Data protection impact assessment: a template for employers
This is a template and worked example from Sohus Ltd, which provides Posture, for organisations that deploy Posture to their staff. In it, "we" means Sohus Ltd and "you" means your organisation. You must review it, change it to fit how you use Posture, and complete the blanks. Your organisation is responsible for the finished assessment. It is not legal advice.
It follows the steps in the Information Commissioner's Office (ICO) guidance on DPIAs. Text in square brackets, such as [Your organisation], and blank lines are for you to fill in. Our suggestions are a starting point, not a conclusion. The facts about Posture come from our Security and data page, our privacy notice and the deployment guide. Check them against the version you deploy.
1. About this assessment
| Organisation | [Your organisation] |
|---|---|
| Assessment owner | ________________ |
| Data protection officer (if you have one) | ________________ |
| Who is covered | [For example: all office staff in the UK, about ___ people] |
| Versions of Posture | [Windows app / Mac app / web app, version ___] |
| Date started | ________________ |
2. Why you are deploying Posture
[Your organisation] is making Posture available to staff who work at screens. Posture suggests a guided movement break of 2–3 minutes after about 30 minutes of active computer use, with a 3D figure that shows each move.
The aims are to:
- help meet the duty in the Health and Safety (Display Screen Equipment) Regulations 1992 (regulation 4) to plan work so that screen use is periodically interrupted by breaks or changes of activity. These regulations cover Great Britain; Northern Ireland has its own equivalent;
- make short, regular movement easy for staff who want it;
- [any other aims, for example a wellbeing programme].
Posture gives general wellness guidance. It is not medical advice and doesn't diagnose, treat or prevent any condition. It supports your DSE assessments; it doesn't replace them.
3. Do you need a full DPIA?
Under UK GDPR, a DPIA is required when processing is likely to result in a high risk to people. The ICO's guidance treats monitoring people, health data and people in a weaker position, such as employees, as signs to look for. So it is sensible to record your thinking even if you decide the risk is low.
In our view, the app itself involves little processing of staff personal data by your organisation. Everything the app knows about a person stays on their device. Sohus Ltd receives nothing from the app except the ordinary web-request details its website host sees, such as the device's IP address (see sections 4c and 5). The places where your organisation may process personal data are set out in section 5. The most important is a pilot survey, if you run one. You decide whether this assessment is needed and whether its conclusions are right for you.
Your decision: [a full DPIA is / is not needed, because ___].
4a. Description of the processing: what Posture stores, and where
- Settings, break history and progress. Stored on the device only: in the browser's local storage for the web app, in macOS preferences for the Mac app, and in the app's data folder for the Windows app. The portable Windows version keeps them in a "Posture data" folder next to the program.
- Health check answers. The health check in Settings is optional. The answers are stored on the device only and are used only to leave out exercises that may not suit the person. They could reveal information about a person's health, so treat them as sensitive. They never leave the device, and neither your organisation nor Sohus Ltd can see them.
- How long it is kept. Posture doesn't delete history on its own. The data stays on the device until it is removed: for the web app, by clearing the site's data in the browser; for the desktop apps, by deleting the app's stored data. Removing the app may leave its data behind. The person can change their health check answers in Settings at any time.
- Nothing else. There are no accounts. Posture collects no names, email addresses, keystrokes, window titles, screenshots, audio or video.
4b. What Posture reads on the device
To avoid interrupting calls and presentations, the apps read some signals on the device. They use them at that moment, on the device, and send none of them anywhere.
- Mac app: time since the last keyboard or mouse input; whether another app is using the camera or microphone; which app is in front; and whether something is fullscreen. If "wait while a calendar event is on" is turned on (by the person, or by your organisation through the
calendarAwaresetting), and the person gives macOS calendar access, it also reads when their events start and end and whether they are marked busy. - Windows app: time since the last keyboard or mouse input; whether the screen is locked or the computer is asleep; whether another app is using the camera or microphone; and which app is in front and whether it fills the screen.
- Web app: the browser's notification permission, and in Chrome and Edge the idle-detection permission, so time away from the computer doesn't count. The person grants these and can turn them off.
