Responsible Tech – Why PIAs and DPIAs Should Sit at the Heart of Organisational Change

Technology is moving quickly.

New systems, AI tools, CRM platforms, HR software, cloud storage, marketing automation, CCTV, biometrics, online forms, portals, apps and supplier platforms are now part of everyday organisational life.

Used well, technology can make organisations faster, smarter and more efficient. It can improve services, support staff, reduce manual processes and help businesses grow.

But used without the right checks, technology can also create risk.

It can collect too much personal data. It can expose sensitive information. It can make unfair decisions. It can create security gaps. It can confuse customers. It can damage trust.

That is why Responsible Tech matters.

Responsible Tech is not about stopping innovation. It is about making sure innovation is safe, fair, transparent, secure and aligned to the people it affects.

In simple terms, it means asking:

Should we do this?
Can we do this safely?
Have we understood the risks?
Are we protecting people properly?
Can we explain our decisions if challenged?

And one of the best ways to answer those questions is through a Privacy Impact Assessment, often known as a PIA or, under UK GDPR, a Data Protection Impact Assessment — DPIA.

A PIA/DPIA is a structured way of looking at how a project, system, process or change could affect people’s privacy and personal data.

It helps organisations identify risks early, reduce harm, improve decision-making and show accountability.

The ICO explains that a DPIA is a process to help identify and minimise data protection risks, and that organisations must complete one where processing is likely to result in a high risk to individuals. It is also good practice to complete one for major projects involving personal data.

That last point is important.

You do not need to wait until something feels “high risk” before asking privacy questions. By then, decisions may already have been made, contracts may already be signed and systems may already be live.

The best time to think about privacy is before the change happens.

Change is one of the biggest moments of risk for any organisation.

That change might be:

• Introducing a new CRM system
• Moving information to the cloud
• Changing how staff access records
• Using AI or automation
• Launching a new website or online form
• Sharing data with a new supplier
• Introducing CCTV, biometrics or monitoring tools
• Changing marketing processes
• Collecting new types of customer or employee data
• Using existing data for a new purpose

Each of these changes may sound operational, but they can have a direct impact on privacy, security, trust and compliance.

A PIA/DPIA helps you pause before pressing go.

It gives you a chance to understand what data is being used, why it is needed, who has access, where it is stored, how long it is kept, what could go wrong and how those risks can be reduced.

Without that step, organisations can end up building privacy problems into the heart of a project.

And once a system is live, privacy issues are often harder, slower and more expensive to fix.

When organisations talk about technology, the conversation often focuses on features, cost, efficiency and speed.

But responsible organisations also ask: what does this mean for people?

For example:

Will customers understand how their data is being used?
Will staff be monitored fairly and transparently?
Could an automated process make a decision that affects someone’s rights?
Could sensitive information be accessed by the wrong people?
Could children’s data, health data or vulnerable people’s information be involved?
Could the system create bias, unfairness or exclusion?
Is there still human oversight where it matters?

Responsible Tech means looking beyond the shiny system and asking whether the organisation can use it safely, fairly and confidently.

That is where PIAs and DPIAs become so valuable. They bring the conversation back to purpose, necessity, fairness, transparency and accountability.

Good Data Privacy should not be added at the end of a project as a final tick-box.

It should be built in from the start.

This is often called Data Protection by Design and by Default. The ICO explains that data protection by default means organisations must limit their use of personal information to what is necessary for each specific purpose, linking closely to data minimisation and purpose limitation.

In plain English: collect what you need, use it properly, protect it well and do not keep it forever.

A PIA/DPIA supports this by helping organisations ask the right questions early:

• Do we really need this data?
• Can we achieve the same outcome with less data?
• Who needs access?
• What security controls are required?
• How will individuals be informed?
• What happens if something goes wrong?
• Has the supplier been properly checked?
• Is the processing fair and proportionate?
• How will we review this over time?

This is not about slowing the business down. It is about helping the organisation make better decisions before risks become problems.

When organisations skip privacy assessments, the risks can build quietly.

Common issues include:

Unclear purpose
Data is collected because the system allows it, not because the organisation actually needs it.

Poor transparency
Customers, clients or staff are not clearly told how their information is being used.

Weak supplier oversight
New platforms are introduced without proper due diligence, contract checks or security review.

Access issues
Too many people can see too much information.

Retention problems
Data is kept indefinitely because nobody has set deletion rules.

AI and automation risks
Tools are used without understanding fairness, bias, explainability or human oversight.

Security gaps
New systems go live before technical and organisational controls have been reviewed.

Loss of trust
People feel surprised, misled or uncomfortable when they discover how their data is being used.

