The pattern is familiar. A project reaches pre-launch review, someone from legal or risk asks whether a DPIA has been completed, and the answer is no. What follows is either a delayed launch or a document produced quickly to satisfy a process — and the second option is worse, because it creates a record asserting that risks were assessed when they were not.
Triage takes an hour and changes the architecture
Screening for high-risk processing is not the assessment itself. It is a short set of questions that determines whether a full assessment is likely to be required, and it is cheap enough to run in every discovery engagement regardless of sector.
- Does the system evaluate or score people in a way that affects what they receive or are offered?
- Does it make automated decisions with legal or similarly significant effect?
- Does it process special-category data — health, biometric, ethnicity, or data about children?
- Does it monitor a publicly accessible area, or track behaviour systematically?
- Does it combine datasets that were collected separately, in a way the person would not expect?
- Does it use a technology whose privacy implications are not yet well understood by the people it affects?
Any yes means a DPIA is likely required. More usefully, each yes points at a specific design decision. Automated decisions need a documented human review route. Special-category data needs its own storage, permissions and retention. Combining datasets needs a lawful basis you can articulate before you build the join.
What to build as a result
The engineering consequences of a positive screen are concrete and cheap when designed in: an append-only audit trail for decisions, a human review path with recorded reasoning, per-category retention with implemented and tested deletion, and access controls that separate special-category data from ordinary application data. Retrofitting any of these into a shipped system costs an order of magnitude more than including them from the start.
We are engineers, not lawyers, and none of this is legal advice. The point is narrower: make sure your counsel is assessing a system that was designed with the question in mind, rather than one where the answer has to be manufactured after the fact.