
- What data, about whom, and how much?Specific categories, not personal data generally.
- What is the purpose, precisely?A vague purpose cannot be tested for necessity.
- What is the lawful basis?And is it the same for every element.
- Who has access, including processors?Including anybody offshore.
- How long is it kept, and why?Retention is part of the description.
Necessity and proportionality
- Could the purpose be met with less data?The core question.
- Could it be met with a shorter retention?Frequently yes.
- Could it be met without identifying people?Aggregation or pseudonymisation.
- Is the intrusion proportionate to the benefit?State the benefit specifically.
- What is the least intrusive alternative?It has to be considered to be rejected.
Risk and measures
- What is the risk to the people involved?Not to the organisation.
- What would the worst outcome be for them?Stated concretely.
- What specific measures reduce that risk?With owners and dates.
- What residual risk remains?And who accepted it.
- Has the data protection officer advised?Required where one is designated.
The pages around this one.
Read the necessity section of your last assessment. If it is one sentence, that is the finding.
It is a required content and it is the one that can change a design. An assessment where it has been reduced to an assertion has recorded a decision rather than tested one, which is a difference a regulator will notice.
Related Services
Explore more solutions that work great with this service
UAE PDPL Compliance
Federal Decree-Law 45 of 2021 readiness and operations
GDPR for UAE Businesses
When EU law actually reaches a UAE business, and when it does not
Data Lifecycle Management
Retention policies, labels and defensible deletion
DIFC DPL 5/2020
DIFC Data Protection Law readiness and Commissioner reporting
Sensitivity Labels
Classification that travels with the file, and governs what Copilot sees
AI Data Security Posture
Copilot readiness and control of shadow AI use
Compliance as a Service
Keeping the position true between assessments
IT Audit Services Dubai
Assessment, technical test or certification, scoped properly