In short
An AI DPIA is a data protection impact assessment for an AI tool or use case. UK GDPR requires one before processing that is likely to result in a high risk to people, particularly with new technologies. It describes the processing, tests necessity and proportionality, assesses risks and records the measures that reduce them.
Get a quote for AI usage evidence for DPIAs
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What an AI DPIA is
A data protection impact assessment (DPIA) is a structured assessment of a planned use of personal data, carried out before the processing begins. Article 35 of UK GDPR requires one where a type of processing, "in particular using new technologies", is likely to result in a high risk to the rights and freedoms of individuals.
An AI DPIA applies that process to an AI tool or AI use case: an assistant staff use to draft client letters, a coding assistant with access to a customer database, an AI note-taker in meetings, or an agent that can read and act on a shared mailbox. It asks what personal data the AI will touch, why, what could go wrong for the people concerned, and what you will do about it.
A DPIA is not the same as an AI risk assessment. The risk assessment looks at an AI tool from the organisation's point of view (security, confidentiality, contracts, reliability). The DPIA focuses on risks to individuals whose personal data is processed. In practice, one feeds the other, and many organisations run them together.
When is a DPIA required for AI?
UK GDPR says a DPIA is required where processing is likely to result in a high risk, and lists three cases where one is required in particular:
- a systematic and extensive evaluation of people based on automated processing, including profiling, used for decisions with legal or similarly significant effects;
- large-scale processing of special category data or criminal offence data;
- systematic monitoring of a publicly accessible area on a large scale.
The regulator also publishes a list of the kinds of processing that require a DPIA; check the current list on ico.org.uk. For AI used at work, these situations usually point towards a DPIA:
- AI used in decisions about people, such as recruitment screening, performance or credit.
- AI processing special category data, such as health information, or data about children.
- New AI tools processing personal data at scale, for example a meeting assistant across the whole organisation.
- AI agents given access to systems that hold personal data.
- Transfers of personal data to AI providers outside the UK.
- Monitoring staff, including the monitoring that AI security tools do.
If you decide a DPIA is not needed, record why. That decision is part of your accountability evidence too.
What an AI DPIA must contain
Article 35(7) of UK GDPR sets the minimum. For AI, this is what each part means in practice:
| UK GDPR requirement | What to record for an AI tool |
|---|---|
| A systematic description of the processing and its purposes | The tool, the provider and plan, the use case, who uses it, what personal data goes in, what comes out, where it is processed and how long it is kept |
| An assessment of necessity and proportionality | Why AI is needed for this purpose, whether less data would do, and why this tool rather than an alternative |
| An assessment of the risks to individuals | Disclosure, training use, retention, inaccurate output, unfair or automated decisions, security weaknesses such as prompt injection |
| The measures to address the risks | Contract terms, configuration, redaction, access limits, human review, training, logging and how compliance will be shown |
You should also seek your data protection officer's advice where you have one, consider seeking the views of the people affected or their representatives where appropriate, and review the DPIA when the risk changes. If the DPIA shows a high risk you cannot reduce, UK GDPR requires prior consultation with the regulator before you start.
Not sure which plan fits? Ask us
Tell us what you need and we will recommend the right plan for your organisation, with a quote.
AI DPIA steps
A practical outline that works for most AI tools:
- Identify the need. Use discovery data to see which AI tools are in use and which involve personal data, then screen each against the high-risk triggers above.
- Describe the processing. Record the tool, plan, provider role (processor or independent controller), data types, users, purposes, locations, retention and integrations.
- Consult. Involve your DPO, IT and security, the business owner of the use case and, where appropriate, the people affected.
- Assess necessity and proportionality. Confirm the lawful basis, minimise the data and check the purpose is compatible with why the data was collected.
- Identify and assess risks. Consider likelihood and severity of harm to individuals for each risk.
- Choose measures. Contractual, organisational and technical measures, with an owner for each.
- Sign off and record the outcome. Note residual risk, who accepted it, and whether prior consultation is needed.
- Put it into practice and review. Configure the controls, train staff and review when the tool, the data or the use changes.
AI DPIA template outline
Use this as a starting structure for an AI DPIA template. Adapt it to your organisation's existing DPIA format rather than running a separate process.
| Section | Questions to answer | Where the evidence comes from |
|---|---|---|
| 1. Overview | Which AI tool or use case? Who owns it? Is a DPIA required, and why? | Business owner; AI inventory |
| 2. Processing description | What personal data goes in and comes out? Whose data? How much? Where is it processed and stored? | Discovery and data type reports; provider documentation |
| 3. Provider and contract | Processor or independent controller? Training use? Retention? Sub-processors? Transfers? | Provider terms and data processing agreement |
| 4. Lawful basis and transparency | Which lawful basis? Are privacy notices accurate? Any special category data? | DPO; privacy notices |
| 5. Necessity and proportionality | Is AI needed? Could less data be used? | Use case review; use-case classification of prompts |
| 6. Risks to individuals | Disclosure, inaccuracy, unfair decisions, security, retention | Risk workshop; security assessment |
| 7. Measures | Which controls reduce each risk? Who owns them? | Policy; Workforce AI Security policies |
| 8. Outcome | Residual risk, sign-off, prior consultation needed? | DPO and risk owner |
| 9. Review | When will this be reviewed? What triggers an earlier review? | Reports and audit trails |
This outline is a starting point, not legal advice. It sits alongside the AI risk assessment and your AI security policy.
