Do I Need a DPIA for My AI System? (GDPR Article 35 Guide)

Most AI systems that process personal data need a data protection impact assessment. Article 35 of the GDPR requires one where processing is "likely to result in a high risk to the rights and freedoms of natural persons", and AI systems usually meet several of the indicators of high risk at once.

In the UK, the ICO's list of processing that requires a DPIA includes "innovative technology", which it defines as including artificial intelligence, machine learning and deep learning. A DPIA is required where that processing is combined with any one of the other criteria in the European guidelines. Because the AI is itself the innovative technology, it does not count as one of those other criteria, but for most AI systems at least one of them applies.

Why AI systems usually meet the threshold

The European guidelines on DPIAs (WP248, endorsed by the European Data Protection Board and referred to in the ICO's guidance) set out nine criteria that indicate likely high risk. AI systems commonly meet several of them:

Innovative technology. The ICO names artificial intelligence as an example, and although this criterion does not require a DPIA on its own, combined with any one of the other criteria it does.

Evaluation, scoring and automated decisions. Where an AI system evaluates or scores people, or contributes to decisions about them, such as credit applications, fraud flags, insurance pricing, recruitment screening or content moderation, it meets the evaluation or scoring criterion, and where decisions are automated and produce legal or similarly significant effects, it also meets the separate automated decision-making criterion. Article 35(3)(a) requires a DPIA for systematic and extensive evaluation based on automated processing, including profiling, where decisions based on it produce legal or similarly significant effects.

Large-scale processing. A chatbot handling thousands of customer conversations each day, or a recommendation engine tracking behaviour across a platform, processes personal data on a large scale. Scale depends on the number of people affected, the volume and range of data, the duration of the processing and its geographic extent.

Systematic monitoring. Where an AI system tracks, profiles or monitors individuals, for example through behavioural analytics, usage patterns or location tracking, it is systematic monitoring.

A customer service chatbot typically meets the innovative technology and large-scale criteria, whereas a fraud detection system can meet all four.

Some processing requires a DPIA without any combination. The ICO's list includes decisions about a person's access to a product, service, opportunity or benefit that are based to any extent on automated decision-making, including profiling. An AI tool that screens job applicants, or scores customers for eligibility, therefore requires a DPIA on that ground alone.

What a DPIA for an AI system should cover

Generic DPIA templates were designed for databases and CRM systems, and AI systems differ from those because data passes through external APIs, is processed by models the organisation does not control, and produces outputs that affect people. A DPIA for an AI system should therefore address the following.

Every data flow. Map each stage, for example: the customer sends a message, your application receives it, it is sent to the model provider's API, it is processed on the provider's servers, the response is returned, and the conversation is logged and stored in your database. Each stage is a processing activity and should be documented.

The relationship with the AI provider. If you use ChatGPT, Claude or another external model, you are sending personal data to a processor. The DPIA should record who the provider is, where it processes data, whether it retains data or uses it for training, and what safeguards apply. A data processing agreement with the provider is required under Article 28, and although the major providers offer one, the organisation should confirm that it has been accepted.

International transfers. Requests to a US provider such as OpenAI involve a transfer of personal data outside the UK and EEA, which needs a lawful mechanism, usually the Standard Contractual Clauses or, where the provider is certified, the Data Privacy Framework. The DPIA should record the mechanism and the assessment of its adequacy. The ICO's guidance on international transfers sets out the requirements.

Decisions and human oversight. Where the AI makes or shapes decisions, even if a person formally approves them, the DPIA should document the decision logic, explain it in terms individuals can understand, and show that human review is meaningful.

Data minimisation. If a chatbot needs only the customer's question to respond, sending the account number, email address and purchase history as well breaches the minimisation principle, so data that is not needed should be removed before it is sent to the API.

Retention. Set a retention period for conversation logs, interaction records and outputs, record the justification, and delete the data when the period ends.

Training data. Fine-tuning a model on personal data, or indexing customer documents for retrieval, is processing, so the DPIA should cover the lawful basis for that use and the practical difficulty of removing personal data once it has influenced a model.

