What a DPIA is, in plain terms
A DPIA is a structured record of how you assessed the risks a project poses to the people whose data it uses — written before you started. Article 35 of UK GDPR requires one where a type of processing, “in particular using new technologies”, is likely to result in a high risk to individuals’ rights and freedoms.
The regulator describes seven steps: identify the need for a DPIA, describe the processing, consider consultation, assess necessity and proportionality, identify and assess the risks, identify measures to mitigate them, and sign off and record the outcome (ICO, How do we do a DPIA?).
Two points are often missed. You can outsource a DPIA, but you remain responsible for it. And if a high risk remains after mitigation, you must consult the regulator before you go ahead.
Why it matters more now than it did in 2018
The regulator’s AI guidance says that in the vast majority of cases, using AI involves processing likely to result in high risk, which triggers the DPIA duty (ICO). A customer-service chatbot, AI screening of CVs, an assistant such as Copilot rolled out across mailboxes and files: each needs at least a screening, and many will need a full DPIA. Innovative technology is on the regulator’s own list of processing that requires one when combined with another factor — and with AI, another factor is rarely far away.
In July 2024 the ICO reprimanded Chelmer Valley High School in Essex for introducing facial recognition for canteen payments without first carrying out a DPIA. “A DPIA is required by law – it’s not a tick-box exercise,” said the ICO’s Head of Privacy Innovation (ICO, July 2024). Earlier, the ICO investigated whether Snap had adequately assessed the risks of its ‘My AI’ chatbot, issuing a preliminary enforcement notice in October 2023. The case closed in May 2024 only after Snap completed a more thorough risk assessment the regulator judged compliant (ICO, May 2024). Neither case needed a data breach. The question was simply whether the assessment existed, and whether it was good enough.
Failing in the DPIA duty falls within the standard maximum fine under UK GDPR: up to £8.7 million or 2% of worldwide annual turnover, whichever is higher (Article 83(4)). A reprimand, like the school’s, is published. And re-engineering a live system to fix what a DPIA would have caught costs far more than designing it right the first time.
Article 35 remains in force after the Data (Use and Access) Act 2025, and the regulator has said its DPIA guidance is under review as a result. On 30 September 2026 the Information Commission took over the ICO’s functions, with the same role and powers (GOV.UK). Regulations in force since 12 May 2026 require the regulator to produce a statutory code of practice on AI and automated decision-making, expected in 2027 (Arnold & Porter). People affected by automated decisions have the right to be told, to obtain meaningful human review and to challenge the outcome — and a DPIA is where you show how you meet that.
Procurement teams increasingly want evidence of practice — risk assessments, approval records, training — rather than policies alone, as one industry commentary put it this summer (Business Reporter, June 2026). A current, evidence-backed DPIA is often the fastest answer to a due-diligence questionnaire about AI.
When you need one
UK GDPR always requires a DPIA for three types of processing: systematic and extensive profiling with significant effects on people; large-scale use of special category or criminal offence data; and large-scale, systematic monitoring of publicly accessible areas.
The regulator adds its own list. It covers innovative technology including AI, decisions that deny people a service or opportunity, large-scale profiling, biometric and genetic data, data matching, “invisible” processing of data not collected from the person, tracking, targeting children or other vulnerable people, and processing where a breach could cause physical harm. Some apply on their own; others when combined with another factor (ICO, When do we need to do a DPIA?). The regulator’s own advice for borderline cases is short: “If in any doubt, we would always recommend that you do a DPIA.”
What separates a DPIA that holds up from one that doesn’t
A weak DPIA is written after the decision has been made. It describes controls nobody checked, its actions say “improve security”, and once filed it is never opened again.
A DPIA that holds up is started early enough to change the design. It maps where the data actually goes, including suppliers and transfers outside the UK. It scores risks to people for likelihood and severity, not only risks to the business. It checks the evidence behind each control — the MFA setting, the log, the supplier contract — rather than accepting the answer. Every action has an owner, a deadline and the evidence that will close it. Residual risk is recorded honestly, and the regulator is consulted when it is still high. And it names the events that will trigger a review: a new system, a new supplier, an incident, a change in the law.
That is simply how an auditor thinks, and it is why we built our DPIA & Privacy Risk Assurance service around evidence rather than templates.
Five questions to ask before your next AI or data project
- What personal data will it touch, and where will that data go — including suppliers and any transfer outside the UK?
- Will it make or shape decisions about people, and is a person meaningfully involved?
- Could anyone be treated unfairly, or harmed, if it gets something wrong or the data leaks?
- Can we show, not just say, that our access controls, logging and supplier terms work?
- Who signs off the remaining risk, and when will we look at it again?
If any answer is “not sure”, start with a screening. Our free Do I need a DPIA? check gives an indicative answer in about three minutes, and nothing you enter leaves your browser.
This article is general information, not legal advice. Facts were checked against the sources linked above on 27 October 2026; the regulator’s DPIA guidance is under review following the Data (Use and Access) Act, so check the current guidance before relying on any detail. VisionXY7 Ltd prepares and evidences DPIAs with the organisations responsible for them; it is not a law firm.