Posture never turns on the camera or microphone and records nothing.
4c. What goes over the network
- Break screen update check (Mac and Windows apps): about once a day, a request to
posturebreak.co.uk(posturebreak.vercel.appfor Windows 0.3.0, Mac 0.3.4 and earlier). Any update is checked against a SHA-256 hash before it is used. You can turn this off with theupdatessetting. - Optional guide figures (Sam, Nina, Marcus and Mei): downloaded once from the same site when someone chooses one. The built-in guides Theo and Mia need no download.
- The web app loads from the same site and then works offline.
- Licence keys are checked on the device. Posture doesn't report the licence, the number of people using it or anything else back to us.
- The apps send no analytics, crash reports or usage data.
The site is hosted by Vercel. Like any web host, Vercel processes the device's IP address and standard request details, such as the app's user-agent, to serve these requests. The requests carry no account, user ID or device ID. Vercel is a US company, so these logs may be processed outside the UK; Sohus Ltd is responsible for that as the website's operator. On a company network the IP address is usually your organisation's shared internet address. The website's home page uses cookie-free Vercel Web Analytics; the app and the exercise guides are not counted.
4d. What your organisation controls
IT can fix some settings for everyone through Group Policy or a Mac configuration profile, such as the break interval, language, seated-only moves and the update check. These settings go from your organisation to the device, never the other way. Posture shows them as "Set by your organisation". It sends nothing back, so your organisation cannot see whether or when anyone takes a break.
5. Where personal data is involved: worked examples
| Activity | Personal data? | Who is responsible |
|---|---|---|
| Posture storing settings, history and health check answers on a device | Yes, but it stays on the device. Neither your organisation nor Sohus Ltd receives it. | Your organisation, as controller, for devices it owns or manages, even though it can't see the data. On a person's own device, [your view: for example, the person]. You may want advice on this. |
| Installing Posture through your device management tools | Your existing records of which devices have which software. | Your organisation, under your existing IT policies |
| Update checks and figure downloads | The device's IP address and request details, in Vercel's request logs | Sohus Ltd, as its own controller for running the website, with Vercel as its host |
| A pilot survey run by your organisation, including the before-and-after survey offered with our free pilot | Anonymous answers are not personal data. If you link the before and after surveys with a code word, answers are pseudonymous, which is still personal data, and questions about aches and pains are health data. | Your organisation |
| Support emails to us | The sender's name, email address and message | Sohus Ltd |
| Your licence and invoices | Your billing contact's name, email address and work address | Sohus Ltd |
Sohus Ltd does not process personal data on your behalf, so we are not your processor and the app needs no Article 28 processing agreement. Apart from the web-request logs above, the only personal data we receive from you is support emails and the contact details on your licence and invoices. Our data processing statement and agreement sets this out.
If we give you questions for a pilot survey, you run the survey and collect the answers. If you ever want us to collect or analyse responses for you, we would first need to agree processor terms with you, and you should update this assessment.
6. Necessity and proportionality
- Purpose: prompting and guiding screen breaks, as described in section 2.
- Data minimisation: no accounts, no central records and no reporting. Posture keeps only what it needs to work, on the device.
- Voluntary use: [state your approach: for example, installing Posture is standard, but taking breaks and using the health check are up to each person].
- Lawful basis for a pilot survey (if any): [consent / legitimate interests / other: ___]. Consent is hard to rely on at work, because staff may not feel free to say no. If you choose it, make taking part genuinely optional. If you ask about health, you also need a condition for processing special category data: [___]. Anonymous surveys avoid this.
- Transparency: tell staff what Posture does and doesn't do before rollout. You can link to our privacy notice.
- Could you achieve the aim with less? [Your view. For example: the app already processes nothing centrally; the remaining choice is whether to run a survey.]
