Assess data protection impact before conducting internal investigations

ANALYSIS: Businesses that plan to carry out internal investigations into the conduct of their employees or agents are likely to need to carry out data protection impact assessments (DPIAs) first, DPIAs are now mandatory in certain circumstances under the GDPR.