Define and document the processes for DPIAs and DMFs

[calumabarnett]

At the moment, it is not always clear when a DPIA or a DMF is needed (for data engineers building managed pipelines, or for Analytical Platform users themselves uploading data ad hoc). This means that we often get support requests asking for advice. We often refer these to the data protection team or to the information assurance (IA) lead in Data & Analysis. It may also mean that some users do not fulfil all governance requirements prior to uploading data to the Analytical Platform and processing it.

We should clarify with the data protection team and with the IA lead what processes apply and when. We should record these clearly in the Analytical Platform user guidance and send out comms to users to notify them that the guidance has been updated.