A smarter way to handle sensitive data 

Improving services for the public is only one part of Humberside Police's digital innovation journey. That same commitment extends behind the scenes, where the force continues to strengthen information governance and the operational processes that support policing every day. One of those was the DPIA process, where a 2022 ICO audit reinforced the need for a more consistent, efficient and compliant approach to handling sensitive data.

The challenge

Data Protection Impact Assessments (DPIA) sit at the heart of responsible data use in policing, helping forces like Humberside Police to assess risk, protect individuals’ rights, and meet strict legal obligations before any sensitive data is used.

The process, however, wasn't keeping pace. Different project types triggered different assessment routes, with no logic to guide requestors toward the right one, and no structured framework to shape what they entered. Business leads frequently submitted incomplete or inconsistent applications, sending reviews backwards before they had properly begun. Supervisors and DPIA officers, meanwhile, had no single view of what was in progress, who owned what, or where things stood.

What made it harder still was how disconnected the surrounding experience had become. Notifications were manual, data entry was repeated across steps, and the DPIA process sat apart from the wider systems and tools the force was already using. When gaps appeared, as they often did, requestors, approvers, and reviewers resolved them outside the process entirely, creating dependencies on workarounds that slowed everything down.

How we made it work

Having already worked alongside the Humberside Police team across several projects, we came into this one with an established way of operating: one team, shared goals, no handover culture.

Collaborative workshops with DPIA officers, business leads, and Information Governance Unit (IGU) staff set the direction early. An agile delivery approach kept things iterative, with regular feedback loops ensuring the solution reflected how people actually worked rather than how it looked on paper. To keep access simple and secure, Azure Active Directory Single Sign-On was integrated so staff could authenticate using their existing force credentials, removing the need for separate account management entirely.

Automation handled the process overhead that had previously fallen to people. Workflows route DPIAs to the relevant IGU experts automatically, and queries are raised and responded to directly within the case record rather than across separate email threads. Throughout, compliance with DPA 2018 and UK GDPR shaped every decision, with the recommended actions from the external audit providing a clear framework to build against.

Impact at a glance

Whilst the results speak for themselves in how teams now experience the process, the numbers behind the change tell their own story.

• The automated process has supported 110 record submissions to date, achieving a 40.9% close rate.
  
  
• An average of 5.6 applications submitted each month, creating a consistent and scalable workflow for ongoing demand.

For a force operating under the data obligations policing carries, these are not efficiency gains in isolation. A DPIA process that runs as it should means sensitive data is handled more consistently, decisions are better evidenced, and the compliance record is always there when it needs to be. That is the kind of foundation that does not just make day-to-day work easier, it protects the force, the people it serves, and the integrity of every decision made along the way.

Momentum gained

Since going live, the way Humberside Police handles DPIAs has changed in ways teams notice day to day. Submissions come in more complete, reviews move forward without being sent back to fix the same gaps, and the chasing and piecing together that once happened across email threads and phone calls has largely disappeared. Ownership is clearer, handovers happen inside the process, and there is always a single place to see what is in progress and what needs attention.

That shift matters beyond efficiency. When the process runs as it should, sensitive data is handled more consistently, decisions are better evidenced, and the compliance record builds itself as work moves through each stage. For a force operating under the data obligations policing carries, that is a major gain.

As Humberside continues to evolve how it manages data and compliance, the solution provides a platform to build from, one already embedded in how the force works rather than sitting alongside it.