Carry out a data protection impact assessment for high-risk AI processing

Practical action

Use the ICO's DPIA template and add AI-specific sections on bias, explainability and human oversight.

Who does it apply to?

Controllers using personal data in AI where processing is likely high risk.

Actors

Provider / developerDeployer / user organisationPublic authority / government body

Sectors

Cross-sector / all sectors

Use cases

AI in hiring and employmentBiometrics and facial recognitionAI in finance, credit and insurance

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessData protection officer · once per ai system
  Privacy and data-protection controls for AI

  Serves 13 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use

  DPIA with AI-specific sections before processing starts.

• supportsProcessAI system owner · once per ai system
  AI impact and fundamental-rights impact assessment

  Serves 11 recorded duties · evidence: AI impact assessment, Impact assessment approval, Impact assessment procedure and template

  Bias, explainability and oversight analysis reused in the DPIA.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• Fundamental Rights Impact Assessment (FRIA)

  Assessment · DOCX and XLSX · v5

• AI Impact Assessment

  Assessment · DOCX and XLSX · v5

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v3

All 7 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every United Kingdom duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Carry out a data protection impact assessment for high-risk AI processing (ICO AI guidance)” [AIPT-OBL-0077, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0077 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0077: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Guidance on AI and data protection, Information Commissioner's Office, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/.

@misc{aipolicytracker2026_carryoutadataprotectioni,
  author       = {{AIPolicyTracker}},
  title        = {{Carry out a data protection impact assessment for high-risk AI processing (ICO AI guidance)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai}},
  url          = {https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Carry out a fundamental rights impact assessment before deployment — EU AI Act, European Union
• Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits — India DPDP Act, India
• Conduct a data protection impact assessment for high-risk processing using new technologies — UAE PDPL, United Arab Emirates
• Deployers must complete impact assessments for high-risk AI — Colorado AI Act, Colorado (United States)
• Map context, intended use and potential impacts (Map) — NIST AI RMF, United States (voluntary)
• Operators of high-impact AI should assess its impact on fundamental rights before use — AI Basic Act, South Korea (voluntary)