A DPIA for an AI tool: when and how

Part of the guide Does your UK business need an AI policy, and what goes in it?

Does every AI tool need a DPIA?

No. Assess the planned use, rather than deciding from the product name. A DPIA is a way to work through the privacy risks of that use and how to address them. If you decide the use does not involve high-risk processing, the ICO says to record how you reached that view.

This applies to the use you are assessing, whether your firm builds the AI or buys an existing tool. If you have appointed a data protection officer, ask for their advice when carrying out the DPIA.

The ICO’s AI guidance is under review after the UK’s Data (Use and Access) Act. The high-risk test above is also set out in the UK GDPR text.

Begin with the planned use

Describe the use What personal data will the tool handle, and what will it do with it?
Assess the risk Could that use pose a high risk to people’s rights and freedoms?
Record the decision Complete a DPIA before high-risk processing. If you decide one is not needed, keep the reasons.

Assess the project before processing starts. The decision rests on its likely risk to people, rather than the AI label.

What should an AI DPIA record?

The ICO’s process starts with the need for an assessment, the planned use of data, consultation and whether the use is necessary and proportionate. It then moves to risks, safeguards and a recorded decision.

In plain terms, explain what you want to do, why that is reasonable and how you will protect people. The table turns those steps into prompts for the project team.

Prompts for the assessment
Part of the assessment	What to write down
The intended use	How data is collected, stored, used, shared and kept secure.
The reason for using data	Why the use is needed, its lawful basis and how people will be told.
Other ways to do the job	Less risky options that could achieve the same purpose, and why they were not chosen.
People’s views	Who was consulted, what they said, or why consultation was not appropriate.
Human involvement	Who checks decisions, and when they do it.
Possible harm	What could happen to people, how likely it is and how serious it could be.
Safeguards and the decision	What will reduce the risks, what remains and the recorded outcome.

How do you make the risk assessment useful?

Look at both the chance of harm and how serious it could be. The ICO says risk assessment needs both. A rare but serious harm should not disappear behind a simple “unlikely” label.

For a staff tool, useful questions might be: could it reveal someone’s private details, or could an inaccurate result affect how they are treated? These are example prompts. The project team still needs to assess the actual data and use.

Possible safeguards include collecting less data, keeping it for less time, narrowing what the tool does, adding security measures and training staff. Record which measures address each risk, then assess what remains.

Can you use the supplier’s assessment or a template?

Use supplier information to explain the tool, but assess your own use. The ICO allows technical material such as a supplier’s data-flow diagram to help illustrate the assessment. It warns against copying large sections of the supplier’s material.

The ICO offers a sample DPIA template. You can use another format if it covers the key parts of the process. The screenshot shows the template link on the ICO’s guidance page.

ICO guidance showing its sample DPIA template link and explaining that other suitable formats are allowed. — This text-only excerpt shows the sample template link in “How do we do a DPIA?”. The template is optional. A different format or project-management method can be used if it covers the key elements. The page also points readers making their own template to the criteria for an acceptable DPIA. The source link below opens the guidance page.

Information Commission’s Office, How do we do a DPIA?, publication date not displayed in the article. Licensed under the Open Government Licence v3.0. Captured 8 October 2026. View full size · Image licence

Who signs it off, and what happens next?

You can bring in help to carry out the DPIA, but your organisation remains responsible for it. Where a data protection officer has been appointed, seek their advice. Decide who will own the assessment and act on its findings.

Put the agreed actions into the project plan and name the people responsible. Keep the assessment under review. A substantial change to what the tool does, the data or the purpose may mean doing it again.

If the assessment shows high risk that you cannot sufficiently reduce, consult the ICO before starting the processing. Signing off the document does not replace that step.

You can outsource your DPIA, but you remain responsible for it.

What to do

Describe the planned data use before it starts.
Assess likely high risk and record the decision.
Seek your data protection officer’s advice if you have one.
Put safeguards and named actions into the project plan.
Keep the assessment up to date as the use changes.

Common questions

Can we do the DPIA after launching the tool?

Where a DPIA is required, UK GDPR requires it before processing begins. The ICO recommends starting early, alongside planning and development.

Does every firm need an outside consultant to do it?

The ICO allows a DPIA to be outsourced, but the organisation keeps responsibility. If a data protection officer has been appointed, their advice must be sought. The assessment should be owned by your firm even when someone else helps write it.

Where next

Sources

This is an independent editorial guide, not legal advice.