It is a requirement of the General Data Protection Regulations that all new systems, processes or services have a DPIA conducted prior to go-live to ensure due consideration of data protection by design and default.

You can find out about Sutton’s COVID vaccination Data Protection Impact Assessment of patients here (PDF)