What is a DPIA? When a UK small business needs one (2026)

The short version

• A DPIA is a risk check you write down before you start, not a form you send anywhere. It describes what you plan to do with people’s data, whether you need to, what could go wrong for them, and what you’ll do about it.
• You must do one when the processing is "likely to result in a high risk" to people. Three kinds always count (big automated decisions about people, large-scale sensitive data, and large-scale monitoring of public places), and the regulator lists ten more.
• Using AI on people’s data is one of the ten. On its own it doesn’t automatically need a DPIA. Add one more risk factor, such as scoring or ranking people, health data or children, and the regulator says one is required.
• Most small businesses keeping ordinary customer and supplier records won’t need one, but the regulator expects you to write down why if you screened and decided not to.
• You only send it to the regulator if a high risk is left after you’ve reduced what you can. Then you must consult it before you start, and it says it will reply within eight weeks, or 14 in complex cases.
• The 2026 law changes left the duty as it was. The regulator is now the Information Commission, and its DPIA guidance is "under review", but the rule itself hasn’t moved.

What is a DPIA?

DPIA stands for data protection impact assessment. The duty comes from Article 35 of UK GDPR, which says: "Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data."

In plainer words: if you’re about to use people’s information in a way that could seriously harm them, you have to think it through, on paper, first. “The controller” is whoever decides why and how the data is used, which for a small business is usually the business itself.

The regulator’s own definition, on its page What is a DPIA?, is: "A DPIA is a process designed to help you systematically analyse, identify and minimise the data protection risks of a project or plan." It doesn’t expect perfection: "It does not have to eradicate all risk, but should help you minimise and determine whether or not the level of risk is acceptable in the circumstances, taking into account the benefits of what you want to achieve."

Nor does it have to be long. The same page says: "Conducting a DPIA does not have to be complex or time-consuming in every case, but there must be a level of rigour in proportion to the privacy risks arising." And there’s no official form: "There is no definitive DPIA template that you must follow."

The regulator here is the Information Commission, which replaced the Information Commissioner (the ICO) on 30 September 2026. We wrote about that change in our post on the data protection fee. Its website is still ico.org.uk, and its DPIA pages still say “ICO” throughout.

When is a DPIA required?

The test is whether the processing is "likely to result in a high risk to the rights and freedoms of natural persons". The law doesn’t define that, and the regulator says so on its page When do we need to do a DPIA?: "The UK GDPR doesn’t define ‘likely to result in high risk’." It describes the question as a screening test, looking for red flags, rather than a full judgement of the risk, which is what the DPIA itself is for.

Three kinds of processing always need one. Article 35(3) names them:

• Big automated decisions about people: "a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling", where the decisions "produce legal effects concerning the natural person or similarly significantly affect the natural person".
• Sensitive data on a large scale: "processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10". Special categories include health, ethnicity, religion, sexual orientation and biometric data used to identify people.
• Watching public places on a large scale: "a systematic monitoring of a publicly accessible area on a large scale".

“Large scale” matters for small firms. The regulator’s examples of large-scale processing include a hospital and a bank, and it adds: "Individual professionals processing patient or client data are not processing on a large scale." So a sole practitioner’s client notes don’t fall under the second case on their own.

The regulator lists ten more. Article 35(4) tells the regulator to publish a list of processing that needs a DPIA. Its list, on the page Examples of processing ‘likely to result in high risk’, puts a condition on five of the ten: they need a DPIA only when combined with one of the European risk criteria listed below. The other five carry no condition.

The "other criterion" comes from the European guidelines the regulator still uses. They give nine signs of likely high risk: evaluating or scoring people; automated decisions with legal or similarly significant effects; systematic monitoring; sensitive or highly personal data; large scale; matching or combining datasets; vulnerable people; new technology; and processing that stops people using a right, a service or a contract. The regulator’s rule of thumb: "In most cases, a combination of two of these factors indicates the need for a DPIA. However, this is not a strict rule."

