Annual Review Data Protection Impact Assessments

Annual DPIA Review Process Commencing

As part of North Ayrshire Council's ongoing commitment to data protection compliance and accountability, the Information Governance team will shortly begin the annual review of all existing Data Protection Impact Assessments (DPIAs).

If you are a Service Lead, Project Lead or the named officer responsible for a DPIA, you should expect to receive an email requesting that you review your DPIA and advise the Information Governance team of any changes to the associated processing activities.

Data Protection Impact Assessments are not static documents. They must be kept under regular review to ensure they accurately reflect how personal information is being collected, used, shared, stored and protected within your service area.

What the Information Governance team needs from you

Upon receipt of the review email, we ask that you:

• review the DPIA currently held on record for your service
• confirm whether there have been any changes to the processing activity since the DPIA was last approved
• provide details of any updates required, including:
  - new systems, processes or technologies introducedh
  - changes to the categories of personal data processed
  - changes to information sharing arrangements
  - new risks identified or changes to existing controls
  - changes to suppliers, processors or third-party organisations involved in the processingl
• please confirm if no changes are required so that the DPIA can be recorded as reviewed and remains current

Why Your Response Matters

The Information Governance team is required to maintain an accurate and up-to-date register of DPIAs across the Council. A response is therefore required from all services, regardless of whether changes are needed.

Important: Non-Response Will Be Escalated

Where no response is received, the Information Governance team will issue reminders and, if necessary, escalate the matter through appropriate management channels. This is to ensure the Council can demonstrate compliance with its data protection obligations and that all processing activities continue to be assessed appropriately.

The team encourages services to begin considering any changes that may have occurred over the last 12 months so that responses can be provided promptly when contacted.

Thank you in advance for your cooperation in helping North Ayrshire Council to maintain robust data protection governance.

For any queries regarding your DPIA or the review process, please contact the Information Governance team.

Published August 11, 2026