When Is a DPIA Legally Required?

Not every project needs a DPIA — but some must have one. Here’s how to tell.

Under the UK GDPR, DPIAs are mandatory in high-risk processing. But what qualifies?

• Use of new technologies (like AI or biometrics)
• Automated decision-making with legal effects
• Large-scale monitoring or profiling
• Processing sensitive data (e.g. health, ethnicity) at scale
• Tracking individuals in public places

Don’t guess — document your justification. Privacy IQ helps clients confidently assess when DPIAs are required — and when they’re just good practice.