Data Protection Impact Assessment

Data Protection Impact Assessment (DPIA)

Version: 1.0 · Owner: Pocket PMO Ltd · Approval status: Approved · Review date: annually (or on material change)

1. Purpose and background

Pocket PMO is a project and portfolio management platform used by internal project managers and small PMOs. It processes ordinary business personal data (employee names, contact details, project assignments, meeting notes) and uses AI to summarise, draft, and forecast. Article 35 UK GDPR requires a DPIA where processing is "likely to result in a high risk to the rights and freedoms of natural persons", including systematic large-scale processing of employee data and use of new technologies (AI). This DPIA has therefore been carried out even though the individual risk profile is moderate.

2. Nature, scope, context and purpose

• Nature. Cloud multi-tenant SaaS. Customer employees are the primary data subjects.
• Scope. Personal data placed in projects, RAID items, meeting notes, uploaded documents, and AI conversation history. Approximately 25–30 personal data attributes per user across the schema (see technical inventory §6).
• Context. Business B2B. Customers are the controllers; Pocket PMO is the processor for content placed inside customer workspaces.
• Purpose. Enable customers to plan, track and report on projects, and to accelerate delivery with human-supervised AI.

3. Data subjects

• Customer end-users (project managers, PMO staff, team members).
• Stakeholders named inside customer projects (may be third parties, e.g. suppliers).
• Marketing leads and support-ticket submitters (controller).

4. Categories of personal data

See the Technical Inventory §6 for the full list. In summary: identity, contact, employment context, project involvement, meeting content, uploaded files, AI conversation history, billing metadata, system telemetry.

No special-category data is intended to be processed. Customers must not upload health, biometric, or other special-category data into the platform (see Acceptable Use Policy).

5. Lawful bases and necessity

Lawful bases are set out in the Privacy Overview. Necessity has been considered against alternatives:

• Could the objective be met with less personal data? Yes for anonymous analytics; no for the core product function.
• Could AI features be delivered without sending prompts to a provider? Not at parity of quality; users can turn AI off per workspace.

6. Proportionality assessment

• The volume and sensitivity of data is proportionate to a business project-management use-case.
• AI features are explicitly advisory. They do not make significant automated decisions.
• The customer controls sharing (Snapshot links, sub-processor invitations, integrations).

7. Specific processing activities considered

7.1 AI processing

Prompts and outputs are transmitted through the Lovable AI Gateway to a model provider (Google Gemini and OpenAI models are available via the gateway). Prompts contain project content the customer has entered, which may include third-party personal data. AI processing is human-approved before it changes project state or communicates externally. Provider no-training and retention statements are held by Pocket PMO on customer request (owner-confirmation D-05).

7.2 Meeting recordings and transcripts

The platform supports transcription via ElevenLabs (elevenlabs-transcribe) and summarisation via the AI Gateway. Audio may be transient depending on customer configuration; transcripts are stored in meetings unless the customer deletes them. Meeting recording can constitute processing of special-category-adjacent data (e.g. voice), so customers must ensure they have a lawful basis and have informed participants.

7.3 Uploaded documents and project content

Files uploaded to the platform are stored in managed object storage with organisation-scoped access. Documents summarised by AI are transmitted to the AI Gateway as part of the prompt.

7.4 External sharing and Snapshot links

Customers can generate share tokens for read-only external distribution (project_share_tokens, drawing_board_share_tokens). Tokens can be revoked; access is auditable. Customers are responsible for judging which content is safe to share.

7.5 Authentication and access

Managed authentication (email/password, Google, Apple, SAML SSO on request), TOTP MFA, session policy 30 minutes idle. Roles evaluated via has_role SECURITY DEFINER function.

7.6 International transfers

Transfers outside the UK/EEA are governed by UK IDTA or EU SCCs per sub-processor. Data residency confirmation is required (H-01, H-02).

7.7 Data retention and deletion

Retention runs while the account is active. Deletion within 30 days of account closure, subject to legal-record requirements and the platform provider's backup retention window.

8. Risk assessment

9. Existing controls (cross-reference)

• Row Level Security on every table + GRANT-per-migration invariant.
• has_role SECURITY DEFINER function.
• MFA (TOTP) via MFAGate.
• Session timeout + inactivity warning (useSessionTimeout).
• HIBP password check + strength policy.
• Rate limits + failed-login logging.
• Approval-first AI UI.
• Audit logs (audit_logs, per-domain change tables).
• Encrypted transport (TLS 1.3) and at-rest storage (AES-256).
• Sentry error monitoring (when enabled).

10. Residual risk

Following existing controls, the residual risk is assessed as Low-to-Medium across all identified processing activities. Highest residual risks are R2, R3 and R6, all addressable via governance work rather than architectural change.

11. Consultation

This DPIA was drafted internally. Where residual risk is Medium or higher, consultation with an external adviser (privacy counsel) is recommended before public launch.

12. Review and approval

Owner confirmation required

• L-03 privacy lead; H-01 region; H-02 AI region; H-03 backup; A-02/A-03 RTO/RPO; D-03 meeting-recording retention; D-05 model no-training statements (confirmed 15 Jul 26).

Document history