Do I Need a DPIA? A Small Business Guide to Data Protection Impact Assessments
You've come across the term 'DPIA' and want to know whether it applies to you. Here is what it is, when the law requires one, and why most ordinary small-business processing doesn't trigger it.
The short version
- A DPIA is a risk assessment for a specific project, not a general compliance document. You do it before you start a new use of personal data that could be high-risk, to spot and reduce the risks first.
- It is legally required for high-risk processing. The law names three triggers: large-scale automated profiling with significant effects on people, large-scale use of special-category or criminal-offence data, and systematic monitoring of public areas on a large scale.
- Most small businesses don't need one for everyday work like a customer list, normal marketing, or payroll. But you should screen each new project, and when in doubt, the ICO says do one.
- AI is the modern trigger to watch. Using AI to make or materially inform decisions about people can be exactly the kind of high-risk processing that requires a DPIA.
If you have come across ‘DPIA’ in a supplier form, a framework checklist, or a worried email and you are wondering whether it applies to your business, this is the right question to ask first. A data protection impact assessment is one of those terms that sounds heavyweight and audit-shaped, when it is really just a structured way of thinking through the risks of a project before you commit to it. Most small businesses doing ordinary work do not need one. But a few specific activities make it a legal requirement, and the honest answer depends on what you are actually doing with people’s data.
What a DPIA actually is
A DPIA is a structured process to identify and reduce the data-protection risks of a specific project before you start it.
The Information Commissioner’s Office (the ICO, the UK’s data protection regulator) describes a DPIA as a way to assess and minimise the risks of a processing activity. The key word is specific. A DPIA is not a one-off form you fill in for the whole business and file away. It attaches to a particular thing you are about to do: launching a new app, installing monitoring software, adopting an AI tool, building a large new database.
Done properly, it walks through a project methodically: what data you’ll process, why, who it affects, what could go wrong for those people, and what you’ll do to lower each risk. The point is to surface problems while they are still cheap to fix, on paper, rather than after you’ve built and launched something.
Two things follow from that. First, the timing matters. A DPIA belongs at the start of a project, while you can still change the design. Doing one after launch is closing the stable door. Second, it scales. The ICO is explicit that a DPIA does not have to be a long or expensive exercise. For a small project the assessment can be short and proportionate. The size of the paperwork should match the size of the risk.
When a DPIA is legally required
A DPIA is mandatory under Article 35 of the UK GDPR before any processing that is ‘likely to result in a high risk’ to people’s rights and freedoms.
That phrase, ‘likely to result in a high risk’, is the legal threshold. Below it, a DPIA is good practice but not compulsory. Above it, it is required by law before you start.
To make that less abstract, Article 35 names three types of processing that always require a DPIA:
- Large-scale automated profiling or evaluation that significantly affects people. This means systematic and extensive evaluation of personal aspects based on automated processing, including profiling, where the outcomes have legal or similarly significant effects. Think automated decisions about creditworthiness, eligibility, or who gets hired.
- Large-scale use of special-category or criminal-offence data. Special-category data is the sensitive stuff: health, race, religion, sexual orientation, biometric and genetic data. Processing it, or criminal-offence data, on a large scale triggers the requirement.
- Systematic monitoring of a publicly accessible area on a large scale. The textbook example is extensive CCTV or tracking across a public space.
The ICO goes further than the three statutory triggers. It publishes its own list of processing that is likely to need a DPIA, including using innovative technology, large-scale profiling, data matching, biometric or genetic data, invisible processing (where people don’t know you hold their data), tracking someone’s location or behaviour, targeting children or other vulnerable people, and using AI to make decisions about individuals. If your project lands on that list, treat a DPIA as required.
THE SME EXAMPLES THAT ACTUALLY MATTER
For a small business, the realistic triggers are narrow: bringing in software that monitors employees in a meaningful way, large-scale tracking of customers' behaviour or location, or adopting an AI tool that makes or shapes decisions about real people. If you are doing one of those, screen it carefully. If you want the wider context first, start with our guide to GDPR for small businesses.
Why most small businesses don’t need one
Everyday processing — a customer list, normal marketing, payroll — is not high-risk and does not require a DPIA.
