Do You Need a DPIA? A Plain English Guide for UK SMEs

A Data Protection Impact Assessment sounds like something only large enterprises need to worry about. In practice, a lot of ordinary small business activity, a new CRM, a marketing platform, an employee monitoring tool, a customer database that’s grown past what a spreadsheet can handle, can trigger the legal requirement for one under UK GDPR. This has nothing to do with whether you use AI. It’s been the law since 2018.

A Data Protection Impact Assessment is a structured look at how a specific piece of data processing affects the people whose data it involves, and what risks that creates. Under Article 35 of UK GDPR, it’s legally required whenever processing is likely to result in high risk to individuals, not just recommended good practice.

A few common triggers for UK SMEs:

Systematic monitoring. Tracking employee activity, location, or performance in an ongoing way.

Special category data at any scale. Health information, for example, even incidentally, such as through an HR or wellbeing platform.

New technology processing personal data. A new booking system, CRM, or customer platform that changes how data moves through your business.

Large-scale processing. The threshold is lower than most businesses assume, “large scale” for a regulator isn’t the same as “large” in the way a small business owner would use the word.

If any of these apply and you haven’t documented one, that’s a live gap, not a future problem.

A DPIA rarely stands alone. The documents that typically go with it are a Privacy Notice that actually reflects what you do with data (not a template lifted from another site), Records of Processing Activities (ROPA) showing what you hold and why, a Data Breach Response Procedure so you’re not improvising if something goes wrong, and a Lawful Basis Assessment confirming you actually have a legal footing for each type of processing.

This is exactly what our UK GDPR & DPIA Pack (£799) covers: the DPIA, Privacy Notice, ROPA, Data Breach Response Procedure and Lawful Basis Assessment, generated against your actual business circumstances rather than a generic placeholder. A brochure is available on the pack page if you want to see what’s included before starting an intake.

GDPR obligations exist independently of anything to do with AI. Clausely covers UK business compliance broadly, EU AI Act, Worker Protection Act 2024, and UK GDPR today, with more frameworks being added over time.