Data Protection Impact Assessments (DPIAs) are a relatively new development in the governance of data processing. The recommendations in this article are a tool for policy-makers and civil servants developing data processing systems for government and undertaking DPIAs, to assist government to meet rule of law standards when implementing new data processing systems. The article also adds to analysis of the governance of data processing systems for all stakeholders, including civil society.