Your marketing team has started using an AI copy tool. HR is trialling AI CV screening. Customer service has a chatbot. Somewhere in that list is a project that needed a Data Protection Impact Assessment before it went live, and probably did not get one.
A DPIA is not paperwork for its own sake. It is the process UK GDPR sets out for identifying and reducing the data protection risk in a project before you start, and for AI tools it is often mandatory rather than optional. This guide explains when it applies, how to screen your tools quickly and what the ICO expects to see.
What Article 35 actually says
Article 35(1) UK GDPR requires a DPIA where a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of individuals. The assessment has to happen before the processing starts.
Article 35(3) sets out three types of processing that always require one:
- systematic and extensive evaluation of personal aspects based on automated processing, including profiling, where decisions produce legal or similarly significant effects
- large scale processing of special category data or data about criminal convictions and offences
- systematic monitoring of a publicly accessible area on a large scale
The ICO has published a further list of ten processing operations under Article 35(4). The first one is the one that catches most AI projects: innovative technology, meaning the use of innovative technologies or the novel application of existing ones, explicitly including AI. That entry requires a DPIA where it is combined with any of the European guidelines criteria, which include evaluation or scoring, automated decision making with significant effect, systematic monitoring, sensitive data, large scale processing, data matching, vulnerable data subjects and preventing people from exercising a right or using a service.
In practice, an AI tool that touches personal data will usually tick the innovative technology box plus at least one more. That is the point at which the DPIA stops being good practice and becomes a legal requirement.
Other entries on the ICO list that come up with AI include denial of service (decisions about access to a product, service, opportunity or benefit based to any extent on automated decision making), large scale profiling, biometrics, data matching, invisible processing and tracking.
A quick screening test for your AI tools
Run each tool through these questions. If you answer yes to the first and yes to any other, do a DPIA.
- Does it process personal data? Customer records, staff data, prompts containing names or case details, uploaded documents, voice or video of real people. Prompts count.
- Does it evaluate, score or rank people? Lead scoring, CV sifting, credit or risk models, churn prediction.
- Does it affect whether someone gets something? A job interview, a price, a loan, a place on a waiting list, access to support.
- Does it use special category or biometric data? Health, ethnicity, beliefs, trade union membership, voice prints or facial data.
- Is it monitoring people? Employee productivity tools, call analytics, session recording, location.
- Does it use data the people never gave you directly? Scraped, enriched or bought data sets used for training or targeting.
- Is it operating at scale, or on vulnerable people including children?
If you only answer yes to the first question, for example a tool drafting blog posts that never sees customer data, you probably do not need a full DPIA. Record why you reached that view. The accountability principle means the decision not to do one should be documented too.
What a good AI DPIA contains
The ICO expects a DPIA to describe the processing, assess necessity and proportionality, identify the risks and set out the measures that address them. For AI tools, a few sections do the heavy lifting.
- What the model actually does with the data. Whether prompts and uploads are used for training, where the data is hosted, who the sub processors are and how long anything is retained.
- Lawful basis and transparency. If the basis is legitimate interests you need a legitimate interests assessment alongside. Your privacy notice has to reflect the AI use in plain terms.
- Accuracy and bias. How outputs are tested, how errors are caught and what happens when the model is wrong about someone.
- Human involvement. The Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D. A decision is solely automated where there is no meaningful human involvement, and where a significant decision is taken solely by automated means the controller must provide information about it, allow representations, enable human intervention and allow the decision to be contested. If your AI tool makes or heavily shapes decisions about people, those safeguards need to be designed in, not bolted on. Our Data (Use and Access) Act 2025 guide covers the wider changes.
- Individual rights in practice. People can ask what you hold, including data sitting inside an AI tool or its logs. Being able to find and export it is a design question, not a support question. See our DSAR support service.
- Security and access. Who in the business can use the tool, and what stops someone pasting a customer list into a public model.
When you have to consult the ICO
If the DPIA identifies a high risk and you cannot reduce it, you must consult the ICO before the processing starts, and you cannot go ahead until you have. The test is the residual risk after mitigation, so a high risk you have brought down to an acceptable level does not need consultation. The ICO aims to give written advice within eight weeks, extending to a maximum of 14 weeks in complex cases.
Where the EU AI Act fits
A DPIA is a UK GDPR requirement and it is separate from the EU AI Act. They overlap in practice, because organisations in scope of the AI Act are usually processing personal data as well. If your AI use has any EU connection, or you publish AI generated content, read our guide to the EU AI Act and Article 50 transparency rules alongside this one. Doing the DPIA and the AI Act assessment in one exercise saves repeating the same tool inventory twice.
Worth remembering that a DPIA is a living document. If the tool changes, the vendor changes its terms, or you extend it to a new use case, review it.
Getting it done
We carry out Data Protection Impact Assessments for organisations introducing AI and other new technology, including the screening exercise that tells you which tools need one in the first place.
If your AI use has grown faster than your governance, a data protection gap analysis is the sensible starting point, because it reviews processing, governance, security, cookies and PECR in one pass. For ongoing support, our outsourced DPO service gives you a named specialist to sign off this kind of decision, and data protection training for staff covers the people using these tools every day, which is usually where the risk starts.
Get in touch if you want a view on whether a specific tool needs a DPIA.