These issues are not just compliance concerns. They affect reputation, customer confidence, staff trust and business resilience.

A responsible organisation does not wait for a breach, complaint or regulator question before acting.

Good looks like:

• Privacy assessments completed before major changes
• Clear ownership of Data Protection risks
• IT, operations, compliance, HR, marketing and leadership working together
• Suppliers reviewed before contracts are signed
• Staff trained to spot privacy and security issues
• AI and automated tools assessed before use
• Privacy notices kept up to date
• Data minimisation built into systems
• Access controls reviewed regularly
• Risks recorded, managed and revisited
• Decisions documented clearly

Most importantly, good looks like a culture where people feel able to ask:

“Have we thought about the privacy impact?”

That one question can prevent a lot of problems.

Responsible Tech is not just a policy. It is a behaviour.

It is the project manager who asks whether a DPIA is needed before launching a new system.

It is the HR lead who considers fairness before introducing staff monitoring.

It is the marketing team that checks consent and preferences before sending a campaign.

It is the IT team that reviews supplier security before onboarding a new platform.

It is the senior leader who asks whether the organisation can explain and justify its use of AI.

It is the frontline colleague who challenges a process because it does not feel right.

That is culture.

A good Responsible Tech culture means people understand that privacy, security and fairness are part of good service delivery. They are not barriers to progress — they are what make progress sustainable.

1. Build PIA/DPIA Screening Into Every Change Process

Every new project, system, supplier or process change should include a simple screening question:

Will this involve personal data?

If yes, ask whether a PIA/DPIA is needed.

This does not mean every change needs a full detailed assessment, but every change should be considered. A simple screening process can help your organisation identify risk early and decide what level of review is proportionate.

2. Review Your Technology and Data Landscape Regularly

Organisations often use more systems than they realise.

Take time to map your technology and data landscape:

• What systems do you use?
• What personal data sits in each system?
• Who owns each platform?
• Who has access?
• Which suppliers are involved?
• Is data shared outside the UK?
• Are AI or automated features being used?
• Are old systems still holding data?
• Are privacy notices still accurate?

This review helps you understand your maturity and spot gaps before they become serious issues.

3. Bring the Right People Into the Conversation Early

PIAs and DPIAs should not be completed in isolation.

Responsible Tech needs input from different parts of the organisation, including leadership, IT, operations, Data Protection, cyber security, HR, marketing, procurement and frontline teams.

Each area sees risk differently.

The best assessments happen when people work together, challenge assumptions and ask practical questions before decisions are finalised.

4. Assess the Impact on People, Not Just the Organisation

A good PIA/DPIA does not only ask, “What is the business benefit?”

It also asks, “What could this mean for the individual?”

Think about customers, clients, employees, service users, children, vulnerable people and anyone else whose data may be involved.

Could the change cause distress, unfairness, exclusion, loss of control, financial harm, discrimination or security risk?

If the answer is yes, then controls need to be designed properly.

Responsible Tech means balancing opportunity with accountability.

5. Review, Learn and Improve

A PIA/DPIA should not be completed once and forgotten.

Projects change. Systems change. Suppliers update features. AI tools evolve. Staff find workarounds. Data uses expand.

Set review points so you can check whether the original assessment is still accurate.

Ask:

• Is the system being used as intended?
• Have new risks appeared?
• Have individuals raised concerns?
• Are controls working?
• Has the supplier changed anything?
• Are staff still following the process?
• Does the privacy notice still match reality?

Maturity comes from regular review, not one-off paperwork.

Responsible Tech is not about saying no to innovation.

It is about saying yes in the right way.

Yes to better systems.
Yes to smarter processes.
Yes to AI and automation where appropriate.
Yes to growth, efficiency and improvement.

But also yes to fairness.
Yes to transparency.
Yes to security.
Yes to accountability.
Yes to protecting people.

PIAs and DPIAs help organisations make better decisions, manage risk and build trust before changes go live.

Because once technology is embedded, it becomes part of your culture.

So the question is not just, “Can this system do what we need?”

The better question is:

“Can we use this technology responsibly, safely and with confidence?”

If the answer is not clear, it is time to pause, assess and improve.

That is Responsible Tech.

That is Data Done Right.

At Assured Consultancy Services, we help organisations understand their data landscape, assess privacy risks, review new technologies and build practical, people-first governance around change.

Whether you are introducing a new system, reviewing suppliers, adopting AI or strengthening your Data Privacy maturity, we can help you ask the right questions before the risk becomes real.

Let’s have a coffee and talk about how your organisation can make technology work better, safer and smarter.

Assured Consultancy Services
Data Done Right
www.assuredconsultancyservices.com