Data Protection Impact Assessment (DPIA)

Company: Active Planning Leads Ltd.
Registration Number: 12862897
Data Protection Registration (ICO): ZA800152
Address: The Old Chapel, 33 Church Street, Coggeshall, Essex, CO6 1TX
Assessment Date: 05 April 2025
Conducted by: Stuart Fairly, Production Manager
Approved by: Catherine Bracher, Director

1. Introduction and Context

This Data Protection Impact Assessment (DPIA) evaluates the privacy risks and safeguards associated with Active Planning Leads Ltd.'s use of publicly available planning application data. The DPIA draws on our Legitimate Interests Assessment (LIA) dated 05 April 2025 and is intended to demonstrate compliance with the UK GDPR, particularly Articles 5 and 35.

2. Description of Processing

Nature of Data Processed:
- Names and addresses of planning applicants
- Project descriptions (e.g., "rear extension")
- Occasionally disclosed contact information (e.g., phone numbers, emails)

Source of Data:
- Publicly accessible planning application portals operated by local planning authorities across the UK and Northern Ireland
Processing Activity:
- Manual re-keying and formatting of planning application data into a proprietary, internal database
- Supplying selected data to vetted business clients for one-time postal marketing
Purpose:
To facilitate connections between planning applicants and relevant service providers (e.g., builders, architects, landscapers) through a one-off postal contact.

3. Lawful Basis for Processing

Legal Basis: Article 6(1)(f) – Legitimate Interests
A comprehensive LIA has been carried out and supports the use of data for the stated purposes. The interests of the business, the planning applicants, and the end clients are balanced against data subjects’ rights and freedoms.

4. Necessity and Proportionality

- Necessity: There is no less intrusive way to offer timely, relevant service opportunities to applicants.
- Data Minimisation: Only essential, already-public information is collected.
- Data Use: Strictly limited to one-off postal campaigns; no email, phone contact, or profiling.
- Security: Access to data is restricted; audit trails are maintained.

5. Risks to Individuals

6. Safeguards and Controls

- Clients must sign a data use agreement restricting use to one-time postal marketing
- No data is sold or transferred beyond the contracted client
- Audit trails of data access and usage are maintained
- A publicly accessible Privacy Notice outlines the nature and scope of processing
- Data subjects may contact the company to exercise their rights under UK GDPR

7. Consultation with Stakeholders

While this processing does not require formal consultation with data subjects (Article 35(9)), our company remains transparent through a privacy notice and provides contact mechanisms for questions, complaints, or opt-outs.

8. DPIA Outcome

✅ Compliant
This DPIA concludes that the processing of personal data for the stated purpose is lawful, necessary, and proportionate, and that risks to individuals are low and sufficiently mitigated.

9. Review and Sign-Off

Review Schedule: Next scheduled DPIA review: April 2026, or earlier if there are substantial changes to the nature or purpose of data processing