Should I publish my DPIA and Equality Impact Assessment?

Contrasting

You still need a DPIA before high-risk processing of personal data. Publishing the completed DPIA is good practice to show you are protecting personal data and considering fairness. Publishing the EIA is also good practice. Redact anything that would be exempt from disclosure.

Warning Conflicting or tensioned advice across sources

Data and AI Ethics Framework treats publishing DPIA and EIA as good practice as separate transparency artefacts. LGA guide suggests integrating DPIA with EqIA or into an AIA to streamline, provided all DPIA and PSED requirements are still met.

How to navigate this: Meet all DPIA and PSED substance either way. Merging documents is fine if nothing required is lost; publishing remains good practice for transparency.

From the guidance

Primary (how) Data and AI Ethics Framework

You need to carry out a Data Protection Impact Assessment (DPIA) before you process personal data when the processing is likely to result in a high risk to the rights and freedoms of individuals. It’s good practice to publish your completed DPIA to demonstrate that you’re taking the appropriate precautions to protect personal data and ensure your system is fair.

Section: Data protection-related transparency

Read this in Data and AI Ethics Framework (opens in new tab)

Secondary (normative) Data and AI Ethics Framework

You must comply with the Public Sector Equality Duty and Equality Act 2010. This means you need to carefully consider and document the equality impact of processing personal data where it can be used to identify individuals as having a protected characteristic. This document is often referred to as an Equality Impact Assessment (EIA). It’s good practice to publish your EIA.

Section: Fairness-related transparency

Read this in Data and AI Ethics Framework (opens in new tab)

Secondary (normative) ICO: Accountability and governance implications of AI

In the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals’ rights and freedoms, and will therefore trigger the legal requirement for you to undertake a DPIA.

Section: What do we need to consider when undertaking data protection impact assessments for AI?

Read this in ICO: Accountability and governance implications of AI (opens in new tab)

Contrasting Responsibly buying AI: a guide for councils in England

Position: Consider integrating DPIA with EqIA or into an AIA if all DPIA and PSED requirements are met.

To streamline the process, please consider integrating your Data Protection Impact Assessment (DPIA) with either an Equality Impact Assessment (EqIA) or into an Algorithmic Impact Assessment (AIA, see below), provided all DPIA and PSED requirements are met.

Section: What does data protection law require?

Read this in Responsibly buying AI: a guide for councils in England (opens in new tab)

Related questions