Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
A Data Protection Impact Assessment is a mandatory risk assessment under Article 35 of the UK GDPR whenever you plan to process personal data in a way that is likely to result in a high risk to individuals. The ICO publishes a list of processing types that always require a DPIA, including large-scale profiling, use of biometric or genetic data, tracking of individuals’ location or behaviour, and combining datasets from different sources. With more small businesses adopting AI tools, CCTV analytics, employee monitoring software and customer-tracking systems, many are now carrying out processing that triggers this requirement without realising it.
A DPIA must be completed before the processing begins, and it must describe the processing, assess necessity and proportionality, identify risks to individuals and set out measures to mitigate them. Where high risk remains after mitigation, you must consult the ICO before going ahead under Article 36. Failing to carry out a DPIA when required can attract fines of up to £8.7 million or 2% of global annual turnover, whichever is higher, under the Data Protection Act 2018, and a missing DPIA is often the first thing the ICO asks to see after a complaint or breach. Checking now is far cheaper than retrofitting an assessment after a system has gone live.