Two details small businesses miss. First, your own staff can count as “vulnerable”, because they can’t easily say no to their employer: "One group who may count as vulnerable in this sense are employees." The regulator’s worked example is a sales firm whose company cars track where staff are, "allowing managers to monitor the movement and whereabouts of their employees at all times", which it says needs a DPIA. Second, if you’re in any doubt, the regulator’s answer is always the same: "If in any doubt, we would always recommend that you do a DPIA to ensure compliance and encourage best practice."

Using AI tools on people’s data: does that need a DPIA?

Often, yes. AI is the regulator’s first example of innovative technology. Its list says: "Innovative technology: processing involving the use of innovative technologies, or the novel application of existing technologies (including AI). A DPIA is required where this processing is combined with any of the criteria from the European guidelines." Its page on when you need one spells out what that means: "The ICO list of high-risk processing operations requires a DPIA if your processing involves innovative technology in combination with another criterion from the European guidelines (e.g. evaluation or scoring, or sensitive data)."

Here’s how that reads for a few everyday cases. This is our reading of the rule, not the regulator’s ruling on any of them:

• An AI tool that sorts or scores job applicants. AI plus evaluation or scoring: the regulator’s own example of the combination. A DPIA is required.
• An AI assistant reading customers’ health details, say in a clinic or a care business. AI plus sensitive data: required.
• An AI system that decides who gets credit, insurance or a service. That’s “denial of service” on the list, which needs a DPIA with no other factor at all.
• An AI tool that helps you draft replies to ordinary customer emails. AI on its own, with nothing else on the list, isn’t automatically a DPIA. Screen it against the nine criteria, and write down what you decided and why.

Two lines on the regulator’s pages make this lighter work than it sounds. "For new technologies, you may be able to use a DPIA done by the product developer to inform your own DPIA on your implementation plans." So ask your AI supplier for theirs. But: "You can outsource your DPIA, but you remain responsible for it."

We build AI tools and apps for businesses, so we have an interest in how this question is answered. We’ve tried to report what the law and the regulator say, and where a line is our own reading, we’ve said so.

What goes in a DPIA

Article 35(7) says "The assessment shall contain at least" four things:

• A description of what you plan to do, in the law’s words "a systematic description of the envisaged processing operations and the purposes of the processing", including "where applicable, the legitimate interest pursued by the controller".
• Whether it’s necessary: "an assessment of the necessity and proportionality of the processing operations in relation to the purposes".
• The risks to people: "an assessment of the risks to the rights and freedoms of data subjects".
• What you’ll do about them: "the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data".

If you rely on legitimate interest for the processing, you’ve probably already done part of the first item. Our post on legitimate interest under UK GDPR explains the legitimate interests assessment, the short note that weighs your interest against the people affected, which can feed straight into a DPIA.

The regulator’s page How do we do a DPIA? turns this into seven steps:

1. Identify the need for a DPIA (the screening above).
2. Describe the processing: how you collect, store, use and share the data, who sees it, which suppliers handle it, and how long you keep it.
3. Consider consultation: ask the people affected, or their representatives, unless there’s a good reason not to.
4. Assess necessity and proportionality: does the plan achieve the purpose, and is there a less intrusive way?
5. Identify and assess the risks to people, weighing how likely each harm is and how severe it would be.
6. Identify measures to reduce each risk, such as collecting less, keeping it for less time, or pseudonymising it.
7. Sign off and record the outcome, including any risk you’ve accepted.

Asking the people affected is in the law too. Article 35(9): "Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing". And it isn’t a one-off. Article 35(11) says the controller shall carry out a review "at least when there is a change of the risk represented by processing operations."

If you screen and decide you don’t need one, keep the reasoning. The regulator says: "You may be able to justify a decision not to carry out a DPIA if you are confident that the processing is nevertheless unlikely to result in a high risk, but you should document your reasons." It doesn’t have to be much: "This does not have to be a burdensome paperwork exercise." And: "For example, you could simply keep an annotated copy of the checklist."

Do you have to send your DPIA to the regulator?

Usually not. You keep it. You only have to go to the regulator if a high risk is left after your measures. Article 36(1): "The controller shall consult the Commission prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk."

