As of 13 August 2026, AI cannot complete a data protection impact assessment.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open your organisation's DPIA template, project proposal, records of processing, data inventory, retention policy, security assessment and processor contracts, then gather the current versions in one working folder.
   2. Ask the project owner, IT or security lead, procurement team and service owner for the data flow, systems, recipients, suppliers, international transfers, retention period, user groups and proposed safeguards.
   3. Paste the gathered factual material into the prompt under Project information, removing unnecessary personal data and labelling documents by source and date.
   4. Run the prompt and copy the draft into the organisation's approved DPIA template, preserving its questions, approval fields and risk-rating method.
   5. Compare every statement in the draft with the source documents, correct inaccurate data flows and safeguards, and replace every assumption or information request with an evidenced answer or an unresolved issue.
   6. Ask the DPO or a UK data-protection solicitor to test the lawful basis, necessity, proportionality, high-risk findings, international transfers, residual risks and whether consultation with the ICO is required.
   7. Record the specialist's decisions, named risk owners, mitigation deadlines and approval status, then obtain the organisation's required sign-off before the processing starts.

   Prompt

   Act as a drafting assistant for a UK organisation preparing a data protection impact assessment under UK GDPR. Do not give legal advice, state that a conclusion is compliant, invent facts, or decide that a risk is acceptable without evidence. Use only the information I provide.
   
   Create a DPIA working draft with these sections:
   1. Project name, owner, purpose and proposed start date
   2. Description of the processing and how it works in practice
   3. Personal data, special category data and criminal offence data involved
   4. Data subjects and expected scale
   5. Data sources, recipients, processors, international transfers and retention
   6. Lawful basis and any relevant condition for special category or criminal offence data, recorded as questions for a qualified reviewer where the evidence is incomplete
   7. Necessity and proportionality, including less intrusive alternatives
   8. Risks to individuals, with causes, affected people, likelihood, severity and overall risk
   9. Existing and proposed technical and organisational measures
   10. Residual risk after mitigation
   11. Consultation required, including data protection officer, security, procurement, affected staff or users, and the ICO where applicable
   12. Decisions, owners, deadlines, evidence required and approval status
   
   For every missing fact, make a clearly labelled information request. Separate facts supplied by me from assumptions, and mark every assumption for confirmation. Do not reduce a risk merely because a control is proposed. Use a table for the risk register and distinguish inherent from residual risk. End with a list of issues that a UK data-protection specialist or DPO must decide before approval.
   
   Project information:
   [Paste the project proposal, process map, data inventory, supplier or processor details, security measures, retention policy, transfer information, consultation notes and existing risk assessments here.]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.