AI data protection impact assessment (DPIA)
A DPIA laid out in the ICO's seven steps, with the questions written for a care service introducing an AI tool. Fill it in before you start and you have a record of the decision you actually made.
This follows the seven steps the ICO sets out for a DPIA process. The wording under each field is written for a care service introducing an AI tool, rather than for a generic project.
Do it before the processing starts. Article 35 says “prior to the processing”, and a DPIA written after a pilot is a write-up, not an assessment. See do you need a DPIA for whether you need one at all — for AI touching care records, you almost certainly do.
If you have a Data Protection Officer you must seek their advice and record it. If you do not follow it, record why.
Section 0: Administration
Organisation: [YOUR ORGANISATION]
Who is completing this: [NAME AND ROLE]
Date started: [DATE]
DPO consulted: [NAME, OR “we do not have a DPO”]
Others involved: [WHO — the ICO expects you to involve information security, any processors, and legal advice where relevant]
Step 1: Identify the need for a DPIA
What are you planning to do, in one paragraph?
[DESCRIBE THE TOOL AND THE TASK. For example: “We plan to use [TOOL] so care workers can speak a summary after each visit, which the tool drafts into a written record for the care worker to check and correct before saving.”]
Why does this need a DPIA?
Tick everything that applies.
From the ICO’s own list of high-risk processing:
- Innovative technology — the ICO names “innovative technologies, or the novel application of existing technologies (including AI)”. The ICO’s rule is that this requires a DPIA where it is combined with any of the criteria below.
- Risk of physical harm if the data were breached — addresses, routines, who lives alone.
From the European guidelines the ICO adopts:
- Special category data. Health data about the people we support.
- Vulnerable data subjects. People who draw on care and support.
- Large scale processing.
- Systematic monitoring.
- Automated decision-making with significant effects.
The ICO says a combination of two of these factors indicates the need for a DPIA, though it is not a strict rule. For AI handling care records, you will normally tick innovative technology, special category data and vulnerable data subjects before you reach the end of the list — which settles the question.
Our conclusion: [WE ARE DOING A DPIA BECAUSE…]
Step 2: Describe the processing
What data will the tool handle?
[LIST IT. Be specific: names, addresses, dates of birth, NHS numbers, health information, audio recordings, photographs. Include data about people other than those you support — family members, neighbours and staff often appear in care records.]
Whose data is it?
[PEOPLE WE SUPPORT / STAFF / FAMILY MEMBERS / OTHER]
How much, and how often?
[HOW MANY PEOPLE, HOW MANY RECORDS A WEEK, OVER WHAT PERIOD]
How does the data get to the tool, and what comes back?
[DESCRIBE THE FLOW, START TO FINISH. Where does the care worker enter it, where does it go, what comes back, where is the output saved?]
Who can see it inside our organisation, and who do we share it with?
[ROLES, NOT NAMES. List any other processor in the chain — the AI supplier’s own sub-processors count, and their list is usually a page on their website that changes without telling you.]
What security measures are in place?
[ACCESS CONTROL, MULTI-FACTOR AUTHENTICATION, ENCRYPTION, WHO HOLDS THE ADMIN ACCOUNT. The ICO expects security measures described here, not only in step 6.]
Where is the data held?
[COUNTRY OR REGION, FROM THE SUPPLIER’S OWN DOCUMENTATION. If the supplier will not say, write that down — it is a finding.]
Is there an international transfer?
[YES / NO. If the tool is hosted outside the UK, this is a transfer and it belongs in your privacy notice too.]
If yes, what makes that transfer lawful?
[NAME THE MECHANISM: UK adequacy regulations for that country, an International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. “They are a big company” is not a mechanism. If the supplier cannot name one, that is a finding and the processing should not start.]
Does the supplier use our data to train its models?
[YES / NO / DEPENDS ON THE PLAN. Name the plan you are buying. Consumer plans and business plans usually differ completely.]
Can any human at the supplier read our data?
[THIS IS A SEPARATE QUESTION FROM TRAINING. Some suppliers do not train on your data but allow staff or contractors to review it for abuse monitoring.]
How long does the supplier keep it?
[RETENTION PERIOD, FROM THEIR DOCUMENTATION]
Is there a data processing agreement in place?
[YES — ATTACH IT / NO. If no, the processing should not start.]
What is our lawful basis?
[AND, FOR SPECIAL CATEGORY DATA, YOUR ARTICLE 9 CONDITION]
Step 3: Consultation
Have we told the people whose data this is?