7. Consultation
Record who you asked and what they said. Consider staff or their representatives, your data protection officer, IT and security, Health and Safety, and occupational health.
| Who | When | What they said, and what changed |
|---|---|---|
| Staff or representatives | ________ | ________________ |
| Data protection officer | ________ | ________________ |
| IT and security | ________ | ________________ |
| Health and Safety / occupational health | ________ | ________________ |
8. Risks to individuals and how they are reduced
Likelihood and severity are our (Sohus Ltd's) suggested starting point, before your measures. Change them to fit your organisation.
| Risk | Likelihood and severity | How it is reduced, and what is left |
|---|---|---|
| Staff believe Posture monitors them, for example because it notices keyboard use, calls and the front app. | Possible; moderate | These signals are read on the device and never leave it. There is no reporting to managers. Organisation settings apply to everyone and reveal nothing about individuals. Explain this to staff before rollout. Left: low. |
| Pressure to take part, or to be seen taking breaks. | Possible; moderate | Say clearly that breaks are voluntary. Anyone can put a break off by 5 minutes (up to twice), skip it, swap a move or hide a move they can't do. There are no streaks, and nobody else can see whether breaks are taken. Left: low. |
| Health check answers are sensitive. | Unlikely; moderate to serious | The health check is optional, stored only on the device and never sent anywhere. Your organisation should not ask people to fill it in or show it to anyone. Left: low. |
| Someone else sees a person's history or health answers on a shared computer. | Possible; moderate | Give each person their own sign-in or browser profile. On shared machines consider not encouraging the health check. The portable version keeps its data next to the program, so it travels with a USB stick. Left: low. |
| IT access to device data, for example through support tools, backups or roaming profiles. | Unlikely; moderate | Check whether your backups or roaming profiles copy app data or browser storage. Treat Posture data as personal and don't inspect it. Left: low. |
| Pilot survey answers are traced to a person. | Possible; serious | Use your own anonymous survey tool, not Posture. Report results only for groups of 10 or more. If you link rounds, use a self-chosen code word, not names. Don't share individual answers with managers. Left: low. |
| Device IP addresses reach the website host. | Likely; minimal | These are ordinary web requests, usually from your shared network address. To stop them, set updates to 0, fix the guide to Theo or Mia (figure set to m or f), or block the addresses. Posture keeps working with the version it has. Left: minimal. |
| Someone relies on Posture for a health problem. | Unlikely; moderate | Posture gives general wellness guidance, not medical advice. Each exercise's step-by-step notes say to stop if there is sharp pain, numbness, tingling or dizziness. Tell staff to see a clinician about pain or injury, and keep your usual DSE assessment and occupational health routes. Left: low. |
| [Other risks you identify] | ________ | ________________ |
9. Measures agreed
- Tell staff before rollout what Posture does, what stays on their device, and that breaks are voluntary.
- Do not ask managers to check or encourage break-taking in a way that feels like monitoring.
- Decide which settings to fix centrally, and whether to turn off the update check.
- If you run a pilot survey, keep it anonymous and report only for groups of 10 or more.
- On shared computers, give each person their own sign-in or browser profile, and check whether backups or roaming profiles copy Posture's data.
- [Other measures: ___]
10. Sign-off
| Item | Name and role | Date | Notes |
|---|---|---|---|
| Measures approved by | ________________ | ________ | Add actions to your plan, with dates and owners. |
| Remaining risk approved by | ________________ | ________ | If a high risk remains, you must consult the ICO before going ahead. |
| Data protection officer's advice | ________________ | ________ | Accepted / overruled (give reasons): ________ |
| Consultation responses reviewed by | ________________ | ________ | ________________ |
| Next review | ________________ | ________ | Review if you change how you use Posture, or a new version changes what it does. |
This template is provided to help you. It is not legal advice, and it does not replace your own assessment or advice from your data protection officer or lawyer.
Who provides Posture
Posture is made by Ben Huss, Immersi, and provided by Sohus Ltd (company number 09369062, registered in England and Wales), 167–169 Great Portland Street, 5th Floor, London W1W 5PF. Sohus Ltd is registered with the Information Commissioner's Office, registration ZC111701. Personal use is free; organisations that deploy Posture to staff need a Posture for Work licence. Questions: ben@immersi.co.uk.