A data protection impact assessment (DPIA) is one of the most misunderstood parts of UK GDPR. Plenty of businesses aren’t sure when one is mandatory, what it involves, or what happens if they skip it.
This DPIA guide answers all three. It covers the legal triggers, the projects where a DPIA makes sense anyway, what a finished assessment contains, and how long the work takes. If you’re working out how to do a DPIA for the first time, start with the definition.
What Is a DPIA?
A DPIA is a structured risk assessment you carry out before processing personal data in a way that’s likely to put people at high risk. The duty comes from Article 35 of UK GDPR. The ICO describes it as “a process designed to help you systematically analyse, identify and minimise the data protection risks” of a project or plan.
Two things set a DPIA apart from other compliance paperwork:
- It looks forward: Article 35(1) requires the assessment before the processing starts. A DPIA written after launch can’t shape decisions that have already been made.
- It focuses on people: The risks it weighs are risks to individuals, such as discrimination, fraud, or losing control of their personal data. Risks to your business come second.
A DPIA doesn’t have to remove every risk. Its job is to bring risk down and help you judge whether what’s left is acceptable.
The Data (Use and Access) Act 2025 left the UK GDPR DPIA duty in place. The ICO has flagged that its DPIA guidance is under review following the Act.
When Is a DPIA Legally Required?
The law names three situations where a DPIA is always required, and the ICO adds a list of its own. Meeting any one of them makes a DPIA mandatory.
The three triggers in Article 35(3)
- “Systematic and extensive” profiling: The wording comes straight from Article 35(3)(a). It means automated evaluation of people, including profiling, that leads to decisions with legal or similarly serious effects on them. Automated credit decisions and recruitment screening are common examples.
- Large-scale special category or criminal offence data: For example, a private healthcare provider’s patient records, or a background-check firm’s conviction data.
- Large-scale public monitoring: Systematic monitoring of a publicly accessible area, such as a network of smart cameras across a chain of shopping centres.
The ICO’s list
Under Article 35(4), the ICO publishes its own list of processing that needs a DPIA. The ICO’s guidance on when you need a DPIA names ten types:
- new or novel uses of technology, including AI
- decisions about access to a product, service or benefit that rely on automated decisions, profiling or special category data
- large-scale profiling
- biometric data
- genetic data
- matching or combining data from several sources
- invisible processing, where you didn’t collect the data from the person and telling them would take disproportionate effort
- tracking location or behaviour
- targeting children or other vulnerable people
- processing where a breach could put someone’s physical health or safety at risk
Five of these (new technology, biometrics, genetic data, invisible processing and tracking) trigger a DPIA only when they come with at least one other risk factor from the European guidelines the ICO points to.
Prior consultation when high risk remains
Sometimes a DPIA shows a high risk you can’t reduce. In that case, you must consult the ICO before processing starts. Under Article 36 of UK GDPR, the ICO has up to eight weeks to give written advice, and it can extend that by six weeks for complex processing. You can’t go ahead until that consultation is done, so the time belongs in your project plan from day one.
What happens if you skip it?
Leaving out a required DPIA breaches Article 35 in its own right. The ICO’s guidance on what a DPIA is warns that this “may leave you open to enforcement action”, including a fine of up to £8.7 million or 2% of global annual turnover, whichever is higher. It also leaves you with no record of how you weighed the risks if a complaint or breach follows.
When Is a DPIA Good Practice Even If Not Mandatory?
Plenty of projects fall short of the legal triggers but still carry enough risk to justify an assessment. The ICO’s own advice is that “if in any doubt, we would always recommend that you do a DPIA”. Three situations deserve one:
- New products that use any personal data: An app, a customer portal or a loyalty scheme. Changing a design on paper is far cheaper than rebuilding a feature after launch.
- New third-party data sharing: Sending customer data to a partner, a marketing platform or a new processor. The DPIA records what you share, why, and which contract terms protect it.
- New surveillance or monitoring systems: CCTV, staff monitoring software, or access logs. Monitoring that falls below the Article 35(3) threshold can still feel intrusive to the people being watched.
A voluntary DPIA also gives you a record you can show a client or regulator who asks how you assessed the risk.
What Does a DPIA Cover?
Article 35(7) sets out four minimum contents. Three more come from elsewhere in Article 35 and the ICO’s guidance, and all seven together make a complete assessment:
- Description of the processing, Article 35(7)(a): What data you’ll collect, from whom, how it flows, who can see it, and why you need it.
- Necessity and proportionality, Article 35(7)(b): Whether the processing is needed for your purpose, whether less data would do, and your lawful basis.
- Risk assessment, Article 35(7)(c): The risks to individuals, rated by likelihood and severity.
- Mitigation measures, Article 35(7)(d): The safeguards and security measures that reduce each risk, plus the risk left over.
- DPO advice and sign-off, Article 35(2): If you have a DPO, the law requires you to seek their advice. The ICO expects you to record that advice and who signed off the DPIA. Where you don’t follow the DPO’s advice, you need to record your reasons.
- Consultation record, Article 35(9): The views of the people affected, or their representatives, where appropriate. If you decide not to consult them, note why.
- Review schedule, Article 35(11): When you’ll check that the processing still matches the assessment, at least whenever the risk changes.
There’s no DPIA template UK law requires you to use. The ICO says there is “no definitive DPIA template that you must follow” and offers a sample you can adapt.
Common DPIA Mistakes
Weak DPIAs tend to fail in one of four ways. Each one breaks the link between the assessment and the decisions it’s meant to shape.
- Doing it after the fact: Once a system is built, the assessment can only describe risks. It can’t design them out.
- Treating it as a checklist: The DPIA Article 35 requires is a risk exercise, not a form. Ticking “yes” to every question without testing the answers produces a document that won’t hold up under questioning.
- Leaving the DPO out: Seeking your DPO’s advice is a legal requirement where you have one. Bringing them in at the end for a signature misses the point of the advice.
- No review cycle: A DPIA goes stale as soon as the system changes. The ICO says you “should not view a DPIA as a one-off exercise to file away”.
How Long Does a DPIA Take?
The time a DPIA takes comes down to how complex the processing is and how much documentation you already hold. The table shows what shapes the effort for common project types.
| Project type | What shapes the timeline |
|---|---|
| A change to an existing system with good records | A focused look at the new element, building on records you already have |
| A new product or app using customer data | Mapping new data flows, third-party tools and the lawful basis for each use |
| AI or automated decision-making | Training data, model outputs, vendor terms and human review routes all need assessing |
| Large-scale special category data or public monitoring | Several teams, consultation with the people affected, and possibly prior consultation with the ICO |
Prior consultation adds the Article 36 response period on top of the assessment itself.
How KEWDATA helps
We start with a free scoping call to confirm whether you need a DPIA and how big the job is. You get a timeline before any work begins. Our consultants then work through six stages:
- mapping the processing with your developers and product team
- assessing necessity, proportionality and lawful basis
- identifying and scoring the risks
- designing mitigations your team can act on
- assessing residual risk and supporting sign-off, including ICO prior consultation where needed
- setting triggers for future reviews
Your organisation stays responsible for the DPIA and the final decision on the processing. Our role is to support the assessment and give you the evidence behind that decision.
Need a DPIA for Your Next Project?
Get expert support before processing starts, while the design can still change. Our DPIA and privacy risk assessment service covers the full assessment, from mapping the processing to a signed-off record with review triggers.
