Interim report: An Overview of Delivering our Data Protection Impact Assessment (DPIA) Template Pack and Example DPIA
This is one of a series of interim reports produced as part of the Information Sharing Project in collaboration with The Promise Scotland. This project has sought to understand the legal, cultural, and technical barriers to data and information sharing as it relates to care experienced children, young people, and their families across public sector agencies and organisations in Scotland.
This report was prepared by Datavant, with contributions from Dr Lang Yu, from Loughborough University, and Mydex CIC. This work package developed and tested a Data Protection Impact Assessment (DPIA) Template Pack, including an example DPIA. The work responds directly to feedback across the project that highlighted the need for clearer, more practical tools to support confident and proportionate data sharing involving children’s data.
The findings presented here should be read alongside insights from the other work packages, as together they contribute to a shared and evolving understanding of how data and information sharing can better support care experienced children and young people in Scotland. The full set of final project outputs is due to be published in spring 2026.
-
The report describes the design and delivery of a practical tool, a DPIA template, intended for use by Data Protection Officers (DPOs) and subject-matter experts working with children’s data sharing in local authorities and the wider Scottish public sector. The template integrates embedded visual data flow modelling, helping users clearly map how data is collected, shared, accessed, and stored across organisations.
By combining narrative structure with visual representation, the DPIA template supports better understanding of risk, roles, and responsibilities, making data sharing arrangements easier to assess, communicate, and explain. This approach aims to move DPIAs from a purely compliance-focused exercise to a tool that actively supports service design, collaboration, and decision-making.
The report outlines how the template can be used in practice, including its role in identifying data sharing risks, assessing proportionality, and supporting mitigation planning in multi-party contexts. It also highlights how the template aligns with themes identified across earlier work packages, including the need for consistency, transparency, and shared understanding across the ‘care system’.