Here is the reassurance, and it is genuine. The vast majority of small businesses run on ordinary, low-risk processing. Keeping a list of customers and their contact details, sending marketing emails to people who’ve opted in, running payroll, handling supplier invoices: none of that meets the high-risk threshold, and none of it needs a DPIA.
The mistake is to swing the other way and decide DPIAs are irrelevant to you forever. They are project-triggered, not business-triggered. The business that never needs one for years can suddenly need one the day it decides to install keystroke-logging software or plug an AI screening tool into its hiring.
So the right habit is not ‘do a DPIA’ or ‘ignore DPIAs’. It is screen new projects. Before you start something that involves people’s data in a new or bigger way, ask the screening question: does this have features that point to high risk? The ICO publishes screening checklists you can use or adapt for exactly this. If you screen a project and conclude no DPIA is needed, it’s worth keeping a short note of that decision and why, so you can show you thought about it.
A DPIA isn’t a tax on growth. It’s the difference between finding out a project is risky on a one-page form, and finding out from an angry customer or a regulator’s letter.
And when you genuinely can’t tell? The ICO’s own advice is unambiguous: if you are in any doubt, do a DPIA. A short, proportionate assessment costs you an afternoon. Getting a risky project wrong costs a great deal more. Doing one when you didn’t strictly have to is never the thing that gets a business in trouble.
The step you can’t skip: consulting the ICO
If your DPIA finds a high risk you cannot reduce, you must consult the ICO before you go ahead.
This is the part people miss, and it changes how seriously a DPIA should be taken. A DPIA is not just an internal tick-box. If, after you’ve added every mitigation you reasonably can, the project still carries a high residual risk, the law requires you to consult the ICO before starting. This is called prior consultation, and it sits in Article 36 of the UK GDPR.
The detail to get right is ‘residual’. You only have to consult if the risk is still high after your mitigations. If your DPIA found a high risk but the measures you’ve put in place bring it down to an acceptable level, you don’t need to consult anyone, you just proceed with your safeguards in place. It is the risk you can’t design away that triggers the conversation.
And you cannot start the processing while you wait. When the ICO is consulted this way, it aims to respond within eight weeks, extendable to fourteen in complex cases. So a project that runs into this is a project to plan early. The realistic takeaway for most small businesses: if you ever get to the point of consulting the ICO, that is a strong signal the project needs serious, probably professional, attention before it goes live.
AI: the modern reason a DPIA matters
Using AI to make or materially inform decisions about people can be exactly the kind of high-risk processing that requires a DPIA.
A few years ago, DPIAs were mostly a concern for organisations running CCTV or big sensitive databases. AI has changed that, and it is the single most likely reason a small business today crosses the threshold.
The ICO explicitly lists the use of AI, machine learning, and automated decision-making about individuals among the activities likely to need a DPIA. The reasoning is straightforward: when a system makes or shapes a decision about a real person, perhaps screening a job application, scoring a customer, flagging behaviour, the stakes for that person are high, and the workings are often hard to see or explain. That combination is what ‘high risk’ is built to catch.
This matters because adopting AI feels easy. You sign up to a tool, paste in some data, and it produces an answer. The data-protection weight of that decision is invisible at the point you make it. If the AI is touching people, particularly making or strongly influencing decisions about them, a DPIA is how you make the risk visible before it becomes a problem. We’ve written more on where that responsibility sits in the legal responsibilities of using AI tools in a small business.
A DPIA also leans on knowing what data you actually process in the first place. If you don’t yet have a clear picture of the personal data flowing through your business, that record is the foundation everything else stands on, and it’s worth building before you tackle anything as project-specific as a DPIA. Our guide to keeping a record of processing activities is the place to start.
So, do you need a DPIA? For your day-to-day, almost certainly not. For the next ambitious project, the new monitoring tool, the AI you’re about to wire into a decision, the answer is: screen it honestly, and if there’s any real chance of high risk, do the assessment. It is the cheapest insurance you’ll buy all year.
SecurSentry is launching soon to help UK SMEs build practical, evidence-backed data protection, including knowing when a project needs a DPIA and screening new work before it goes live. Join the waitlist to be first to know when we open.
This article is general information, not legal or compliance advice. If you are planning high-risk processing, or you’re unsure whether a DPIA applies to your project, seek qualified guidance from a data protection professional or solicitor.