Does my smart device need a DPIA before launch?
You must complete a data protection impact assessment before processing personal information likely to create high risk. Screen the device, app and cloud service together, including household monitoring. Reduce the risks before launch and consult the ICO if high risks cannot be mitigated. Cambridge China Bridge has its own staff in China.
Screen the processing before approving the launch
The trigger is likely high-risk processing, rather than the fact that the device is imported. The ICO says most consumer connected-device processing is likely to be high risk and therefore usually requires a data protection impact assessment, or DPIA. Start screening during product selection, before testing with real personal information.
Keep this assessment separate from the security paperwork covered in our connectable products guide. Ask the factory to demonstrate what the device collects, what the app sends elsewhere and what the cloud service retains. An enclosure inspection cannot answer those questions.
Identify the high-risk features
The ICO identifies systematic and extensive profiling used for significant decisions, large-scale use of special category data and large-scale monitoring of publicly accessible areas as processing that always requires a DPIA. Its connected-device guidance also says a DPIA is required when offering the product or service to children.
For your screening discussion, flag microphones, cameras, location histories, health measurements and inferred household routines. Describe what each feature actually does. A movement alert and a service that builds a continuing behaviour profile need different risk discussions. For camera sourcing questions, use our security cameras guide.
Assess everyone in the household
Work through a household scenario involving the account holder, another adult, a child and a visitor. Ask whose voice, image or activity could be captured, who can view it and whether someone without an account can understand or control the recording.
Test uncomfortable scenarios as well: an account holder watching another occupant remotely, a former partner retaining access, or a used device exposing the previous household’s recordings. Record the possible harm and the access path that enables it. Include domestic abuse and stalking in the assessment discussion.
Turn mitigation into a factory specification
For each risk, specify a change and a way to test it. Consider local processing instead of uploading recordings, less detailed activity logs, shorter retention, separate household permissions, visible recording indicators and a usable microphone or camera switch. Check that account removal and ownership transfer also remove unwanted access.
Ask for demonstrations on the intended production device, app and cloud configuration. Record the approved settings and unresolved defects alongside the firmware and software approval. Give each mitigation an owner and retain test evidence rather than accepting a promise that privacy will be added later.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Make the assessment a release decision
Use the assessment to describe the processing and its purpose, assess necessity and proportionality, identify harm and specify mitigation. Judge the risk remaining after the changes. If a high risk cannot be mitigated, you must consult the ICO before starting that processing.
For your release file, retain the data-flow map, supplier answers, risk assessment, mitigation tests and the decision to proceed or hold. Reopen the assessment when proposed software or service changes alter data collection or access. Cambridge China Bridge’s staff in China can support factory checks; ask your privacy adviser to assess the processing and remaining risks.
Frequently asked questions
Does every imported smart device need a DPIA?
The trigger is processing likely to create high risk. The ICO says most consumer connected-device processing meets that threshold. Screen the actual device, app and service rather than relying on the product name.
Can I leave the DPIA until after launch?
No, where it is required it must be completed before the relevant processing begins. Build the assessment into development so its findings can change the product before release.
Can I use the factory’s DPIA?
Use it as input. Check whether it describes your actual app, cloud service, settings, users and access arrangements. Ask your privacy adviser to assess gaps before relying on it.
Do I have to send every DPIA to the ICO?
No. Prior consultation is required where high risk remains that you cannot mitigate. Hold the affected processing and consult the ICO before starting it.