Do you need a DPIA for an AI tool?
For AI touching care records, almost certainly yes. The ICO names AI as innovative technology, and care data is special category data. Two triggers is the threshold.
Short answer: if an AI tool will touch information about the people you support, you almost certainly need one. This page shows the working, because “almost certainly” is not good enough for a decision you may have to defend.
CQC names a DPIA directly in its principles for good use of AI. Data protection law requires one in defined circumstances. Those circumstances describe care work closely.
The rule
Article 35(1) of the UK GDPR:
“Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.”
Two things in that sentence are easy to miss.
“Prior to the processing.” A DPIA is not a write-up. If you have already run a three-month pilot on real visit notes, the DPIA was late.
“Likely to result in a high risk.” The ICO is explicit that this is a screening test, not a conclusion. You are not being asked to prove the processing is high risk. You are being asked whether there are features that point to the potential for it. As the ICO puts it, you are “screening for any red flags”.
The three automatic triggers
Article 35(3) names three types of processing that always require a DPIA:
- Systematic and extensive profiling with significant effects — automated evaluation of personal aspects that decisions are based on, producing legal effects or similarly significant effects.
- Large scale use of sensitive data — special category data under Article 9(1), or criminal offence data.
- Public monitoring — systematic monitoring of a publicly accessible area on a large scale.
Trigger 1 is why using AI to decide eligibility or risk is a different order of problem from using it to draft a letter.
The nine factors
Beyond the automatic three, European guidelines set out nine indicators of likely high risk:
- Evaluation or scoring
- Automated decision-making with legal or similar significant effect
- Systematic monitoring
- Sensitive data or data of a highly personal nature
- Data processed on a large scale
- Matching or combining datasets
- Data concerning vulnerable data subjects
- Innovative use or applying new technological or organisational solutions
- Preventing data subjects from exercising a right or using a service
The ICO’s guidance on how to count them is the part to hold on to:
“In most cases, a combination of two of these factors indicates the need for a DPIA.”
The ICO’s own list
The ICO is required to publish its own list of processing that needs a DPIA. The first entry on it:
“Innovative technology: processing involving the use of innovative technologies, or the novel application of existing technologies (including AI). A DPIA is required where this processing is combined with any of the criteria from the European guidelines.”
And, asked what innovative technology means, the ICO’s first example is:
“artificial intelligence, machine learning and deep learning”
There is no ambiguity to work with. The regulator has named the thing you are asking about.
Two other entries on that list matter in care:
- Targeting of children or other vulnerable individuals — using their personal data for profiling or other automated decision-making.
- Risk of physical harm — “where the processing is of such a nature that a personal data breach could jeopardise the [physical] health or safety of individuals.”
A breach of care records can put someone at physical risk. For people fleeing domestic abuse, that is not hypothetical.
Why care work reaches the threshold so easily
Put the pieces together for a fairly ordinary example: a tool that turns a care worker’s spoken summary into a draft visit record.
| Factor | Present? | Why |
|---|---|---|
| Innovative technology | Yes | ICO names AI directly |
| Sensitive data | Yes | Health data is special category data under Article 9 |
| Vulnerable data subjects | Yes | The people you support |
| Risk of physical harm from a breach | Often | Addresses, routines, who lives alone |
The threshold was two. That example has three or four before anyone has argued about it.
This holds for most realistic uses: drafting care plans, summarising incidents, summarising referrals, transcribing visits. The common factor is not the tool. It is that the data is about people who draw on care.
When you might not need one
The test is about the data, not about whether the word “AI” is involved. If an AI tool never touches personal data, the analysis changes.
Genuine examples:
- Drafting a job advert with no personal data in the prompt.
- Rewriting a policy document that names no one.
- Drafting a funding bid using only anonymised or aggregate figures.
- Working up interview questions for a role.
Note the discipline each of those requires. “Rewrite this incident report in plainer English” is not policy work — it is special category data pasted into a text box.
The ICO also allows that you may justify not doing a DPIA where you are confident the processing is unlikely to be high risk — but it says to document your reasons. An undocumented decision not to do a DPIA looks identical, afterwards, to never having thought about it.
And its own closing advice on the threshold question is worth taking at face value: “If in any doubt, we would always recommend that you do a DPIA.”
A caution about the current guidance
The ICO’s DPIA guidance carries this notice:
“Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.”
The Article 35 threshold is in the legislation and is not expected to move, but the ICO’s surrounding guidance may. Check the ICO’s own page before you rely on the detail here for anything consequential, and note the date at the foot of this page.
What this page is not
We are not lawyers, and this is not legal advice. It is a plain reading of the ICO’s published guidance, with the source linked so you can check our reading against the original. For a tool that will handle a lot of data about a lot of people, or for anything touching automated decisions about someone’s care, take proper advice.
What to do next
- Work out whether the tool will touch personal data at all. If it will not, write down why you concluded that.
- If it will, use our AI DPIA template. It follows the ICO’s structure.
- Do it before the pilot, not after. Article 35 says “prior to the processing”.
- Keep it. CQC’s principles name the DPIA specifically, and a completed one is the clearest evidence you assessed the risk.
- Revisit it when the tool changes. Suppliers change their data terms more often than you change your practice — our tool directory dates every entry for exactly that reason.