As of 13 August 2026, AI can only partly decide whether your UK business needs a DPIA.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the current ICO guidance on Data Protection Impact Assessments and save the relevant screening criteria and source links.
   2. Create a one-page fact sheet for the processing activity covering its purpose, data types, people affected, scale, technology, data sources, recipients, retention and safeguards.
   3. Paste the fact sheet and the relevant ICO extracts into a chatbot with the copyable prompt, and ask it to identify missing facts before giving an outcome.
   4. Check every factual assumption in the model's analysis against your project documents, supplier information, data map and security assessment.
   5. Compare each cited criterion and quotation with the current ICO source you opened, correcting any unsupported or outdated citation.
   6. Send the fact sheet, checked analysis and draft decision record to your DPO or a UK data protection solicitor when the activity involves high-risk technology, vulnerable people, extensive monitoring, profiling, special category data or unresolved uncertainty.
   7. Record the final decision, owner, evidence and review trigger in your compliance records, and start a DPIA if the checked conclusion is that one is required.

   Prompt

   Act as a UK data-protection compliance research assistant, not a solicitor and not the accountable decision-maker. Help me screen whether the processing activity below is likely to require a Data Protection Impact Assessment under the UK GDPR and current ICO guidance.
   
   Processing activity: [describe the project or processing]
   Purpose: [what the processing is intended to achieve]
   Personal data: [ordinary personal data and any special category or criminal offence data]
   People affected: [customers, employees, children, vulnerable people or other groups]
   Scale: [approximate number of people, records, frequency and geographical scope, if known]
   Technology or method: [profiling, automated decision-making, monitoring, tracking, biometrics, AI or other technology]
   Data sources and sharing: [where the data comes from and who receives it]
   Retention: [how long it is kept]
   Security and safeguards: [access controls, minimisation, pseudonymisation and other safeguards]
   Existing assessments or policies: [paste relevant extracts]
   
   Use only the UK GDPR and current ICO guidance that I provide or that you can identify with a source link and access date. Do not invent facts, legal tests, risk levels or citations. First list missing facts that could change the result. Then map the known facts to each relevant DPIA screening criterion, quoting or closely paraphrasing the source and linking it. Give a cautious outcome of one of: likely required, likely not required, or cannot determine. Explain the strongest reasons on both sides, distinguish legal requirements from good practice, and state what evidence would resolve uncertainty. Draft a short decision record with the processing description, risks considered, sources, assumptions, decision, owner and review trigger. Do not present this as legal advice. Flag the points that a UK data protection solicitor or suitably qualified DPO should check before I rely on the decision.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.