DPIA support for Irish businesses
DPIA Support for Irish Businesses
We run the Data Protection Impact Assessment with your team and deliver a documented assessment and risk register.
From €495 per DPIA
- For new systems, CCTV, monitoring and AI tools
- A documented assessment you can keep on file
- Risks and mitigations set out clearly
- Fixed price with a clear scope
Request a DPIA quote
Business enquiries only. Tell us about your organisation and we will send a written proposal.
Prefer to talk? Call 085 804 1664.
Who this is for
Projects likely to be high risk
GDPR requires a DPIA before processing that is likely to result in a high risk to individuals.
CCTV and workplace monitoring
Systematic monitoring of staff or public areas usually calls for an assessment.
New software and AI tools
Introducing a system that profiles people or handles sensitive data is a common trigger.
Large-scale sensitive data
Health, biometric or children’s data processed at scale needs a documented assessment.
What you get
Included
- A screening check to confirm whether a DPIA is needed
- Workshops with the project owner and relevant staff
- A description of the processing and its purposes
- An assessment of necessity and proportionality
- A risk register with mitigations
- A written DPIA report for your records
Not included
- Legal advice or representation
- Implementing the technical measures identified
- Consultation with the Data Protection Commission on your behalf
- Any guarantee that the processing is lawful
How it works
Scoping call
We learn about the project or system and confirm a DPIA is the right tool.
Assessment
We work through the processing, risks and mitigations with your team.
Report
You receive the written DPIA and risk register.
Pricing
From €495 per DPIA
The price depends on the complexity of the processing and the number of people who need to be involved. It is fixed and agreed in writing before work starts.
Who does the work
The work is led by Dylan Holland of Plus Promotions Limited. You deal with the same person from scoping through delivery.
What a DPIA must contain
Article 35 of the GDPR sets out the minimum content of a Data Protection Impact Assessment:
- a systematic description of the planned processing and its purposes;
- an assessment of whether the processing is necessary and proportionate to those purposes;
- an assessment of the risks to the rights and freedoms of the people affected;
- the measures planned to address those risks, including safeguards and security measures.
The Data Protection Commission has published a list of processing operations for which a DPIA is mandatory in Ireland. If an assessment shows a high risk that cannot be reduced, the organisation must consult the Commission before the processing starts.
Questions
When is a DPIA required?
Before any processing that is likely to result in a high risk to individuals, such as large-scale use of sensitive data, systematic monitoring, or profiling with significant effects.
Who needs to be involved?
The project owner, someone who understands the system, and your DPO if you have one.
What do we receive?
A written DPIA report and a risk register with the mitigations agreed.
Can you do one for CCTV, monitoring or an AI tool?
Yes. These are among the most common reasons organisations ask for a DPIA.
Are you solicitors?
No. This service is provided by Plus Promotions Limited, a compliance consultancy. We are not a solicitor’s practice and do not give legal advice. If a matter needs a solicitor, we will tell you.
Related GDPR guides
- Do you need a Data Protection Officer in Ireland?
- GDPR for small businesses in Ireland
- Data breach: the 72-hour response guide
- Handling a data subject access request
- GDPR and employee data: employer guide
- GDPR consent in Ireland
- GDPR fines and the Data Protection Commission
- Privacy and cookie policies for Irish websites
Other services: Outsourced DPO · GDPR compliance projects · GDPR audit and gap analysis · DPIA support
Request a DPIA quote
Or call 085 804 1664
Looking for help with your own data rights as an individual? Contact the Data Protection Commission.