AI glossary
Data protection impact assessment (DPIA)
Also called DPIA, privacy impact assessment.
A data protection impact assessment (DPIA) is a documented check, made before you start, of how a use of personal data could harm people and how you will reduce that risk. UK GDPR Article 35 requires one where processing is likely to result in a high risk, and the ICO names AI among the technologies that can trigger one.
Think of it as
A risk assessment for people’s data, done before the work starts.
Why it matters at work
Bringing in an AI tool that touches personal data, such as recording meetings or screening job applications, may need one. Ask your data protection lead early, before the tool is bought.
Sources
- UK GDPR Article 35: data protection impact assessment (opens in a new tab) legislation.gov.uk, read 29 October 2026.
- Data protection impact assessments (DPIAs) (opens in a new tab) Information Commissioner’s Office, read 29 October 2026.
- Examples of processing “likely to result in high risk” (opens in a new tab) Information Commissioner’s Office, read 29 October 2026.