Do you need a DPIA to use AI?

Sometimes, but probably less often than you fear: there's no exemption for small businesses, yet most everyday uses of AI in a small firm, such as drafting emails or summarising your own notes, don't on their own require a DPIA. The uses that clearly do are things like screening job applicants, profiling customers at scale, face or voice recognition, and anything involving health or other sensitive data.

A DPIA, or Data Protection Impact Assessment, is a written check you do before you start using people's personal information in a way that could put them at risk. Think of it as a risk assessment, like the one you'd do before a building job, but for people's data rather than their safety.

We're not data protection advisers, so this article explains what the regulator's own guidance says rather than giving advice on your situation. If you're unsure, the Information Commissioner's Office (ICO), the UK's data protection regulator, is the place to check. Since 30 September 2026 the regulator has formally been the Information Commission, but it still goes by the ICO.

Why it sounds as if every use of AI needs one

The ICO's guidance on AI says this: "In the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk to individuals' rights and freedoms, and will therefore trigger the legal requirement for you to undertake a DPIA."

"Processing" just means doing anything with personal information: collecting it, storing it, reading it, or feeding it into a tool.

There's also no small-business exemption. The separate duty to keep a record of your processing lets organisations under 250 staff off in some circumstances, under Article 30(5) of the UK GDPR. But Article 35, which creates the DPIA duty, has no equivalent.

That can read like a reason to worry. It doesn't need to be, because the test is narrower than that sentence suggests, and the ICO's own list of examples treats AI differently, as the next sections explain.

The test is a quick screening, not a full risk assessment

Article 35(1) says you must do a DPIA before processing that is "likely to result in a high risk to the rights and freedoms of natural persons". The ICO is clear that this doesn't ask you to judge whether your project really is dangerous. In its words, "the question is a more high-level screening test: are there features which point to the potential for high risk?"

It works a bit like a doctor's checklist of warning signs. You aren't diagnosing anything; you're seeing whether any of the signs are present.

Article 35(3) names three types of processing that always need one:

• systematic and extensive automated evaluation of people, where decisions with legal or similarly significant effects are based on it
• large-scale processing of special category data (the more sensitive kinds, such as health, ethnicity or religion) or criminal offence data
• systematic monitoring of a publicly accessible area on a large scale

The ICO then publishes ten more examples under Article 35(4). Some need a DPIA on their own; others only when combined with something else.

Underneath those sit nine warning signs from guidelines written by the Article 29 Working Party, the group of European data protection regulators that existed before the GDPR, which the ICO still points to:

• evaluating or scoring people
• automated decision-making with a significant effect
• systematic monitoring
• sensitive or highly personal data
• large scale
• matching or combining datasets
• vulnerable people
• innovative technology
• stopping someone using a right or a service

The ICO's rule of thumb is that two of these together point to needing a DPIA, though it says plainly that this isn't a strict rule.

AI counts as one warning sign, and usually needs a second

This is the key point for a small business, and it's where the ICO's own guidance pulls in two directions.

On the ICO's Article 35(4) list, "innovative technology" expressly includes artificial intelligence, machine learning and deep learning. But the ICO's wording there is that a DPIA is required "when combined with any other criterion".

So on that list, using AI is one warning sign. On its own, for most ordinary uses, it doesn't require a DPIA. What matters is whether something else sits alongside it. That's a narrower reading than the "vast majority of cases" line in the AI guidance quoted above, and both are the ICO's own words. If you're relying on the narrower one, it's worth knowing the broader one exists.

Summarising your own meeting notes almost certainly doesn't add a second warning sign. Nor does drafting a reply to a supplier, or writing first-draft marketing copy. In each case there's no scoring of a person, no monitoring, no large scale and no sensitive data. Often there's no personal data at all, in which case Article 35 doesn't apply in the first place.

If you'd like AI set up so it only sees the information each job actually needs, and personal details stay out of it where they aren't needed, we're happy to do that part for you.

One thing that catches people out: the ICO treats employees as potentially vulnerable, because the power imbalance at work means they can't freely object to what their employer does with their data. So AI used on your own staff brings in a second warning sign more easily than AI used on your own admin. Transcribing a routine team meeting isn't the same question as transcribing a grievance hearing.

The uses that clearly do need one

Automated screening or ranking of job applicants. This is the clearest example. It falls under Article 35(3)(a), and separately under the ICO's "denial of service" heading, which covers decisions about a person's access to "a product, service, opportunity or benefit which are based to any extent on automated decision-making". Note "to any extent". The ICO's 2024 work on AI recruitment tools puts the DPIA first among its questions and says to do it when you're choosing the tool. In March 2026 it told employers using automated hiring decisions to test for bias, be open about it, and explain how to challenge a decision.

