ata retrieval amongst other efficiencies and benefits will make this type of product cost effective. 4.4.6 Data protection impact assessment The Data Protection Impact Assessment (DPIA) has been continually reviewed and updated in consultation with the Senior Data Governance Officer resourced to the project and the third-party Data Protection Officer (DPO) Veritau. Veritau approved the DPIA for this work. The recommendation was that an Information Asset 42 OFFICIAL - SENSITIVE Owner is assigned for the product and that it is added to the Information Asset Register. Further, additional approval could be sought through consultation with the Information Commissioner’s Office. A copy of the Data Protection Impact Assessment is available at Appendix 11. 4.4.7 Risk management A risk register for the project was maintained throughout and actively managed in-line with corporate risk and issue management processes. Additional measures to ensure risk management was robust included consulting with a third-party data analytics specialist for check and challenge and to develop mitigations. It should be noted for context that the project was a proof of concept and has not been implemented and is therefore not currently being used. The below summary includes a high-level summary of risk descriptions only: Risk status Count 1. Risk related to the project itself - closed 7 2. Ongoing risk – open, can be influenced 13 3. Ongoing risk – open, little or no ability to influence 1 4. Issues – any status 0 5. New risks identified at closure 2 Risk related to the project itself – closed:  There could be insufficient commitment and/or corporate resources available and this could cause delays (internal and also with partners)  Timeframes set are unachievable and/or missed  There is a risk tha