DPIAs, change control, and higher-risk processing

A data protection impact assessment (DPIA) identifies and reduces data protection risks before higher-risk processing starts. The ICO expects DPIAs as part of accountability, and they are legally required where processing is likely to pose a high risk to people's rights and freedoms.

In pharmacy, DPIAs are triggered not only by new technology. Risk can also rise when services become more centralised, more intrusive, more automated, or when data is shared more widely across branches and systems.

Examples that should prompt DPIA screening

• New digital services: online booking, remote consultations, new messaging platforms, or new patient apps.
• AI tools: transcription, summarisation, triage support, search, or productivity tools that process personal data.
• New shared access: wider head-office reporting, branch-to-branch visibility, or expanded use of NHS and shared care systems.
• Large-scale special category processing: new vaccination, testing, or clinical service workflows.
• Acquisitions, mergers, or system migrations: where data is moved, combined, or repurposed.
• Monitoring tools: call recording, CCTV with sensitive coverage, or analytics that track staff or patient behaviour more deeply.

What leaders should expect from a good DPIA process

• Early screening: assess risk before procurement is finalised, not after go-live is promised.
• Involve the right people: DPO or IG lead, service leads, IT or supplier contacts, and clinical or operational leaders where needed.
• Map the real data flow: document how data actually moves, not just the vendor's ideal workflow.
• Record the decision: if a full DPIA is not required, keep a written rationale.
• Link to change control: ensure privacy notice updates, contract reviews, staff training, access design, and testing follow from the assessment.

AI leadership note

High-risk processing should not be discovered after launch. Strong pharmacy governance screens changes early, records decisions clearly, and builds privacy and confidentiality controls into the service before live data is used.