New technology can make running a business easier. A customer relationship management system can improve how you manage enquiries. A new booking platform can reduce administration. An AI tool can help draft documents, summarise information or automate repetitive tasks.
But introducing a new tool can also change how your business handles personal data.
Information may be collected in a different way, shared with another provider, stored in a new location or made accessible to more people. A tool may introduce new uses for existing data or create a dependency on a service you previously managed yourself.
For small businesses, these changes are often made quickly. Someone finds a useful tool, signs up for an account and starts using it. The data protection questions may not arise until afterwards.
A better approach is to consider privacy and data protection before the new process goes live.
You do not need a full-scale compliance project for every minor change. You do need a proportionate way to identify what is changing, what risks it creates and what needs to be done.
1. Start with the purpose
Before looking at the technology, be clear about why you need it.
What business problem are you trying to solve? What will the tool do? What outcome are you expecting?
Then consider whether personal data is involved.
Personal data is information relating to an identified or identifiable living person. Depending on your business, this might include customer details, employee records, contact information, booking data, correspondence or information collected through a website.
If the new tool does not process personal data, many data protection requirements may not apply to that use. However, confidentiality, security, contractual and other risks may still need consideration.
If personal data is involved, identify the purpose of the processing and establish that you have an appropriate lawful basis. Do not assume that because the business already holds the information, it can automatically be used for any new purpose.
2. Identify what information the tool will handle
Be specific about the information involved.
Will the tool process names and email addresses? Customer histories? Employee information? Financial details? Special category data? Information about children?
Consider both the information entered directly and any data the tool may retrieve from connected systems.
Then ask whether all of it is necessary.
A tool may offer a wide range of features, but that does not mean you need to provide it with access to every available record.
Limiting the information collected and the access granted can reduce exposure if something goes wrong.
For AI tools, consider the information people may enter into prompts, upload as documents or expose through integrations. Check how the provider handles inputs and outputs, including any storage, reuse or training arrangements that are relevant to the service.
3. Understand the supplier’s role
A new technology provider may process personal data on your behalf, act as a separate controller for some activities or have a different role depending on the service.
You need to understand what the provider does with the information and what responsibilities apply.
Questions to consider include:
-
What personal data will the provider process?
-
For what purposes?
-
Does the provider act as a processor, an independent controller or in another capacity?
-
What security measures are in place?
-
Will the provider use the information for its own purposes?
-
Will other providers or subprocessors receive the data?
-
Where will the data be processed or accessed?
-
What happens when the contract ends?
-
Can information be retrieved or securely deleted?
Where a provider acts as a processor, the required contractual arrangements must be in place. Do not rely solely on the fact that the provider has a privacy policy or describes its service as secure.
Review the terms that apply to the actual service and intended use.
4. Check access, security and data sharing
A new tool can change who has access to personal data.
Check which employees need access, whether permissions can be restricted by role and whether administrator access is appropriately controlled. Consider authentication, account security, external sharing and how access is removed when someone leaves or changes role.
Also consider how information moves between systems.
For example, your business might export customer information from an event booking platform and import it into an email marketing service. That transfer creates questions about purpose, lawful basis, transparency, data minimisation, supplier roles and security.
The fact that two services can exchange data does not automatically mean that every transfer is appropriate.
Make sure the sharing is justified, that only necessary information is transferred and that the relevant privacy information and supplier arrangements are in place.
5. Update your privacy information and records
If the change affects how personal data is processed, check whether your existing documentation remains accurate.
This may include:
-
your privacy notice or other information provided to individuals
-
your records of processing activities, where required
-
your supplier and processor records
-
retention arrangements
-
access and security procedures
-
data-sharing arrangements
-
internal guidance for staff
The exact updates depend on the change.
For example, introducing a new system to perform an existing activity may mainly require reviewing the supplier, security and processing records. Using existing customer information for a new purpose may require a more substantial assessment of the purpose, lawful basis, compatibility and information provided to individuals.
Documentation should reflect what the business actually does, not what it intended to do when the documents were first written.
6. Screen the change for DPIA requirements
A Data Protection Impact Assessment (DPIA) is not automatically required every time you introduce new technology.
