Do you need a DPIA? Check in two minutes, then build your draft free.
A data protection impact assessment (DPIA) is required under UK GDPR before you start processing that's likely to result in a high risk to people. This free checker asks the questions in Article 35 and on the list of processing that needs a DPIA published by the Information Commission (which replaced the ICO on 30 September 2026), tells you which one applies, and then helps you build a first draft. It runs in your browser: we don't see or store your answers.
How it works
Start the check
Answer yes, no or not sure. You can go back at any point.
See which one applies
The checker asks the questions in Article 35 and on the Information Commission's list, and tells you which one applies.
Build your draft
Build a first draft in your browser, then download Word or PDF, or print.
Thirteen questions, one at a time
Answer yes, no or not sure. You can go back at any point.
What a DPIA must contain
- 01
a systematic description of the processing and its purposes;
- 02
an assessment of necessity and proportionality;
- 03
an assessment of the risks to people's rights and freedoms;
- 04
the measures to address them.
Who it's for
Before processing likely to result in a high risk. Article 35(3) names three cases and the Information Commission lists ten more; the checker asks about all thirteen.
What it isn't
It's a structured starting point based on UK GDPR and Information Commission guidance.
DPIA and AI Impact Assessment
Questions
When do I need a DPIA?
Before processing likely to result in a high risk. Article 35(3) names three cases and the Information Commission lists ten more; the checker asks about all thirteen.
Is a DPIA the same as a privacy impact assessment?
A DPIA is the UK GDPR term; older guidance and other countries use "privacy impact assessment" for similar work.
What happens if the DPIA shows a high risk?
If you can't reduce it, Article 36 requires you to consult the Information Commission before you start.
Does an AI feature need a DPIA?
Often. "Innovative technology", including AI, is on the Information Commission's list.
Who should do it?
The controller is responsible. If you have a Data Protection Officer, you must seek their advice.
Do you keep my answers?
No. The checker runs in your browser and nothing is sent to us.
Is this legal advice?
No. It's a structured starting point based on UK GDPR and Information Commission guidance.
Built by Goldline Consultancy. Sources: UK GDPR Articles 35 and 36 (legislation.gov.uk), Information Commission DPIA guidance (ico.org.uk). Last checked 30 October 2026.
Do you need a DPIA? Check in two minutes.
It runs in your browser: we don't see or store your answers.
Start the check