We were asked by an industry user group for a software supplier to carry out a DPIA on behalf of all the controller clients for a new mobile app being developed that would be deployed to their end customers. We carried out a DPIA in close co-operation with the software supplier. Given that the app would be rolled out by an estimated 50-75 user group controllers in the first year with an estimated end user base of between 1,500 – 10,000 users per deployment we needed to ensure that the default app configuration would be robust, and that the user group was given adequate information to deploy the app in a compliant manner. In the end, we carried out a DPIA and also produced documented sub-processor evaluations, a transparency review of the app and we developed a rollout guide for the app to be used by each of the controller clients. The app developer also implemented additional measures including regular pen testing of the app and a deployment checklist.