1 General information Date complaint received [Insert date] How was the complaint received? ☐ Email☐ Letter☐ In person☐ Telephone☐ Other—[please state]When responding to the complainant, consider what is the most appropriate means of communication. Date complaint acknowledged [Insert date, which should be 30 days beginning when the complaint is received.] Proposed deadline for responding to complaint [Insert date, which should satisfy the requirement that you will deal with the complaint without undue delay.] Person investigating complaint and completing this record [Insert details of individual who investigated the complaint and completed this report. This may be your data protection officer.] Date of report [Insert

[Insert complainant’s name] [Insert complainant’s contact address] Our ref: [insert complaint reference number] Dear [insert complainant’s name] Your complaint I am continuing to investigate your data protection complaint, which I received on [insert date complaint received]. So

[Insert complainant’s name] [Insert complainant’s contact address] Our ref: [insert complaint reference number] Dear [insert complainant’s name] Your complaint I am continuing to process your data protection complaint that I received on [insert date complaint received]. [Identity information For security reasons, we cannot provide a detailed response to your complaint without being satisfied about your identity[, and that

This Practice Note provides an overview of the key provisions and requirements of the UK’s data protection regime and highlights particular issues of relevance to pension lawyers. For information on common issues which arise regarding the application of data protection requirements in a pensions context, see Practice Note: Data protection—FAQs for pensions. The UK’s data protection regime Until 24 May 2018, the data protection regime in the UK was governed by the Data Protection Act 1998 (DPA 1998). Between 25 May 2018 and Implementation Period (or IP) completion day (11pm on 31 December 2020), the date and time at which the UK left the European Union, the UK applied the data protection regime introduced by the General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR). The EU GDPR had introduced a raft of changes to the previous data protection regime, including new and extended data subject rights, a new standard for consent, additional obligations and liabilities for data controllers and data processors, and

This flowchart illustrates how to establish whether or not you need to conduct a data protection impact assessment (DPIA) in relation to a particular project, and how to conduct one if it is required. It also covers post-DPIA actions, including integrating the outcomes of your DPIA into your project plan and keeping your DPIA under review. See also Precedents: Data protection impact assessment—DPIA and Data protection impact assessment—DPIA—short form, which is based on a template issued by the Information Commissioner’s Office (ICO). The ICO’s detailed Data Protection Impact Assessments guidance sets out seven steps to conducting a DPIA. This Flowchart is intended to cover those seven stages, but it also reflects the ICO’s expectations regarding post-DPIA activities, specifically: • integrating the outcomes of your DPIA into your project plans, and • monitoring the ongoing performance of the DPIA Note 1: Identify the need for a DPIA If you have a data protection officer (DPO), ask them for advice. For further information, see Practice Note: How to complete a data protection impact assessment—DPIA—Who should conduct the

1 Project overview Project summary [Summarise the project, eg new IT system for storing and accessing personal data, or proposal to identify people in a particular group or demographic to predict their buying needs] Processing purposes [Insert the purposes of the processing, eg improve the quality and accuracy of employee personal data and implement an improved process for deleting data that is no longer required] Lawful ground for processing [Insert lawful ground. Where the organisation intends to rely on legitimate interests as the lawful ground for processing, describe those legitimate interests and also confirm that a legitimate interests assessment has been undertaken.] 2 Identify the need for a DPIA 2.1 Project aims and benefits What does the project aim to achieve? [State what the project aims to achieve] What are the anticipated benefits to the organisation, individuals and/or other parties? [Describe anticipated benefits] 2.2 Preliminary screening Question Answer/comment Does the project involve one or more of the following:—systematic and extensive evaluation of personal aspects relating to natural persons based on automated processing (including profiling) on which decisions are based that produce legal effects for or similarly significantly affect a data subject?—processing

1 Project overview [Insert an overview of the project, explaining why it is necessary and how it will impact on privacy. Subject to commercial sensitivity, consider including an explanation or diagram setting out the proposed information flows.] 2 Summary of privacy risks and approved solutions Risk Approved solution Approved by [Insert description of a privacy risk] [Describe the solution that has been approved to eliminate or reduce this risk OR Residual risk accepted and approved] [State who has approved this solution] [Insert description of a privacy risk] [Describe the solution that has been approved to eliminate or reduce this risk OR Residual risk accepted and approved] [State who

