A GP practice would never start a new treatment without asking whether it was safe. Yet new software is often switched on with a quick look at the brochure and a nod from whoever is available. When that software handles patients' health records, the question "do we need a data protection impact assessment?" is easy to skip, because it has not been asked before and the practice has always managed.
That habit is the biggest DPIA risk in primary care. It is rarely a refusal to comply. It is a gap between what a practice has always done and what it is now doing.
What the law asks for
Under Article 35 of the UK GDPR, a controller must carry out a data protection impact assessment, or DPIA, before starting processing that is "likely to result in a high risk to the rights and freedoms" of individuals, particularly where it uses new technologies. Article 35(3) lists cases where an assessment is particularly required, including "processing on a large scale of special categories of data". Health information is a special category of data, and every practice holds it about every patient on its list.
The minimum content is also set out in the Article: a systematic description of the processing and its purposes, an assessment of whether it is necessary and proportionate, an assessment of the risks to patients, and the measures planned to address those risks. The ICO describes the process in seven steps, from deciding whether a DPIA is needed through to recording the outcome and the measures chosen.
A DPIA is not about proving something is wrong. It is a short, structured way of recording that you thought about patients before you switched something on.
Where "we've always done it this way" goes wrong
Most practices already have a DPIA habit for big projects, such as a clinical system change. The risk sits in the small and gradual changes that could affect operations:
- The upgrade that changes what a product does. The software was reviewed three years ago. A new release now adds analytics, an online booking feature or an AI summary. The old review no longer describes it.
- The free tool someone found. A clinician starts using a transcription app, a messaging service or a spreadsheet template because it saves time. Nobody decided; it just spread.
- The supplier's own assessment. Suppliers often offer a ready-made DPIA. It describes the supplier's product in general, not your practice, your patients or your settings. It is a useful starting point and not a substitute.
- The change nobody called a change. A new text-message reminder service, a new way of sharing letters with a hospital, or moving a backup to a different provider all alter who sees what.
- The assumption that the ICB or a larger body has done it. Sometimes it has, and sometimes only for part of what you do. Ask to see it.
A five-question screen for any new tool or process
Before anything new touches patient information, ask:
- Does it involve health or other special category data about many patients?
- Is it new technology to us, or an existing tool being used in a new way, such as an AI feature?
- Does anyone outside the practice, including the supplier, see or store patient information?
- Could it affect decisions about patients, or monitor their behaviour?
- Could a patient be surprised to learn we do this?
If any answer is yes, treat a DPIA as the starting point, not an optional extra. If the answers are all no, write down the five answers and the date. That short note is itself evidence that you considered the question.
A worked example
A six-GP practice adopts an AI note-taking tool because two clinicians trialled it and liked it. The supplier's website says it is "fully GDPR compliant" and offers a generic DPIA. Nobody asks where the audio is processed, whether recordings are kept, whether the supplier uses them to improve its product, or what happens when a patient does not want to be recorded.
A one-hour practice meeting with the five-question screen exposes all four gaps. The practice decides to ask the supplier for its data processing terms, adds a patient notice and an opt-out at the front desk, restricts the tool to certain appointment types, and records the decision. None of this takes weeks. It takes a conversation held before the tool is used rather than after.
What a proportionate DPIA looks like
For a small practice, a DPIA for a new tool does not need to be a long report. It can be a few pages that answer the Article 35 questions in plain language: what the tool does and with what data, why it is needed, what could go wrong for patients, and what the practice will do about each risk. The practice manager can lead it. The data protection officer should be asked for advice where one is appointed. The key point is the timing: before go-live, with someone able to say "not yet" if an answer is unsatisfactory.
Habits that help
- Keep a list of every system and tool that touches patient information, with its owner. Review it twice a year.
- Ask one question at every staff meeting: "Has anything changed in how we use patient data?"
- Make the five-question screen part of any purchase or trial, however small or free.
- Revisit older DPIAs when a product changes, or after a set period such as a year.
- Record decisions, including decisions that no DPIA was needed.
The takeaway
The risk in primary care is rarely a dramatic breach. It is the drift that happens when each small change seems too minor to examine. A short, regular habit of asking "what has changed?" costs a few minutes and protects patients and the practice alike.
Frequently asked questions
Do GP practices have to do DPIAs? Where processing is likely to result in a high risk to individuals, yes. Large-scale processing of health data and new technology are both indicators. When in doubt, the screen above and a written note of your answer are sensible.
Can we rely on the supplier's DPIA? It can feed into yours, but the controller, which is the practice, remains responsible for assessing its own use.
Who should carry out the DPIA? Someone close to how the tool will really be used, usually the practice manager or a clinician, with advice from the data protection officer.
What if we have already started using the tool? Carry out the assessment now, record what you find, fix what needs fixing and note the date. Doing it late is better than never.
How Pathway 2 Privacy can help: a DPIA service gives your practice a proportionate, plain-language assessment for the tools you use or plan to use, and Remediation support helps you close gaps in tools already in use, in a sensible order. See our data protection support for healthcare, our guide to using a DPIA as a design tool, or start with a free data protection review.
Sources: UK GDPR Article 35 (legislation.gov.uk); ICO guidance on data protection impact assessments.