[WHEN AND HOW. The ICO requires you to communicate a new use of personal data to individuals before the processing starts.]
What did they say?
[INCLUDING ANY OBJECTIONS, AND WHAT WE DID ABOUT THEM]
Have we consulted staff who will use it?
[THEY WILL TELL YOU THINGS THE SUPPLIER WILL NOT]
Have we asked the supplier the questions we should have?
[SEE OUR SUPPLIER QUESTION SHEET. Attach the answers.]
If we did not consult, why not?
[THE ICO EXPECTS A REASON, RECORDED]
Step 4: Necessity and proportionality
What is the purpose? What problem does this solve?
[BE HONEST. “Care workers spend 40 minutes a shift on notes” is a purpose. “Innovation” is not.]
Could we achieve the same thing in a way that uses less data, or no AI?
[IF YES, SAY WHY YOU ARE NOT DOING THAT]
Is the amount of data proportionate to the benefit?
[DOES THE TOOL NEED EVERYTHING IT IS BEING GIVEN?]
How do we make sure the output is accurate?
[WHO CHECKS, WHAT THEY CHECK, HOW OFTEN. CQC asks for “monitoring outputs” under Regulation 17 on good governance, and this is where you record how.]
How will people exercise their rights?
[ACCESS, RECTIFICATION, ERASURE, OBJECTION. If data sits with a supplier, how do you get it back or delete it?]
How do we stop this spreading to uses we have not assessed?
[THE ICO CALLS THIS FUNCTION CREEP. A tool bought for visit notes gets tried on incident reports, then on a safeguarding referral. Say what the tool is approved for and who has to agree before that changes.]
How do we satisfy ourselves the supplier is doing what it agreed?
[WHAT YOU WILL ACTUALLY CHECK, AND WHEN. Their certification scope, their sub-processor list, and their terms — all of which change. A date in a calendar is a measure; an intention is not.]
Step 5: Identify and assess risks
For each risk: likelihood (remote / possible / probable), severity (minimal / significant / severe), and overall risk (low / medium / high).
| Risk | Likelihood | Severity | Overall |
|---|---|---|---|
| Staff use a personal account and data goes to a supplier with no agreement | [ ] | [ ] | [ ] |
| The tool mishears a medication name and it reaches a record unchecked | [ ] | [ ] | [ ] |
| A summary drops a significant detail and the record reads complete | [ ] | [ ] | [ ] |
| Strong language is smoothed, hiding a pattern of escalation | [ ] | [ ] | [ ] |
| Data is held outside the UK and we cannot answer a commissioner’s question | [ ] | [ ] | [ ] |
| A person we support was never told and finds out later | [ ] | [ ] | [ ] |
| Staff stop checking output once the pilot ends | [ ] | [ ] | [ ] |
| The supplier changes its terms and nobody notices | [ ] | [ ] | [ ] |
| [ADD YOUR OWN] | [ ] | [ ] | [ ] |
Step 6: Measures to reduce the risk
| Risk | What we will do | Residual risk | Approved? |
|---|---|---|---|
| [RISK] | [MEASURE — e.g. “named approved account only, checked at induction and in supervision”] | [LOW / MEDIUM / HIGH] | [YES / NO] |
| [RISK] | [MEASURE] | [ ] | [ ] |
Measures worth considering, because they address the risks above directly:
- Name the approved tool and the approved plan and account, not just the product
- Print the “never paste this” poster where staff work
- Sample and check output at an agreed rate, continuing after the pilot ends
- A named person reads alerts or errors, with a route for staff to report them
- A review date for the supplier’s terms
- Non-digital routes for people who do not want this
Step 7: Sign off and record
DPO advice: [WHAT THEY SAID]
If we are not following that advice, why: [REASON]
Residual risks accepted by: [NAME AND ROLE]
Date: [DATE]
Any high residual risk? If a high risk remains that you cannot reduce, you must consult the ICO before you start.
[YES — WE WILL CONSULT THE ICO / NO]
Review date: [DATE — no more than a year, and sooner if the tool or the supplier’s terms change]
How the outcomes go back into the project: [WHAT CHANGES AS A RESULT OF THIS DPIA]
Keep it
A completed DPIA is the clearest evidence that you assessed the risk before you started. CQC names the DPIA directly in its principles for good use of AI, and the ICO requires one for this kind of processing.
Keep it with the supplier’s data processing agreement and the answers to your supplier questions.