DPIA & Privacy Risk Assurance · Step 2 · Govern
A DPIA you can defend, with the evidence behind it.
UK GDPR requires a data protection impact assessment before any processing that is likely to result in a high risk to people. The UK regulator says AI use usually meets that test. We prepare your DPIA with you, check the evidence behind every control, and come back to verify that the fixes were made.
Screening from £297 · one DPIA from £1,350 · AI DPIA from £1,950 · all excl. VAT
Why it matters
A legal duty that AI has made routine
A DPIA is not paperwork for its own sake. It is the record that shows you thought about the people affected before you started — and the regulator asks for it.
Required by law
UK GDPR Article 35 requires a DPIA before processing that is likely to result in a high risk to individuals, “in particular using new technologies”.
Source: UK GDPR, Article 35AI usually qualifies
The regulator’s AI guidance says that in the vast majority of cases, using AI involves processing likely to result in high risk — which triggers the DPIA duty.
Source: ICO guidance on AI and data protectionUp to £8.7m or 2%
Failing in the DPIA duty falls in the standard maximum fine: up to £8.7 million or 2% of worldwide annual turnover, whichever is higher.
Source: UK GDPR, Article 83(4)The method
Three phases, twelve steps
The twelve steps cover all seven DPIA steps the UK regulator describes. The highlighted steps are what turn a completed template into assurance.
Phase 1
Understand
- Screening and scopeIs a DPIA legally required, what is in scope, who is affected?Regulator step 1 · Screening & Scope Statement
- Data-flow mappingWhere personal data comes from, where it goes, who processes it, how long it is kept.Regulator step 2
- ConsultationDPO, IT, security, the project owner, suppliers and, where appropriate, the people affected.Regulator step 3
- Necessity and proportionalityLawful basis, data minimisation, retention, transparency and individuals’ rights.Regulator step 4
Phase 2
Assess & treat
- Privacy risk scoringRisks to individuals, scored for likelihood and severity, in a formal register.Regulator step 5
- Evidence of controlsEncryption, access, MFA, logging, backups, suppliers, training: we ask to see the evidence, not just the answer.Regulator step 6 · Lead Auditor method
- Risk treatment planEvery action has a required control, an owner, a deadline and the evidence that will close it.Regulator step 6
- Residual riskRisk recalculated after controls. If a high risk remains, the regulator must be consulted before you proceed.Regulator step 6 · prior consultation
Phase 3
Assure & sustain
- Quality reviewThe evidence, scores and conclusions are challenged before anything is signed.Beyond the regulator’s steps
- Report and sign-offThe DPIA Assurance Pack, ready for your DPO or management to approve and record.Regulator step 7
- Implementation verificationWe come back and check the agreed controls are in place: finding, action, evidence, closure.Beyond the regulator’s steps
- Continuous reviewTriggers for a re-assessment: a new system, AI, a new supplier, a transfer abroad, an incident or a change in the law.The regulator says DPIAs must be kept under review
The difference
Why it is stronger than a template
| A typical DPIA service | VisionXY7 DPIA & Privacy Risk Assurance | |
|---|---|---|
| Controls | Asks “do you have access controls?” | Checks the evidence: MFA settings, logs, backups, supplier contracts |
| Actions | “Improve security” | Each action has an owner, a deadline and the evidence required |
| After the report | Ends at delivery | A verification visit; every finding closed with evidence |
| When things change | Nothing defined | Review triggers and an annual review |
| AI systems | Generic questions | An AI risk layer, linked to ISO/IEC 42001 and EU AI Act work |
What you receive
The DPIA Assurance Pack
Not a completed template, but a set of documents your DPO, board, auditor or a buyer’s due-diligence team can follow from question to conclusion.
You own every document. The pack is written to the structure the regulator expects, so it can sit in your records of processing and be produced on request.
Twelve parts
- 1 Executive summary · 2 Screening & scope statement
- 3 DPIA record · 4 Data-flow map
- 5 Consultation record · 6 Necessity, proportionality & compliance
- 7 Privacy risk register · 8 Control & evidence assessment
- 9 Remediation action plan · 10 Residual-risk assessment
- 11 Management or DPO sign-off · 12 Review date and triggers
Packages
From a three-minute check to an organisation-wide framework
Every price starts from a stated minimum and excludes VAT. Complex processing, several systems or on-site work are scoped in writing before you commit.