Is AI usage evidence for DPIAs the right fit for you?
We will check it against your systems and requirements and recommend the right option.
AI-specific risks to cover
Standard DPIA templates were not written with AI in mind. Make sure yours considers:
- Training use: whether the provider uses prompts and files to improve its models, and whether that can be switched off centrally.
- Retention of prompts and outputs, including chat history and uploaded files.
- Personal accounts of the same tool, which sit outside the business contract.
- Inaccurate output about individuals and how it is checked before use.
- Automated decisions and whether human involvement is meaningful.
- Prompt injection and agent actions: AI that reads untrusted content and can act on systems holding personal data. See prompt injection and MCP security.
- Oversharing in assistants connected to company data, where AI can surface anything a user can open. See Microsoft Copilot security.
How discovery data feeds the DPIA
The weakest part of most AI DPIAs is the description of the processing. It is often written from what people think happens rather than what does. Check Point Workforce AI Security gives you facts instead:
- Which tools: sanctioned and shadow AI apps, tools and MCP servers, from its discovery and AI application catalogue.
- Who uses them: breakdowns by app, user and session, and whether use is through managed corporate accounts or unmanaged personal ones.
- What for: AI-based classification of prompt content into use-case categories.
- Which data types: detections of personal data, credentials, source code and financial data in prompts and uploads.
The same product supplies the measures: redaction with labelled placeholders, file and image redaction with OCR, copy and paste restrictions, user guidance and blocking of unapproved apps. Its audit trails and reports then show the measures working, which is what a review needs. The Essentials tier covers web AI apps; the Enterprise tier adds desktop apps, coding assistants and agents.
As noted on our AI and UK GDPR page, the monitoring itself should be covered in a DPIA too.
How Forever Systems helps
We do not write DPIAs for you or give legal advice; your DPO or legal adviser owns the assessment. What we can do is give them the evidence and the controls. We can run Workforce AI Security in discovery mode, share the reports your DPIA needs, and then configure the measures the DPIA calls for.
This page is general information, not legal advice. Data protection law changed in 2025 and 2026, so check the regulator's current guidance and take advice for specific decisions. Contact us to talk about a discovery pilot.
How Forever Systems helps you use AI safely
We are an independent UK IT and cyber security provider. We supply Check Point Workforce AI Security and help organisations put sensible, workable rules around AI at work.
- See what is really in use: we can start with a discovery pilot, so you know which AI tools, browser extensions, coding assistants and agents your people use before anyone writes rules
- Policy you can enforce: we help you decide what to approve, restrict or block, and turn your AI acceptable use policy into Workforce AI Security policies
- The right tier: Essentials for browser-based AI, Enterprise when desktop apps, developer code assistants and agents are in the picture, confirmed at quote
- Staged roll-out: from monitoring to warnings, redaction and blocking at a pace your people can absorb, with reviews along the way
- Around the tool: Microsoft 365 permissions ahead of Copilot, device management for the extension and agent, and safe use of AI training for staff
We work with businesses, schools, charities and public sector organisations. Our guides are general information, not legal advice.
Frequently asked questions
Do I need a DPIA for AI?
You need one where AI processing of personal data is likely to result in a high risk to individuals, which UK GDPR highlights for new technologies. AI used in decisions about people, with special category data, at scale or by agents with access to personal data usually needs one. Record your reasoning either way.
Is there an AI DPIA template?
The regulator publishes DPIA guidance on ico.org.uk. This page gives an AI-specific outline you can use alongside it, covering the provider's role, training use, retention, transfers, automated decisions and AI security risks.
Who should carry out an AI DPIA?
The controller is responsible, usually led by the business owner of the AI use case with the data protection officer advising, and input from IT, security and, where appropriate, the people affected.
What is the difference between a DPIA and an AI risk assessment?
A DPIA focuses on risks to individuals whose personal data is processed and is a legal requirement for high-risk processing. An AI risk assessment looks more widely at risks to the organisation, such as confidentiality, security and contracts. Many organisations run them together.
Do we need a DPIA for Microsoft Copilot or ChatGPT Enterprise?
Possibly. It depends on the personal data involved, how widely the tool is used and what it can access. Assistants connected to company data can surface anything a user has permission to open, which is worth assessing before a wide rollout.
When should an AI DPIA be reviewed?
UK GDPR expects a review at least when the risk changes. For AI that includes a new provider plan, new data or integrations, an agent gaining new permissions, or the provider changing its terms.
Still have a question about AI usage evidence for DPIAs?
Ask us and a member of our team will reply by email.