Does what you are planning need a data protection assessment first?

Does your website or app track what individual people do?

For example, analytics that keep data on each visitor, an advertising pixel, session recording, heatmaps, or anything that follows a person from page to page or between visits. Simple visitor totals do not count. Anything linked to an ID for a person or device does.

Do you combine data from separate systems to build a picture of individual customers?

For example, linking your ad account, your analytics and your payments or customer records, so you can see what one person did and how much they spent. If you only ever use the linked data for totals, say no. If you use it to group, score or target people, say yes.

Does software decide, or have a big say in, who gets a service, a price or a job?

For example, sifting CVs, scoring credit or affordability, setting prices per person, or approving and refusing automatically. It still counts when a person signs it off, if that person is following the score.

Do you pick out children, patients or other vulnerable people from what you know about them, to target marketing or online services at them?

Under-18s, people receiving care, people in financial difficulty. Picking them out by age, condition or circumstances in your records or your ad platform's data is profiling. Merely having some among your customers is not.

Are you about to use personal data you already hold, on a large scale, for something new?

For example, using your whole customer list for marketing when it was collected to fulfil orders, or training an AI model on records collected for another reason. There is no fixed number: a few hundred local customers is unlikely to be large scale, a national customer base is.

Do you profile large numbers of people?

Scoring or grouping people, or predicting their behaviour, across a large customer base. There is no fixed number. The regulator looks at how many people, how much data, for how long and over how wide an area.

Do you hold personal data you got from somewhere other than the person, without telling them?

For example, prospect lists, data copied from websites or bought, or data from a partner. This item applies if you rely on the exemption for cases where telling people would be impossible or take disproportionate effort.

Do you use biometrics to identify or verify your staff, children, patients or other vulnerable people, or use them on a large scale?

Face recognition, fingerprint entry, voice identification. A fingerprint clocking-in system counts, because the EU regulators' DPIA guidelines (WP29) list employees among vulnerable people. Other criteria in those guidelines also count, such as systematic monitoring or matching datasets, so answer unsure if one might apply.

Do you hold or use genetic data about staff, children, patients or other vulnerable people, or use it on a large scale?

The list names it, so we ask. It only counts together with another risk factor from the EU guidelines (WP29), such as vulnerable people or a large scale, so answer not sure if one might apply.