Do I need a DPIA?
Twelve questions mapped to the regulator’s high-risk criteria; an instant answer on screen. Nothing you enter is sent anywhere.
DPIA Screening
Two focused hours on one processing activity; a written Screening & Scope Statement that records whether a DPIA is required and why.
Safe AI Starter
For small businesses: an AI use policy, DPIA screening of the tools you use, and plain do’s and don’ts for staff.
DPIA Assessment
One processing activity, steps 1–8 and 10: the DPIA record, data-flow map, privacy risk register, action plan and sign-off page.
AI DPIA
As the DPIA Assessment, for one AI system, plus the AI risk layer: accuracy and bias, explainability, automated decisions and human review, training data, model and vendor terms.
DPIA Assurance
Steps 1–11: the full twelve-part DPIA Assurance Pack, a quality review before sign-off, and a verification visit about 90 days later.
DPIA Review & re-verification
Step 12: an annual or trigger-based review of an existing DPIA, re-checking the evidence and updating the residual risk.
DPIA Framework Build
Organisation-wide: your DPIA procedure, screening tool, template, register and a workshop so your team can run DPIAs themselves.
Need AI governance beyond one system? See the AI Safety & Assurance Programme or the enterprise engagement ladder.
AI DPIA
The extra layer an AI system needs
An AI tool raises questions a standard DPIA template does not ask. The AI DPIA adds them, using the same evidence-first method.
It sits naturally beside ISO/IEC 42001 readiness and the EU AI Act Applicability Assessment, so the same work counts towards all three.
What it adds
- Accuracy and bias: who could be treated unfairly, and how you would know.
- Explainability, automated decisions and meaningful human review.
- Training data, prompts and outputs: what is kept, where, and for how long.
- Model and vendor terms, sub-processors and transfers outside the UK.
- Data leaking through prompts and staff use of public AI tools.
The boundary
The ICO allows a DPIA to be outsourced, but the organisation doing the processing remains responsible for it. VisionXY7 prepares and evidences your DPIA and you make the decision. If a high risk remains after mitigation, you must consult the regulator — since 30 September 2026 the Information Commission, which took over from the ICO — before going ahead; we prepare that consultation pack with you. VisionXY7 is not a law firm and does not give legal advice.
Questions
DPIA questions, answered
When is a DPIA legally required in the UK?
UK GDPR requires a DPIA before any processing that is likely to result in a high risk to individuals. It is always required for systematic and extensive profiling with significant effects, large-scale use of special category or criminal offence data, and large-scale monitoring of public areas. The regulator adds its own list, which includes innovative technology such as AI, data matching, biometrics, tracking and targeting children.
Do we need a DPIA for an AI tool such as a chatbot or Copilot?
Often, yes. The regulator's AI guidance says that in the vast majority of cases using AI involves processing likely to result in high risk, which triggers the DPIA duty. Whether your specific use does depends on the data, the people affected and the decisions involved. The free DPIA check gives an indicative answer in about three minutes, and a DPIA Screening from £297 records the decision formally.
Can we outsource our DPIA to VisionXY7?
Yes. The regulator allows a DPIA to be outsourced, but your organisation remains responsible for it and makes the final decision. VisionXY7 prepares the DPIA with you, checks the evidence behind your controls, and produces a sign-off pack for your DPO or management to approve.
Did the Data (Use and Access) Act remove DPIAs?
No. Article 35 of UK GDPR, which sets the DPIA duty, remains in force. The regulator has said its DPIA guidance is under review following the Data (Use and Access) Act, so VisionXY7 dates its method and re-checks it whenever that guidance changes.
How long does a DPIA take?
A DPIA Screening takes two focused hours. The time a full DPIA needs depends on how complex the processing is and how quickly the evidence and the right people are available, so the scope and timetable are agreed in writing before work starts. DPIA Assurance adds a quality review and a verification visit around 90 days after sign-off.
Next step
Find out in three minutes whether you need one.
Take the free check, or book a DPIA Screening and leave with a written answer. Once the controls are in place, step 3 is building the automation safely.