{"slug":"uk-ico-dpia-for-ai","id":"AIPT-OBL-0077","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0077","title":"Carry out a data protection impact assessment for high-risk AI processing","short_title":"Data protection impact assessment for AI","category":"impact_assessment","summary":"Where AI processing of personal data is likely to result in a high risk to individuals, UK GDPR requires a DPIA before processing begins. The ICO treats most AI involving profiling, large-scale processing or novel technology as meeting this threshold.\n","practical_action":"Use the ICO's DPIA template and add AI-specific sections on bias, explainability and human oversight.\n","is_binding":true,"applies_from":null,"section":null,"source_reference":"UK GDPR Article 35; ICO guidance, accountability and governance section","official_source_url":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["provider","deployer","public_authority"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","biometrics","finance_and_credit"],"applicability":[{"description":"Controllers using personal data in AI where processing is likely high risk.","actors":["provider","deployer","public_authority"],"conditions":null}],"evidence_examples":[{"title":"Data protection impact assessment","description":null,"artifact_type":"report"}],"framework_mappings":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 6.1.4 AI system impact assessment","note":"Original editorial mapping.","confidence_level":"high","is_original":true},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 5.1","note":"Impact assessment.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"privacy-and-data-protection-for-ai","title":"Privacy and data-protection controls for AI","kind":"process","relationship":"satisfies","note":"DPIA with AI-specific sections before processing starts.","confidence_level":"high","url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai"},{"slug":"ai-impact-assessment","title":"AI impact and fundamental-rights impact assessment","kind":"process","relationship":"supports","note":"Bias, explainability and oversight analysis reused in the DPIA.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-impact-assessment"}],"url":"https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai","policy":{"slug":"uk-ico-ai-data-protection-guidance","title":"ICO Guidance on AI and data protection","status":"guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/policies/uk-ico-ai-data-protection-guidance"}}