Dynamic DPIA™ · United Kingdom
The ICO publishes a DPIA template, which makes the UK the straightforward case: what you receive is the regulator’s own document, populated field by field, not our arrangement of their questions.
The two halves
The split is not arbitrary. One side has a correct answer that can be checked against a source; the other has a defensible answer that depends on your organisation and its appetite for risk.
| ICO section | Arrives written | You supply |
|---|---|---|
| Describe the processing | Nature, scope, context and purposes, drawn from your intake | Anything the intake could not know about internal workflow |
| Consultation process | Whether the shape of this processing points toward consulting data subjects | Who you consulted, or the reasoned decision not to |
| Necessity and proportionality | The lawful-basis framing and the questions the section expects answered | The answer. This is the paragraph a regulator reads first |
| Identify and assess risks | Cited risk categories from the instruments that attach to this deployment | Likelihood and severity for your population |
| Identify measures to reduce risk | The controls the obligations expect, each tied to its provision | Which you actually operate, and what you will do about the rest |
| Sign off and record outcomes | — | All of it. The DPO’s advice and the controller’s decision |
We bring the regulatory intelligence and the intake. You bring the privacy and legal judgment for your use case and organization. The document is built to hold both.
The division of labour, stated onceWhy the UK case is the clean one
Where an authority publishes a template, using anything else creates a translation step that somebody has to perform later, under time pressure, in front of a regulator.
You get their document, not ours
Field by field, in the ICO’s own layout and order. A reviewer who knows the form knows where to look, which is the entire point of a standard form.
Your house template, if you prefer it
Many organisations have a DPIA form their legal team already approved. Changing it to suit a vendor is a cost with no benefit — we fill yours instead.
The UK is not the EU, and the report says so
UK GDPR and the DPA 2018 are their own instruments. A document that treats the UK as an EU member state is wrong on its face, and it is a mistake we have seen in the wild.
What this is not. LegisGate produces regulatory intelligence and assessment-preparation materials. Nothing we produce is legal advice, a legal opinion, a certification, or a determination of compliance, and no document we deliver satisfies a legal obligation on its own. Sufficiency is determined by your counsel. A completed DPIA from us does not satisfy Art. 35. It is the document your controller and DPO complete and sign.
Before you buy one
Article 35 attaches on conditions, and plenty of deployments do not meet them. A determination tells you whether this assessment is required — and if it is not, gives you the dated record saying so, which is the document you actually needed.
The full price of that report comes off this one within sixty days, so finding out costs nothing.
The half that is yours
It is the paragraph that decides whether the assessment holds, it depends on facts only your organisation knows, and a vendor writing it for you is how a DPIA becomes a file nobody can defend.