Annex C
CYC DPIA screening May 2025 – v6.0
Data Protection Impact Assessment Screening Questionnaire
To confirm whether a full DPIA is required please go through the below and tick any boxes that are relevant.
|
Ref number: |
Heritage Programme |
|
Name and Job title: |
Tania Weston, Regeneration Programme Manager |
|
Date: |
15/10/2025 |
|
Description - Explain broadly what you aim to achieve and what type of processing it involves. You may find it helpful to refer or link to other documents, such as a project proposal, business case etc. |
|
|
The programme will develop a 10-year Heritage Strategic Delivery Plan – focused on maximising the social, economic and sustainability outcomes from York’s world-renowned heritage assets. At the heart of the programme will be attracting significant investment in York’s heritage, through public sector grants, private sector investment or planned disposals.
At this stage use and/or collection of personal data is not anticipated. The programme will develop a number of projects (such as capital investment to reduce vacancy rates on upper storeys of buildings, or an audit of street ‘clutter’ or buildings at risk). It is possible that some projects may be developed by or involving individuals as volunteers or trainees, in which case personal data considerations may become applicable. Data protection considerations will be regularly reviewed as the programme develops and a DPIA complete where relevant.
|
|
Are you:
☐ starting a new (or reviewing an existing) project involving the use of personal data.
Are you planning to carry out any
☐ evaluation or scoring
☐ automated decision-making with significant effects;
☐systematic monitoring;
☐ processing of sensitive data or data of a highly personal nature
☐ processing on a large scale
☐ processing of data concerning vulnerable data subjects
☐ innovative technological or organisational solutions
☐ processing that involves preventing data subjects from exercising a right or using a service or contract.
☐ profiling to make decisions about people
☐ automated decision-making to make decisions about people
☐ process special-category data or criminal-offence data
☐ systematically monitor a publicly accessible place eg CCTV
☐ use innovative technology in combination with any of the criteria in the European guidelines
☐ use profiling to help make decisions on someone’s access to a service, opportunity or benefit
☐ use automated decision-making to help make decisions on someone’s access to a service, opportunity or benefit
☐ use special category data to help make decisions on someone’s access to a service, opportunity or benefit
☐ carry out profiling on a large scale
☐ process biometric or genetic data in combination with any of the criteria in the European guidelines
☐ combine, compare or match data from multiple sources
☐ process personal data without providing a privacy notice directly to the individual in combination with any of the criteria in the European guidelines
☐ process personal data in a way that involves tracking individuals’ online or offline location or behaviour, in combination with any of the criteria in the European guidelines
☐ process children’s personal data for profiling or automated decision-making or for marketing purposes, or offer online services directly to them
☐ process personal data that could result in a risk of harm in the event of a breach
☐ a change to the nature, scope, context or purposes of existing processing
If you have ticked any of the boxes above, you must complete a full DPIA. Please contact information.governance@york.gov.uk who will be able to advise and support you to do this