The regulator’s page Do we need to consult the ICO? puts it more simply: "If your DPIA identified a high risk but you have done things to reduce the risk so it is no longer high, you need not consult us." If a high risk remains, though: "You cannot go ahead with the processing until you have consulted us." It says it will reply "within eight weeks of receipt of your DPIA. In complex cases, we can extend this to a maximum of 14 weeks."

Publishing your DPIA isn’t required, but the regulator encourages it: "To aid transparency and accountability, it is good practice to publish your DPIA." It says you can black out sensitive details or publish a summary.

What happens if you don’t do one

Failing to do a required DPIA is a breach of Article 35, and Article 83(4) sets the top fine for it at £8,700,000 or, for a business, 2% of its worldwide annual turnover if that is higher. The regulator’s own page puts it this way: "failure to carry out a DPIA when required may leave you open to enforcement action, including a fine of up to £8.7 million, or 2% global annual turnover if higher." Those are maximums, not typical fines. The more practical cost is being unable to show you thought it through if something goes wrong.

What changed in 2026, and what didn’t

• The duty is the same. We read Articles 35 and 36 as they stood on 27 October 2026, on the government’s legislation site. The only 2026 change to either is one word: “the Commissioner” became “the Commission” on 30 September 2026 (SI 2026/386 and SI 2026/1015). The site shows no changes to either article that are still waiting to be added.
• The guidance is "under review". Every one of the regulator’s DPIA pages opens with: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change."
• There’s no date for new DPIA guidance. That note points to the regulator’s plans for new and updated guidance. On 27 October 2026 we read all six of its topic pages and its codes of practice page. None lists any work on DPIAs. Its guidance on agentic AI (AI that takes actions for you) has a consultation "due to launch October 2026" and is due in spring 2027.
• The name hasn’t caught up yet. Four weeks after the change, the regulator’s pages still ask "Do we need to consult the ICO?", and its prior consultation page points to "appeals against the Information Commissioner". Nothing turns on it. The law says "the Commission", and the advice is the same.

So for now, follow the current guidance. If the regulator changes its list or its advice, a DPIA you’ve already done is a record you can update, not wasted work.

What argues the other way, and what we couldn’t check

• This isn’t legal advice. We’re not lawyers. “Likely to result in a high risk” is a judgement, and the regulator says that outside the listed cases "it’s up to you to decide". Where real money or vulnerable people are involved, get advice.
• The “two of nine” test is a rule of thumb. The regulator calls it "not a strict rule". One factor can be enough, and two don’t always mean high risk.
• We read the European guidelines through the regulator’s summary. The nine criteria come from the Article 29 Working Party’s guidelines, which we haven’t read in full. Where we quote the regulator’s summary of them, that is what we quote.
• There’s no “no DPIA needed” list. The law lets the regulator publish one (Article 35(5)), and it says: "We have the power to establish this type of list, but we have not done so yet." So nothing official tells you a common task is safe to skip.
• Plenty of guides on page one are written for somewhere else. When we searched “what is a dpia”, one of the guides on page one was a US data company’s, dated March 2025, and doesn’t mention UK GDPR or the UK regulator once. The EU’s Article 35 is close to ours, but the national lists differ, so check which country a guide is written for.

Sources, and what we checked

• UK GDPR on legislation.gov.uk, read from the site’s XML: Article 35, Article 36 and Article 83, all in their versions from 30 September 2026, with the amendment notes for each. Also the Data Protection Act 2018, section 157 for the fine levels.
• The regulator’s DPIA guidance, all six pages: the overview, What is a DPIA?, When do we need to do a DPIA?, How do we do a DPIA?, Do we need to consult the ICO? and Examples of processing likely to result in high risk.
• The regulator’s plans for new and updated guidance: the overview, all six topic pages and the codes of practice page.
• Google’s search suggestions for “what is a dpia” and “when is a dpia”, in British English.
• Every quotation above was checked word for word against the page it came from. Every page above was read on 27 October 2026, and again on 29 October 2026, the morning we published.