Does your AI rollout need a DPIA?
Answer 13 questions about one AI use case. The check applies fixed rules from UK GDPR Article 35, the ICO's list of high-risk processing and the EDPB criteria, and shows you exactly which ones your answers trigger.
About two minutes. Nothing you enter leaves your browser.
For most AI that touches personal data, the answer is yes. The useful part is knowing why.
The ICO's guidance on AI and data protection says a DPIA will be required in the vast majority of cases where AI processes personal data.1 A yes on its own does not help much. This check shows which specific rule each answer triggers, so you know what the DPIA needs to address and can explain the decision to your board.
Not sure of an answer? Choose "Not sure". It is treated as a yes, because screening should err towards caution, and the result tells you which answers to confirm.
Do I need a DPIA to use AI in the UK?
If the AI processes personal data, very often yes. The ICO's guidance on AI and data protection says a DPIA will be required in the vast majority of cases where AI is used to process personal data, because that processing is likely to result in a high risk to individuals.
When is a DPIA legally required?
UK GDPR Article 35 requires one wherever processing is likely to result in a high risk, and always for three types of processing: systematic and extensive automated evaluation with legal or similarly significant effects, large-scale use of special category or criminal offence data, and large-scale systematic monitoring of a publicly accessible area. The ICO adds its own list of processing that needs one, and the EDPB criteria give a rule of thumb: two or more usually means a DPIA.
Why does using AI count as a criterion on its own?
Both the ICO and the EDPB treat innovative technology as a risk factor. The ICO's list says it triggers a DPIA when combined with any other criterion, so for AI one more yes is usually enough.
What happens to our answers?
Nothing leaves your browser. The check runs entirely on this page, and your answers are not stored, sent or used to train any AI model.
Is this legal advice?
No. It is a screening aid based on your answers. Your data protection officer or adviser should confirm the decision and record it, including any decision not to carry out a DPIA.
What does a DPIA not tell me?
Whether the AI use case is ready to deploy. A DPIA covers data protection risk. Readiness also depends on data quality, process maturity, tooling, people and governance, which is what the full AQE assessment checks.
- Information Commissioner's Office, Guidance on AI and data protection, section on data protection impact assessments.
- UK GDPR, Article 35, as it applies in the UK.
- ICO, Examples of processing likely to result in high risk; EDPB-endorsed Article 29 Working Party guidelines on DPIAs (WP248 rev.01).
Ruleset DPIA-SCREEN 1.0, reviewed October 2026.
A DPIA covers data protection. AQE tells you whether the use case is ready.
Five areas, one qualification verdict, and every answer behind it. About ten minutes.