Example DPIA for Wyser ASSIST
What is this document?
A Data Protection Impact Assessment (DPIA) helps your organisation identify and reduce data protection risks before introducing new technology or processing personal data in a way that could pose a high risk to individuals.
We have provided an example DPIA for Wyser ASSIST to help your organisation assess the use of AI transcription and summarisation in advice services.
The document follows the Information Commissioner's Office (ICO) seven-step DPIA structure and includes example responses covering how ASSIST processes data, data protection risks and the measures used to manage them.
How to use the example
Download the example DPIA and use it as a starting point for your own assessment. It is written from your organisation's perspective as the data controller, so you can adapt it to reflect your services, policies and use of ASSIST.
The document distinguishes between:
- Wyser-supplied information: Describes how ASSIST works and the measures Wyser has in place. Check these details against your current contract, Data Processing Agreement (DPA) and configuration before reusing them.
- Your organisation's decisions: Covers matters you must assess and document yourself, such as your lawful basis for processing, consultation with stakeholders and acceptance of residual risks.
- Details to confirm: Square brackets identify information you need to complete or check against your own arrangements.
What does the example cover?
The example follows the seven steps of a DPIA and covers:
- The need for a DPIA and a description of the processing
- Consultation with relevant stakeholders
- Necessity, proportionality and the lawful basis for processing
- Potential risks to individuals and measures to reduce those risks
- Sign-off, approval and ongoing review
It also includes questions specific to AI transcription and summarisation, including accuracy, human oversight, model training and the use of optional modules.
What should you check before completing your DPIA?
Before relying on the example, make sure you have considered:
- Your own data and processes: Identify the people whose data you process, the information recorded in conversations and how your team uses ASSIST.
- Your configuration: Confirm which recording methods, features and optional modules your organisation uses.
- Your data protection arrangements: Document your lawful basis, transparency measures, retention requirements, access permissions and processes for handling data subject rights.
- Your risk assessment: Review the risks and suggested ratings against your organisation's circumstances. The example ratings are illustrative, not prescribed outcomes.
- Your approval process: Consult your Data Protection Officer (DPO) and relevant stakeholders, record decisions and assign responsibility for reviewing the assessment.
Does this example replace your own DPIA?
No. Your organisation remains responsible for completing, approving and reviewing its DPIA as data controller.
The example is a practical starting point, not legal advice or a completed assessment for your organisation. Your DPO should review the document alongside your current Wyser DPA, configuration and internal data protection policies.
You should also review your DPIA when your use of ASSIST changes materially, such as introducing a new module or when changes to a sub-processor or AI model provider affect your assessment.
Need further information?
For supporting documentation about ASSIST's data processing and security arrangements, consult the related Knowledge Base resources, including the DPA, security information and sub-processor register.
Contact your Wyser Account Lead or email support@wyser.online if you need further information to support your assessment.