A DPIA for AI: when a UK SME needs one, and a template that passes.

UK GDPR requires a DPIA before processing that is likely to result in a high risk to individuals, and the ICO publishes screening criteria and a list of processing that always needs one. The criteria that AI use most often meets are: systematic and extensive profiling with significant effects; large-scale processing of special-category data or criminal-offence data; systematic monitoring of a publicly accessible place or of employees; innovative technology applied to personal data; and decisions about access to services made by automated means. The ICO’s own guidance on AI says that in most cases the use of AI to process personal data will trigger the requirement, because AI tends to involve one or more of those.

What does not need one: drafting a tender response, summarising a public document, writing marketing copy, analysing the firm’s own sales figures with no individuals identifiable. The test is whether personal data is processed and whether the processing is likely to be high risk, not whether AI is involved.

ICO screening criteria applied to common SME uses. Where in doubt, do a screening record and keep it.

The Act received Royal Assent on 19 June 2025 and, per the ICO’s guidance page updated in June 2026, all of its data protection provisions are now in force. On automated decisions it replaced Article 22 with Articles 22A to 22D, which, in the ICO’s words, open up the full range of lawful bases for significant automated decisions, including legitimate interests, provided the safeguards are in place: the individual is told, can make representations, can contest the decision, and can obtain human intervention. Decisions based on special-category data remain more restricted. For an SME using AI to screen, score or triage people, the practical effect is that the lawful basis is easier to find and the safeguards are not optional, and the DPIA is where both are recorded.

The Act also restated the transfer test for sending data outside the UK as whether protection would be “not materially lower”, and added a duty to have a data protection complaints procedure. Both belong in the template.

Seven parts, matching the ICO’s guidance on what a DPIA must contain. Replace the bracketed items; keep the headings so an auditor recognises the shape.

The risk register is where most DPIAs turn into paperwork, because they list generic risks and score them all as low. Do it from the process instead. Walk one real case through: an applicant, a patient, a customer. At each step ask what the AI sees, what it produces, what a person does with it, and what happens to that individual if it is wrong. The risks that fall out are specific, they have owners, and the measures against them are things the firm will actually do, which is what the ICO means by an assessment rather than a document.

Two risks are nearly always underrated. Inaccuracy acted on without checking, which is why the acceptance threshold and the review step belong in part three as numbers. And bias, which for any scoring of people means monitoring outcomes by protected characteristic and being able to show the monitoring, because the firm, not the vendor, answers for the result.

A four-page document that a new manager could read and understand what the system does, which data it touches, who decides, and what to do if it goes wrong. A processor recorded, a DPA on file, a retention setting made deliberately, a policy staff have read, and a review date in the calendar. It is less work than it sounds when it is done before the build, and far more than it sounds when it is done after a complaint. Our GDPR guides for Claude and ChatGPT cover the provider side; this template covers yours.