AI in recruitment

Recruitment is where the ICO has looked most closely at how employers assess AI. Its report Recruitment rewired, published on 31 March 2026, sets out findings from more than 30 employers that engaged with it voluntarily between March 2025 and January 2026.

Several of those employers had not identified that they needed a DPIA and had not completed one. Where DPIAs existed, many had a blank risk assessment or identified no risks, and most of those recorded no advice from the data protection officer and had been signed off despite being incomplete. Most described the third-party tool only briefly, without explaining how it worked, which decisions it was applied to, or whether its outputs made or supported those decisions.

The ICO also found that most employers believed the tools supported their decisions, while in practice many decisions were solely automated. In its example, a hiring manager looks closely at the candidates the tool rates green but only glances at those rated red before rejecting them. The ICO found that the manager had "rubber-stamped" those rejections, which made them solely automated decisions, so the safeguards in Article 22C of the UK GDPR applied. Under Article 22A, a decision is solely automated where there is no meaningful human involvement in taking it.

The ICO states that these findings come from voluntary engagement rather than an audit or investigation, and no employer has been fined as a result. It has written to the employers concerned with a date by which to improve, and 16 have confirmed that they will act on its recommendations. For any organisation using AI to assess candidates, the findings show what the ICO expects a DPIA to address: a description of how the tool works, a completed risk assessment, the DPO's advice, and whether human review applies to every candidate, including those the tool ranks lowest.

The consequences of not carrying one out

Failing to carry out a required DPIA can lead to a fine of up to £8.7 million or 2% of worldwide annual turnover, whichever is higher. In its February 2026 penalty against MediaLab.AI, the owner of Imgur, the ICO imposed £247,590 in total, of which £82,215 was for failing to carry out a DPIA under Article 35(1), alongside the penalty for the lawful basis infringements.

A DPIA also provides the record an organisation needs when something goes wrong, because after a breach, a complaint or a regulatory inquiry it shows that the risks were assessed and that reasonable steps were taken to reduce them. Without it, the organisation lacks the main record showing that it considered whether the processing was lawful.

Processing the data of Nigerian residents

If you process the personal data of Nigerian residents, the Nigeria Data Protection Act 2023 has its own DPIA requirements, broadly similar to the GDPR's. A Nigerian fintech using AI that also serves UK or EU customers is likely to need a DPIA under both regimes, although a single assessment can cover both, provided it assesses the processing against each set of criteria.

How to carry out the assessment

Use a template built for AI systems. The free AI DPIA Template on this page sets out the screening test, an assessment structured on the contents Article 35(7) requires, a risk register for the risks most common in AI systems, and checks drawn from the ICO's recruitment findings. The ICO's DPIA guidance remains the official reference on what the law requires.

Map the data flows before drafting, drawing on the developers' knowledge of where the data goes in practice, which may differ from the existing documentation.

Complete the DPIA before the system is deployed, because Article 35 requires the assessment before the processing begins, and changing a live system to address risks found afterwards is more costly and disruptive than designing for them.

Review the DPIA whenever the system changes, for example on a change of AI provider, a new data source or a change to retention. It should remain up to date for as long as the processing continues.

An AI DPIA draws on data protection law, AI architecture and risk management, and few organisations have one person who covers all three. If you are considering outside help, this guide explains what AI compliance consulting costs and what it should include.

---

Need the assessment carried out for your system? Start with a £500 scoping review, which sets out whether your AI system requires a DPIA, what it must cover and the gaps in your current documentation, with a written report within one week. To complete it yourself, use the free AI DPIA Template on this page.

Related reading: If the system makes decisions about individuals, consider the position from their side too: AI Rejected Your Job Application: Your Rights under UK Law, part of the AI and your rights theme.

The ICO's DPIA screening guidance and its Recruitment rewired report were checked on 5 October 2026, and the MediaLab.AI penalty notice of 4 February 2026 on 2 October 2026. This page is general information, not legal advice.