1 Identify the need for a DPIA Explain broadly what the project aims to achieve and what type of processing it involves [Insert, eg you may find it helpful to refer or link to other documents, such as a project proposal. Summarise why you identified the need for a DPIA.] 2 Describe the processing Describe the nature of the processing [Insert, eg how will you collect, use, store and delete data? What are the sources of the data? Will you be sharing data with anyone? What types of processing identified as likely high risk are involved? You might find it useful to refer to a flow diagram or other way of describing data flows] Describe the scope of the processing: [Insert, eg what is the nature of the data, and does it include special category or criminal offence data? How much data will you be collecting and using? How often? How long will you keep it? How many individuals are affected?

1 Project summary Project information Details Project name [Insert name] Project owner [Insert name] Project summary [Summarise the project, eg new CCTV system for a car park] 2 Details of proposed surveillance camera system 2.1 Identify why your deployment of surveillance cameras requires a DPIA ☐ Systematic and extensive profiling☐ Public monitoring☐ Denial of service☐ Data matching☐ Tracking☐ Risk of harm☐ Automated decision-making☐ Large-scale use of sensitive data☐ Innovative technology☐ Biometrics☐ Invisible processing☐ Targeting children/vulnerable adults☐ Special category/criminal offence data☐ Other [Please specify]   2.2 Timescale and status of surveillance camera deployment Is this a proposal for a new deployment or the expansion of an existing surveillance camera system? ☐ New deployment☐ Expansion of existing system Which data protection regime will you be processing under? ☐ UK GDPR☐ Other—[state eg EU GDPR] 2.3 Description of processing Where do you need to use a surveillance camera system? [Insert response and/or refer to Appendix 1] What are you trying to achieve? [Insert response]Set out the context and purposes of the proposed surveillance cameras or the reasons for expanding an existing system. Provide evidence where possible, eg crime statistics over an appropriate period of time, housing and community issues etc. 2.4 Personal data to be processed and area covered by the processing Set out the nature and scope of the personal data you will be processing.

1 AI project overview 1.1 Project aims and benefits Project summary [Summarise the project] What does the project aim to achieve? [State what the project aims to achieve] How will you measure success? [insert] What are the anticipated benefits to the organisation, individuals and/or other parties? [Describe anticipated benefits to the organisation, individuals and/or other parties (including, if relevant, wider society)] 1.2 DPIA screening Outcome of DPIA screening—see Appendix 1 ☐ DPIA required under the GDPR☐ DPIA not required under the GDPR, but completed on a voluntary basis☐ DPIA not required under the GDPR and no DPIA will be completed—[state your reasons why a DPIA is not required] 2 AI tool and provider What is the name of AI tool? [Insert] What is the intended function of the AI tool? [Insert a basic description of the intended function of the AI tool, including whether your intended use is consistent with this] Who is the AI provider? [Insert] Is this an established provider or market-entrant? [Insert] Does the AI provider have any relevant accreditations? [Insert] Is this a free or paid for AI tool? ☐ Free☐ Paid for Is this a publicly-accessible AI tool? ☐ Publicly-accessible☐ Not publicly-accessible Any other relevant information about the AI tool or provider? [Insert, eg feedback from

Introduction [Provide a brief introduction of the project to which the consultation relates, to include as required:] [—a brief introduction to your organisation] [—what you are consulting on] You are invited to take part in our consultation, which is running for [insert number] weeks from [insert date] until [insert date]. This consultation will provide you with the opportunity to comment on [insert details]. Your views are important to us. Please use this form to provide feedback. Complete as many sections of this form as you would like and send it to: [insert address]. We will also accept feedback by email, letter and phone (see Contact details

[Insert title of project]—[insert who you are consulting, eg Employee consultation] [Insert name of organisation] 1 Introduction [Provide a brief introduction to the project to which the consultation relates, to include as required:] [—a brief introduction to your organisation] [—what you are consulting on] You are invited to take part in our consultation, which is running for [insert number] weeks from [insert date] until [insert date]. This consultation will provide you with the opportunity to comment on [insert details]. Your views are important to us. They will be used to help us decide [insert details]. 2 The project: [insert description] 2.1 Project overview [Insert overview of the project.] For more information about the project, see Appendix 1 and/or ‘Find out more’ at 4.1.