You should first screen the proposed processing to determine whether it is likely to result in a high risk to people’s rights and freedoms. Where a DPIA is legally required, it needs to be completed at the appropriate stage, before the relevant processing begins.
The assessment should consider the nature, scope, context and purposes of the processing, whether it is necessary and proportionate, the risks to individuals and the measures available to address those risks.
The use of new technology can be relevant, but the decision should be based on the actual processing and its risk, not simply the name of the technology.
For higher-risk projects, it is particularly important to involve the appropriate people early enough for the assessment to influence the design.
If a DPIA identifies high residual risks that cannot be sufficiently reduced, further escalation and, where legally required, prior consultation with the ICO may be necessary.
7. Give AI and other new technology specific attention
Where the change involves AI, consider the questions that may not arise with a conventional software tool.
What data is being entered? Is it used only to generate an output, or may the provider retain or reuse it? How reliable are the outputs? Is there human review? Could the system produce biased or misleading results? How will people be informed where required? Can individuals exercise their rights?
Also consider whether the AI system makes or supports decisions about people, particularly decisions with significant effects. Additional legal and governance requirements may apply depending on the use.
An AI assessment should sit alongside the wider change process. It does not replace a DPIA where one is required, supplier checks, security reviews or any separate assessment of other legal obligations that may apply.
The aim is to understand how the technology will be used in your business and to put appropriate controls in place before relying on it.
8. Decide what needs to be completed before go-live
An assessment is only useful if its findings lead to decisions and actions.
Before the new processing starts, identify whether anything needs to be resolved.
For example:
-
the supplier agreement needs to be updated
-
access needs to be restricted
-
the privacy notice needs to change
-
a retention arrangement needs to be agreed
-
a DPIA needs to be completed
-
employees need guidance or training
-
a security concern needs to be addressed
-
responsibility for monitoring the new process needs to be assigned
Record the decision, the person responsible and any outstanding actions. Do not treat a project deadline as a reason to bypass a necessary legal or security requirement.
If important risks remain unresolved, the appropriate decision may be to delay the change, limit its scope or introduce additional safeguards.
9. Review the change after implementation
The work should not necessarily end when the system goes live.
Check that it is being used as intended and that the controls are operating.
Are people using the approved tool? Is the data being shared as expected? Are permissions appropriate? Have any unexpected uses emerged? Are there incidents or near misses that indicate a weakness?
Review the arrangement when the purpose, technology, supplier, data or level of risk changes materially.
For small businesses, this can be proportionate. You do not need a separate committee for every application. You do need a way to recognise when a change has implications that require further attention.
A practical checklist
Before introducing a new tool or changing how you process personal data, ask:
-
What is the purpose of the change?
-
What personal data will be collected, accessed or shared?
-
Is the processing necessary and supported by an appropriate lawful basis?
-
Who provides the service, and what is their role?
-
Are the supplier terms and security arrangements appropriate?
-
Are access, sharing and retention controlled?
-
Do privacy information or processing records need updating?
-
Is a DPIA required following screening?
-
Are there specific AI or other technology risks to assess?
-
What actions and approvals are needed before go-live?
-
Who is responsible for monitoring the new process?
-
When should the arrangement be reviewed?
Not every change will need a lengthy assessment. The aim is to scale the work to the nature of the change and the risks involved, while making sure important questions are not missed.
Make change assessment part of how you work
Data protection is easier to manage when it is considered as part of business decisions, rather than added at the end.
A simple, consistent change assessment helps you spot issues early, identify when specialist advice is needed and make sure the right actions are completed before new processing begins.
It also connects GDPR with wider business risk management. A new technology may create privacy risks, supplier dependencies, operational vulnerabilities and governance questions at the same time. Looking at those issues together can lead to better decisions.
The objective is not to slow down every change. It is to make sure the business understands what it is introducing and is ready to manage it.
Need a practical way to manage GDPR in your business?
My UK GDPR Ready resources are designed to help small businesses and charities put proportionate data protection processes in place, including a structured approach to change and new technology.
Drop me a message at jacky@jacquelinehodges.co.uk to discuss how I can help
Recent Comments