Clinical Safety ToolkitStaffordshire Training Hub

Type at least two letters.

    Home / Information governance

    The DPIA

    A data protection impact assessment (DPIA) is how you think through the data risks of a new tool before you use it, and write down what you're doing about them.

    Do we need one?

    Rule of thumb: if a new tool will handle patient information, assume you need a DPIA and speak to your DPO.1

    You need a new one

    • An online consultation or triage toolPatients send health information through it
    • A patient messaging toolTexts, letters and questionnaires sent from the record
    • A recall or proactive care toolSearches the whole list to find and invite patients
    • An AI care navigator or receptionistTalks to patients and handles their details
    • An AI scribeRecords and transcribes consultations
    • A new phone system that records or transcribes callsCalls hold health information too
    • A document processing toolReads incoming letters, then summarises and codes them into the record
    • A tool that files or codes results automaticallyWrites into the record without a person doing each step
    • Switching supplier for a tool you already useNew supplier, new contract, data may move

    You may not need a new one

    • A tool that uses no personal informationFor example, a clinical reference app
    • A small update to a tool whose DPIA already covers itCheck the change doesn’t alter the data, then note it on the DPIA
    • Your clinical system, such as EMIS or SystmOneIt still needs a DPIA, but the ICB usually buys it and provides one. Adapt it to your practice
    • A tool your ICB or PCN has already assessed, used the same wayAdopt their DPIA and add anything local, instead of starting again

    Either way, write down the decision and why.

    The steps

    The ICO’s eight steps, in four phases.1

    Plan

    1. Decide if you need oneUse the examples above, and record the decision either way.
    2. Describe the dataWhat information, from whom, where it goes, who sees it, how long it’s kept. A simple boxes-and-arrows diagram helps. Follow the data.

    Ask

    1. Ask the people affectedFor a patient-facing tool, your patient participation group (PPG) is a good start.
    2. Ask others who knowYour DPO, Caldicott Guardian, the supplier and your IT provider.

    Assess

    1. Is it necessary?Does the tool need everything it collects? Could you do the same with less?
    2. List the risksAccess, storage, accuracy, security and surprises.
    3. Decide what to doContract terms, settings, training, retention rules.

    Sign off

    1. Sign off and keep it liveRecord the DPO’s advice, who accepted the remaining risk, and the review date.

    The practice manager usually writes it, the DPO advises, the Caldicott Guardian is consulted, and the SIRO or a partner accepts the remaining risk.

    A template to start from

    Plain English, following the ICO’s steps, with a filled-in Oakfield version.

    1. AssessData protection impact assessment (DPIA)Open ↗
    Data protection impact assessment (DPIA)Open in new tab ↗Oakfield exampleDownload Word

    If your supplier, ICB or PCN already has a DPIA for the tool, build on it. For AI scribes, NHS England has a template DPIA.2

    Oakfield’s DPIA

    Oakfield started by mapping how data moves through its new online consultation tool, Kestrel Consult, step by step, with a column for each system or person involved. Every time data moves from one column to another, it can reach the wrong record, the wrong person or another company, so that’s where to look for risks. Ask the supplier for their data flow diagram to start from: it should be in their own DPIA.1

    Oakfield's data flow, step by step: the patient fills in the online form; Kestrel Consult stores it; Heron Link, the integration partner, passes the patient's details to EMIS, which finds the patient and saves the request; staff read and triage it in the tool, open the patient in EMIS and add notes, and write a reply; the tool sends the reply to the patient, and deletes the request 90 days after it's closed.PatientKestrel ConsultHeron LinkEMISPractice staffFills in theonline formStores the requeston UK serversRisk 3Passes the patient’sdetails to EMISRisk 4Finds the patient,saves the requestRead and triageit in the toolStaff find thepatient, add notesRisk 1Write a replyin the toolSends the reply bytext or emailRisk 2Gets the replyDeletes the request90 days after closing
    1. PatientFills in the online form
    2. Kestrel ConsultStores the request on UK serversRisk 3
    3. Heron LinkPasses the patient’s details to EMISRisk 4
    4. EMISFinds the patient, saves the request
    5. Practice staffRead and triage it in the tool
    6. EMISStaff find the patient, add notesRisk 1
    7. Practice staffWrite a reply in the tool
    8. Kestrel ConsultSends the reply by text or emailRisk 2
    9. PatientGets the reply
    10. Kestrel ConsultDeletes the request 90 days after closing
    Follow the steps down. Each colour is a system or person, and the tags mark where Oakfield's risks below come in.

    Four of the data risks Oakfield found. The full list is in the Oakfield version of the template above.

    • Risk 1The tool and EMIS don’t stay in step. Opening a request doesn’t open the same patient in EMIS, so staff may add notes or send a message to another patient they had open before by accident.
      →
      What Oakfield didStaff check name, date of birth and NHS number match in both systems before adding anything or sending. They close each record when they finish. Anything added to the wrong record is corrected and reported as a data breach.
    • Risk 2A reply to a patient request reaches someone other than the patient, for example a parent’s phone number on a teenager’s request.
      →
      What Oakfield didStaff check who the reply will go to before sending. Sensitive replies ask the patient to phone the practice.
    • Risk 3The supplier reuses requests to train or improve its product
      →
      What Oakfield didThe contract rules this out unless the data is anonymised, and the DPIA records it.
    • Risk 4The link between Kestrel Consult and EMIS is run by another company, Heron Link, so a third organisation handles patient details
      →
      What Oakfield didChecked the supplier’s agreement names Heron Link as a subcontractor on the same terms, that it stores data in the UK and has completed the DSPT. The DPIA records it.

    References

    1. Data protection impact assessments. Information Commissioner’s Office
    2. AI enabled ambient scribing products template DPIA. NHS England

    Sources on this page last checked 3 November 2026.