My take on IG is “write it down”. What do you want to do, why, and how? This is for everything: Data Protection Impact Assessments, application forms, protocols, Standard Operating Procedures, working processes, data-sharing agreements, and so on. That’s all it is: write it down.