Home › Answers › Data, privacy and GDPR
Do I need a DPIA to use AI?
Short answer
Sometimes. UK GDPR requires a data protection impact assessment (DPIA) when processing is likely to result in a high risk to people. The ICO lists AI as an "innovative technology", so you need one when AI use is combined with another risk factor, such as automated decisions about people or special category data. It's good practice for most AI projects.
When a DPIA is likely needed
| AI use | DPIA? |
|---|---|
| Drafting marketing posts with no personal data | Not usually |
| Pasting customer emails into a chatbot | Consider one; check the tool's data terms |
| AI call recording and transcription | Likely, especially with sensitive calls |
| AI screening of job applicants | Yes |
| AI decisions about customers' access to services | Yes |
| Health, biometric or children's data | Yes |
How to do a simple DPIA
- Describe what the AI tool does and what personal data goes in.
- Explain why you need it and your lawful basis.
- Identify risks: errors, bias, security, data sent abroad, training on your data.
- List safeguards: business plans, training switched off, human review, retention limits.
- Record the decision and review it when things change.
The ICO publishes a DPIA template.
Is a DPIA a legal requirement?
Yes, for high-risk processing under Article 35 of UK GDPR. If you can't reduce a high risk, you must consult the ICO before you start.
Related questions
Do sole traders need a DPIA?
The rule depends on risk, not size. A sole trader using AI on sensitive data still needs one.
Do I need an AI policy too?
It helps. See do I need an AI policy?
Sources
- ICO: when do we need to do a DPIA?
- ICO: data protection impact assessments
- ICO: guidance on AI and data protection
Checked 17 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.
More on data, privacy and gdpr
- Are AI detection tools accurate?
- Are AI tools secure for business?
- Are ChatGPT chats private? Can OpenAI read them?
- Are Microsoft Copilot chats private?
- Can AI agents be trusted?
- Can AI read my WhatsApp messages?
All data, privacy and gdpr answers · All answers · Guides · AI tools directory
Get one useful AI tool in your inbox each weekday
Free, plain English, five minutes to read. Unsubscribe any time.
See our privacy notice.