The privacy of our clients and partners, especially those in the health and care sectors, along with their patients, clients and employees, is critical to us and their organisations as is the security of data. Processing personal data legally and securely prevents regulatory violations, avoids negative publicity, and shows respect for data subjects.

The UK’s Data Protection Act, 2018 (DPA) came into force on 25 May 2018, implementing the EU General Data Protection Regulation (GDPR) as the main legislation governing the processing of personal data in the UK. BREXIT changed the legal basis, with all data protection legislation becoming simply part of UK law.

The EU-based legislation was absorbed, fundamentally unchanged, into that framework and apart from technical changes such as referring to the GDPR as the UK GDPR rather than the ‘EU GDPR’, little has changed following the UK’s departure from the EU. If the law is significantly amended, we will update our procedures to comply with it and assist our clients in doing the same.

Most recently, the Data (Use and Access) Act, 2025 has amended the DPA/GDPR in some respects and its provisions will be considered when assessing DPTAs.

Data Protection Impact Assessments
The Legislation states that “where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, the controller must, prior to the processing, carry out a Data Protection Impact Assessment (DPIA). Furthermore, if the assessment reveals processing involving high risks that cannot be mitigated, the ICO must be consulted before starting the processing.

Data Protection Threshold Assessments
Amongst other uses, this tool is employed to screen programmes and decide whether full DPIAs or other actions are required.

Accessing the Form

The DPTA form works well on most devices, but may not display well on small displays such as smartphones, which should be avoided.

Using the Form

• Use the DPTA Form tab to raise a new assessment form
• Some fields may already be completed as defaults or based on your profile – most of these can still be altered
• There are 5 pages – take your time, working through them in order, returning to [Previous] pages as necessary
• You can navigate between pages (as long as all mandatory fields have been completed) either:
  sequentially using the [Next] and [Previous] buttons at the bottom of each page, or by ‘jumping’ via the numbered progress bar at the top
• Some fields and guidance may be revealed or hidden depending on your responses
• Fields marked with an asterisk * must be completed to submit the form
• Clicking the [Draft] button on the last page saves a draft, but the DPO will not start assessing the programme
• Clicking the [Submit] button on the last page saves the form and sends it to the DPO for assessment
• A record of the submission will appear listed on the DPTA Submissions tab
• See the Follow-up tab to find out what happens after you submit a DPTA form

On submission of your Data Protection Threshold Assessment form, the DPO will:

1. Email you an acknowledgement
2. Update the submission’s  Stage from Draft to Being Assessed
3. Check the submission
4. Comment or ask questions in the Assessment field
5. Contact you for further details and clarification if required
6. Update the Stage from Being Assessed to Assessed
7. The entry for the new submission on the DPTA Submissions tab can be subsequently updated by you or the DPO.

Further follow-up could include:

• Proposing actions as needed
• Providing assistance with tasks such as completing a full DPIA and checking or preparing documents such as DPAs or contracts