Child's Interview Right's Practitioner regulations: data protection impact assessment

8. Incorporating Privacy Risks into planning

Explain how the risks and solutions or mitigation actions will be incorporated into the project/business plan, and how they will be monitored. There must be a named official responsible for addressing and monitoring each risk.

Risk: ChIRP Personal information released inappropriately by SG

Ref: ACR01

How risk will be incorporated into planning:

• Statutory obligation on SG staff to comply with data protection legislation.
• Data sharing agreement – progress is being made with to facilitate an agreement between PS and several regulatory bodies. SG are awaiting sight of the final agreement.

Owner: SG / PS

Risk: Handling of data rights requests: we may receive data rights requests we are unable to action in full

Ref: ACR02

How risk will be incorporated into planning:

Legal requirement to store personal data is clearly established, and will be explained if rights of deletion, objection or restriction are made.

Owner: SG

Risk : Data is not shared in a timely manner, impacting negatively on ChIRPs or children

Ref: ACR03

How risk will be incorporated into planning:

Sharing requirements discussed with Police Scotland and training provider

Owner: SG