Do You Need a DPIA? A Plain English Guide for UK SMEs

A Data Protection Impact Assessment sounds like something only large enterprises need to worry about. In practice, a lot of ordinary small business activity, a new CRM, a marketing platform, an employee monitoring tool, a customer database that’s grown past what a spreadsheet can handle, can trigger the legal requirement for one under UK GDPR. This has nothing to do with whether you use AI. It’s been the law since 2018.

A Data Protection Impact Assessment is a structured look at how a specific piece of data processing affects the people whose data it involves, and what risks that creates. Under Article 35 of UK GDPR, it’s legally required whenever processing is likely to result in high risk to individuals, not just recommended good practice.

A few common triggers for UK SMEs:

Systematic monitoring. Tracking employee activity, location, or performance in an ongoing way.

Large-scale processing of special category data or criminal-offence data is an express Article 35 trigger. Other uses of sensitive data can still contribute to a high-risk assessment, particularly when combined with factors such as evaluation, systematic monitoring or innovative technology.

Genuinely new or unusual technology. Not simply switching to a new CRM or booking system on its own, that alone doesn't trigger the requirement, but using AI, biometric recognition, or another technology that's novel in itself, especially alongside another risk factor like profiling or sensitive data.

Large-scale processing can be a relevant high-risk factor, particularly when combined with sensitive data, systematic monitoring or evaluation. There is no single universal numerical threshold, so scale should be assessed in context.

If proposed processing is likely to result in high risk, the required DPIA must be completed before that processing begins. Where screening concludes that a DPIA is not required, recording the reasoning provides a useful accountability trail, particularly for AI or other innovative technology.

If you are introducing employee monitoring, the DPIA question deserves its own assessment. The ICO says you must complete a DPIA before worker monitoring that is likely to create a high risk to people’s rights and freedoms. Examples include biometric monitoring, keystroke monitoring, monitoring that can lead to financial loss such as performance management, and profiling or special category data used to make decisions.

Monitoring emails or messages is particularly sensitive because it can capture private communications and special category data. The ICO says employers considering this type of monitoring must complete a DPIA, explain why the monitoring is necessary and proportionate, identify the lawful basis, and tell workers what is happening.

If your proposed monitoring is lower risk, a DPIA can still be useful. If you decide not to complete one, document why. That decision trail matters because accountability under UK GDPR is not just about reaching the right answer; it is about being able to show how you reached it.

A DPIA rarely stands alone. The documents that typically go with it are a Privacy Notice that actually reflects what you do with data (not a template lifted from another site), Records of Processing Activities (ROPA) showing what you hold and why, a Data Breach Response Procedure so you’re not improvising if something goes wrong, and a Lawful Basis Assessment confirming you actually have a legal footing for each type of processing.

This is exactly what our UK GDPR & DPIA Pack (£799) covers: the DPIA, Privacy Notice, ROPA, Data Breach Response Procedure and Lawful Basis Assessment, generated against your actual business circumstances rather than a generic placeholder. A brochure is available on the pack page if you want to see what’s included before starting an intake.

GDPR obligations exist independently of anything to do with AI. Clausely covers UK business compliance broadly, EU AI Act, Worker Protection Act 2024, and UK GDPR today, with more frameworks being added over time.