Profiling customers at any real scale. Profiling means using data to build a picture of someone, such as their likely spending or interests. Profiling individuals on a large scale is on the ICO's list without needing a second warning sign, and the ICO gives "application of AI to existing process" as an example.

Biometrics. Face or voice recognition for door entry, identity checks or clocking in.

Special category data. Health, ethnicity, religion, trade union membership, biometric identification, criminal offence data, and anything aimed at children.

What a DPIA has to contain is shorter than you'd expect

Article 35(7) sets out four things a DPIA must include: a systematic description of the processing and its purposes, an assessment of whether it's necessary and proportionate, an assessment of the risks to people, and the steps you plan to take to deal with those risks. If you have a Data Protection Officer, the person formally responsible for overseeing how your organisation handles personal data, you must ask for their advice, and where appropriate the views of the people whose data it is.

The ICO's seven-step process fills that out, and it publishes a template you can use if it helps. Its own position is that a DPIA "does not need to be a time-consuming process in every case".

The other half is what you do when the answer is no. The ICO asks you to write that decision down too, and says it doesn't have to be a burden: "you could simply keep an annotated copy of the checklist." For many small businesses, that's the realistic outcome: a short note and a saved file.

What could happen if you should have done one and didn't

The ICO's own statement is that failing to carry out a DPIA when required "may leave you open to enforcement action, including a fine of up to £8.7 million, or 2% global annual turnover if higher".

That's a maximum, and it's worth keeping in proportion. The more everyday concern is that a DPIA is one of the things likely to be asked for if a complaint or a data breach brings the regulator's attention to your business, and not having one makes your position harder to explain.

There's also a timing point that can affect your plans. If your DPIA finds a high risk remaining that you can't reduce, Article 36 requires you to consult the ICO before you start. The ICO has up to eight weeks to reply, which it can extend by a further six. That's something to build into your timetable, not just paperwork.

The law has changed and the guidance is still catching up

This is worth knowing if you're reading anything older. The Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D, fully in force from 5 February 2026, and the ICO confirmed on 19 June 2026 that all the Act's data protection provisions are now live.

In practice, decisions made entirely by a computer that significantly affect someone are no longer limited to a narrow set of legal grounds. "Legitimate interests", meaning a genuine business reason that's balanced against the person's interests, is now potentially available. But Article 22C requires four safeguards: tell the person, let them make representations, let them get a human to step in, and let them challenge the decision. Special category data stays restricted under Article 22B.

The awkward part is that the ICO's guidance on this is still in draft. It consulted between 31 March and 29 May 2026 and lists the final version as due in Winter 2026. Every page of its DPIA guidance currently carries a notice saying it's under review because of the Act. Article 35 itself wasn't changed, so the DPIA test above is stable, but for the detail on automated decisions, check the ICO's pages rather than a summary like this one.

What to do next

If your AI use is drafting, summarising and searching your own material, the ICO's approach is to note that you screened it and why you concluded no DPIA was needed, and keep that note.

If you're about to buy something that screens applicants, scores customers, recognises faces or handles health data, the ICO's guidance is to do the DPIA before you sign, because the point is that it can change what you buy.

If you're somewhere in between, such as AI used on your staff or on a few hundred customer records, the ICO's own advice is that if you're in any doubt, do one.

Once you've made those decisions, if you'd like help with the AI side, whether that's setting up a tool for drafting and summarising or connecting it to your other systems, we're happy to take that on. Our article on whether AI trains on your business data covers another question worth asking before you choose a tool.

Sources

• Article 30, UK GDPR: Records of processing activities - legislation.gov.uk
• Article 35, UK GDPR: Data protection impact assessment - legislation.gov.uk
• Article 36, UK GDPR: Prior consultation - legislation.gov.uk
• Articles 22A to 22C, UK GDPR: automated processing and significant decisions - legislation.gov.uk
• When do we need to do a DPIA? - ICO
• Examples of processing 'likely to result in high risk' - ICO
• What is a DPIA? - ICO
• How do we do a DPIA? - ICO
• What are the accountability and governance implications of AI? - ICO
• Automated decision-making, including profiling (draft guidance) - ICO
• The Data Use and Access Act 2025 - what does it mean for organisations? - ICO
• ICO governance changes confirmed for 30 September 2026 - ICO
• Thinking of using AI to assist recruitment? Our key data protection considerations - ICO
• Automated decisions can streamline the hiring process - with the right safeguards in place - ICO

Checked on 20 October 2026. The ICO's DPIA and AI guidance is under review because of the Data (Use and Access) Act 2025 and the final automated decision-making guidance is still to come, so check the ICO pages rather than trusting the date on this one.