# Carry out a data protection impact assessment for high-risk AI processing

- **Record type**: Obligation
- **Instrument**: ICO Guidance on AI and data protection
- **Jurisdiction**: United Kingdom
- **Category**: impact_assessment
- **Binding**: Yes
- **Provision**: UK GDPR Article 35; ICO guidance, accountability and governance section

## In brief

Carry out a data protection impact assessment for high-risk AI processing is a legal requirement under the ICO AI guidance in the United Kingdom (UK GDPR Article 35; ICO guidance, accountability and governance section). Where AI processing of personal data is likely to result in a high risk to individuals, UK GDPR requires a DPIA before processing begins.

## What the duty requires

Where AI processing of personal data is likely to result in a high risk to individuals, UK GDPR requires a DPIA before processing begins. The ICO treats most AI involving profiling, large-scale processing or novel technology as meeting this threshold.

## What an organisation does about it

Use the ICO's DPIA template and add AI-specific sections on bias, explainability and human oversight.

## Controls that meet this duty

- Privacy and data-protection controls for AI (satisfies): https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai
- AI impact and fundamental-rights impact assessment (supports): https://aipolicytracker.org/controls/ai-impact-assessment

## Parent instrument

- ICO Guidance on AI and data protection
  - Record: https://aipolicytracker.org/policies/uk-ico-ai-data-protection-guidance
  - Context file: https://aipolicytracker.org/policies/uk-ico-ai-data-protection-guidance.md

## Provenance

- **Permanent id**: AIPT-OBL-0077 (https://aipolicytracker.org/id/AIPT-OBL-0077; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai
- **Official source**: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
- **Provision**: UK GDPR Article 35; ICO guidance, accountability and governance section
- **Review status**: verified
- **Confidence**: medium
- **Facts last confirmed**: 2026-09-26
- **Confirmed by**: Bhaskar Bhatt (see https://aipolicytracker.org/reviewers)
- **Retrieved**: 2026-10-27
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Carry out a data protection impact assessment for high-risk AI processing (ICO AI guidance)" [AIPT-OBL-0077, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0077 (accessed 27 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.