Using AI in Your Business, Here's When the Law Expects a DPIA

Most UK businesses now use AI in some form. A chatbot on the website, a tool that screens CVs, a system that scores customer risk, a copilot pulling from company records. What many owners have not clocked is that once personal data is involved, the AI project sits inside a regime that has been in force since 2018. Under the UK GDPR, some of that processing is only lawful if the business has completed a data protection impact assessment first. Skip it, and the processing itself can be unlawful, regardless of how good the tool is.

This guide explains what a data protection impact assessment is, when the law actually requires one, why AI use almost always crosses the line, and where UK businesses are getting caught out in 2026.

What a data protection impact assessment is under UK law

A data protection impact assessment, or DPIA, is a documented risk assessment. Article 35 of the UK GDPR requires it before you start processing personal data in a way that is likely to result in a high risk to individuals.

Three things matter about that definition.

• It is done before processing starts, not after go-live.

• It is a risk assessment, not a form. The point is to identify what could go wrong for the people whose data is involved and to design the processing so those risks are reduced.

• It is a living document. If the tool, the data, or the purpose changes, the DPIA has to be updated.

The ICO expects the controller (the business deciding why and how personal data is used) to sign the DPIA off. If a Data Protection Officer is in place, they review it. For a plain-English walk through of the wider duties that sit around this, see our AI governance service page.

When a data protection impact assessment is legally required

Article 35(3) sets out three headline triggers. A DPIA is required if the processing involves:

• Systematic and extensive evaluation of people based on automated processing, including profiling, where decisions have legal or similarly significant effects.

• Large-scale processing of special category data (health, biometrics, ethnicity, political views and so on) or criminal offence data.

• Systematic monitoring of publicly accessible areas on a large scale.

Those are the statutory examples. The ICO adds a longer list of high-risk indicators, drawn from earlier European guidance, which are now the working test in the UK. There are nine of them.

• Evaluation or scoring, including profiling and prediction.

• Automated decision-making with legal or similarly significant effect.

• Systematic monitoring.

• Sensitive data or data of a highly personal nature.

• Data processed on a large scale.

• Matching or combining datasets.

• Data about vulnerable people, including staff, children and patients.

• Innovative use of new technology.

• Processing that prevents someone from exercising a right or using a service.

The working rule from the ICO is that if the processing meets two or more of these indicators, a DPIA is required. In some cases, meeting only one is enough on its own, and using a new technology is one of them.

Why AI use almost always crosses the line

AI use typically hits several of those indicators at once. That is the point regulators, including the ICO, have made repeatedly since 2023.

• AI is a new technology by any reasonable reading.

• Many AI use cases score, rank or profile people. CV shortlisting, credit decisions, fraud flags, customer segmentation.

• Training and running AI models often involves large-scale data.

• The logic can be opaque, which raises risks around transparency and fairness.

That combination is why Osborne Clarke's 2026 note, drawing on ICO guidance, put it bluntly: in the vast majority of cases, using AI to process personal data will trigger the legal requirement to run a DPIA. If AI is being used to make or support a decision about a person, the safe assumption is that a data protection impact assessment is required.

A few real examples of what tends to cross the threshold.

• An HR team plugging in a CV screening tool. Automated evaluation, staff records, new technology.

• A customer service chatbot fine-tuned on customer emails. Large-scale processing, new technology, potentially special category content.

• A biometric time and attendance system. Special category data by definition.

• A generative AI copilot pulling from internal HR, finance or customer files. Innovative use, large-scale, potentially sensitive data.

The pattern is consistent. If AI is being used to make or support a decision about a person, a data protection impact assessment should be treated as the default position, not the exception.

What has to go into a data protection impact assessment

Article 35 sets out four elements the DPIA has to cover.

• A systematic description of the processing and its purposes.

• An assessment of whether the processing is necessary and proportionate.

• An assessment of the risks to the rights and freedoms of individuals.

• The measures planned to address those risks and demonstrate compliance.

Those elements should be written for a reader. If someone at the ICO opens the document in twelve months, they should be able to see what the processing does, why it was needed, what risks were identified, and what was done about them. A one-page checklist with green ticks does not meet the standard.

Where residual risk remains high after mitigation, Article 36 requires the business to consult the ICO before going live. In practice this is rare, but it is not optional when it applies.

Common mistakes business owners make

Four patterns show up again and again in enforcement notes and practitioner writing.

• Relying on the AI vendor's DPIA. A supplier's assessment covers the supplier's role. The customer is the controller and needs its own DPIA covering its specific use.

• Running one DPIA for the whole tool. The UK GDPR attaches the high-risk test to the processing activity, not the system. If the same tool is used for three different purposes, that is three processing activities and, in most cases, three DPIAs.

• Writing the DPIA after go-live to tick the box. The legal requirement is that the DPIA is done before processing starts.

• Assuming small scale means low risk. Scale is one factor of nine. Sensitive data, profiling or new technology can trigger the duty on their own.

What has changed in 2026

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and the main changes commenced on 5 February 2026. It replaced Article 22 with new Articles 22A to 22D, narrowing the automated decision-making regime so that the tightest rules apply where decisions rely wholly or partly on special category data.

Article 35 was not repealed. The DPIA duty is unchanged. If anything, the ICO has signalled a firmer enforcement posture on AI processing, and its final guidance on the new Article 22A to 22D regime is expected in winter 2026.

Recent enforcement gives a sense of the direction of travel.

• In July 2024 the ICO reprimanded Chelmer Valley High School for introducing facial recognition for canteen payments without a DPIA and without consulting its DPO.

• The Clearview AI case was remitted to the First-tier Tribunal on 6 October 2025 after the Upper Tribunal confirmed the ICO's jurisdiction to issue enforcement notices.

• In February 2026 the ICO fined Reddit £14.47m for failures in processing children's personal data, a public signal that the regulator is prepared to use the higher end of the penalty range.

The fine ceiling under the UK GDPR is £17.5m or 4% of global annual turnover, whichever is higher. For DPIA-specific breaches under Article 83(4), the ceiling is £8.7m or 2% of turnover.

What to check this quarter

If AI is being used, procured or planned in the business, three practical steps will move things forward.

• List every AI use, purpose by purpose, not tool by tool. One tool with three uses is three assessments.

• Screen each purpose against the nine ICO indicators. If two or more apply, a DPIA is required. If one applies and it is new technology or profiling, the same conclusion usually follows.

• Get each DPIA reviewed by a Data Protection Officer, or a specialist, before the processing goes live. That is the point at which risks can still be designed out cheaply.

If you would like a specialist view on where your AI use sits against the ICO's expectations, book a 20-minute call with Hyplon.

Frequently Asked Questions

Do I need a DPIA if I only use ChatGPT for internal drafting?

If no personal data goes into the tool and no personal data comes out, no. If staff paste customer emails, CVs, or client notes into it, the answer changes. That is processing of personal data using a new technology, and a DPIA is very likely required.

Is my AI supplier's DPIA enough?

No. The supplier's assessment covers its role. As the controller, the business still needs a DPIA covering its own purpose and use.

What happens if I've already gone live without one?

Stop and assess. The processing may be unlawful. A DPIA can and should still be completed, and material risks should be addressed before continuing. Document the timeline honestly.

How long does a DPIA usually take?

For a well-scoped AI use case with cooperative stakeholders, two to four weeks is a realistic range. Complex or multi-vendor projects take longer.

What is the fine for skipping one?

Up to £8.7m or 2% of global annual turnover under Article 83(4) UK GDPR. Wider breaches connected to the same processing can attract the higher ceiling of £17.5m or 4%