A DPIA checklist for people analytics projects
6 min readPublished 2026-09-07Last reviewed 2026-09-07
Short answer
A data protection impact assessment for people analytics should start before the project is built, not after. It needs a clear description of the data used, the purpose, who can access outputs, and what happens if the analysis affects someone's employment. This checklist covers the areas most people analytics teams need to address.
- Describe the purpose of the analysis and the decision it will inform
- Identify the data sources and categories of personal data involved
- Confirm the legal basis for processing this data
A data protection impact assessment (DPIA) helps a people analytics team identify privacy risks before they become real problems for employees or the organisation.
Assessing the risk
- Could the output affect an individual's employment, pay or role?
- Is any of the data sensitive (health, union membership, protected characteristics)?
- Could the analysis produce a biased or disparate outcome across groups?
- How long will the data and outputs be retained?
Mitigations to document
| Risk | Mitigation |
|---|---|
| Re-identification of anonymised data | Set a minimum group size before results are shown |
| Disparate impact across groups | Test outputs across demographic segments before rollout |
| Function creep | Restrict use of outputs to the stated purpose only |
Sign-off and review
- 01ConsultInvolve legal, data protection and, where relevant, employee representatives before sign-off.
- 02Document decisionsRecord why identified risks were accepted, mitigated or the project scope was changed.
- 03Set a review dateRevisit the DPIA if the data sources, purpose or audience for outputs changes.
Common questions
- Is a DPIA legally required for every people analytics project?
- It depends on the risk level and jurisdiction; high-risk processing of employee data typically warrants one even where not strictly mandatory.
- Who should sign off the DPIA?
- Typically data protection and legal functions, with input from the people analytics team and, for higher-risk projects, senior leadership.