New systems. Launching or replacing software that stores personal data.
Services · Risk
Find privacy risks in a new system or project while they are still cheap to fix.
A data protection impact assessment (DPIA) is a structured way to find privacy risks before they become problems. You describe what you plan to do with personal data, ask who could be affected and how, and decide what safeguards are needed. It is far cheaper to change a design than to fix a breach afterwards.
New systems. Launching or replacing software that stores personal data.
Sensitive data. Handling health, biometric, genetic or similar data.
Monitoring. Using CCTV, tracking, or analysing behaviour at scale.
Large databases. Combining or sharing data across teams or organisations.
Outsourcing. Moving data to a cloud provider or another country.
Describe. Map the data, the purpose, who uses it and where it goes.
Test necessity. Check that you need each item and that the purpose is clear and lawful.
Find risks. Consider harm to individuals, such as exposure, misuse or loss of control.
Recommend. Propose controls for each risk, ranked by priority.
Record. Deliver a written report and revisit it when the project changes.
A clear written report: what the project does, the risks we found, how serious they are, the measures we recommend and who is responsible for each. Keep it on file as evidence that privacy was considered from the start.
Data protection consultant. Practical CDPA advice from filing to day-to-day compliance.
Privacy documentation. Records of processing, policies and privacy notices.
DPO as a Service. A certified Data Protection Officer without a full-time hire.
Data controller registration. Register with POTRAZ using Form DP1.
CDPA assessment. Find your gaps and build a plan to close them.
A DPIA is a structured review that identifies how a planned activity could affect people’s privacy, and what you will do to reduce those risks before it starts.
Do one before you launch or change something that uses personal data in a way that could seriously affect people: for example health records, biometrics, CCTV, tracking or profiling, large databases, or new software. Confirm what applies to your sector with POTRAZ or a qualified adviser.
No. An audit looks at how you operate today. A DPIA looks forward at a specific project. Both are useful, and a CDPA assessment is the better first step if you have not reviewed your overall position.
A written report with the risks found, how serious each is, the measures we recommend and who should act on them, so that you can show you thought about privacy before you started.
Yes. We also build software, so we can review a design and suggest changes early, when they cost least. See software development as a service.
Tell us about your organisation and what you need. We will reply with questions and a proposed way forward. Email dpo@privacycure.com, message us on WhatsApp or use the contact form.