UK GDPR Article 35
A DPIA is required before processing that is likely to result in a high risk to individuals.
DPIA AND AI IMPACT ASSESSMENT
One assessment for the data protection and the AI questions
When a system uses personal data and AI, UK GDPR asks for a Data Protection Impact Assessment and ISO 42001 asks for an AI system impact assessment. We run them as one piece of work, with your DPO, so the evidence agrees and nothing is done twice.
From £4,000, plus VATCredited in full against a Sprint started within six months. Timeline set on the diagnostic.
TRIGGERS
When you need it
ISO/IEC 42001 clause 6.1.4
An AI system impact assessment is required, supported by the Annex A controls on assessing impacts of AI systems.
Your buyers ask
A customer, investor or procurement team asks for the assessment behind an AI feature.
EU AI Act Article 27
Certain deployers of high-risk AI systems must carry out a fundamental rights impact assessment when the high-risk obligations apply to that system.
DELIVERABLES
What you get
- The integrated assessment document, covering the Article 35(7) contents: a description of the processing and its purposes, necessity and proportionality, the risks to individuals, and the measures to address them.
- The AI system impact assessment within the same document: intended use, foreseeable misuse, affected individuals and groups, and impacts.
- Risk register entries with owners and dates.
- The measures list with owners.
- A sign-off page for your DPO and accountable owner.
- A clear statement where residual risk stays high, because Article 36 then requires prior consultation with the Information Commission, which replaced the ICO on 30 September 2026.
Method: we follow ISO/IEC 42005:2025, the guidance standard for AI system impact assessment.
METHOD
How it runs
- 1
Scope and system description
- 2
Data and AI mapping with your team and DPO
- 3
Risk and impact assessment
- 4
Measures, owners and sign-off
SCOPE
Not included
- Legal advice. We are not a law firm.
- Prior consultation correspondence with the regulator. We prepare the pack, you submit it.
- Fixing the issues found. Scoped separately if you want us to do it.
FAQ
Common questions
Do we need both a DPIA and an AI impact assessment?
If the system processes personal data and uses AI, usually yes; one integrated piece of work covers both.
We already have a DPIA, is it enough for ISO 42001?
Usually not on its own: ISO 42001 asks about impacts beyond data protection, such as on groups and society; we extend the existing DPIA rather than start again.
Who signs it off?
Your accountable owner, with your DPO's advice recorded; Goldline prepares and reviews, it does not approve on your behalf.
Does this count towards the ISO 42001 Sprint?
Yes, the fee is credited in full against a Sprint started within six months.