{"id":34,"date":"2026-08-23T19:35:05","date_gmt":"2026-08-23T19:35:05","guid":{"rendered":"https:\/\/assuredata.assetsphere.uk\/?p=34"},"modified":"2026-08-23T19:35:05","modified_gmt":"2026-08-23T19:35:05","slug":"when-ai-project-needs-dpia","status":"publish","type":"post","link":"https:\/\/assuredata.assetsphere.uk\/?p=34","title":{"rendered":"When does an AI project need a DPIA?"},"content":{"rendered":"<p class=\"wp-block-paragraph\">A Data Protection Impact Assessment is not required simply because a project uses AI, but AI can introduce characteristics that make a DPIA necessary or sensible \u2014 particularly where personal data is used in new, extensive or higher-risk ways.<\/p><h2 class=\"wp-block-heading\">Start with the processing, not the label<\/h2><p class=\"wp-block-paragraph\">Describe what personal data is used, whose data it is, the purpose, data sources, recipients, retention and the effect on individuals.<\/p><h2 class=\"wp-block-heading\">Look for higher-risk characteristics<\/h2><ul class=\"wp-block-list\"><li>Systematic or significant evaluation of people<\/li><li>Use of sensitive or special-category information<\/li><li>Large-scale monitoring or profiling<\/li><li>New combinations of datasets<\/li><li>Automated decisions with meaningful effects<\/li><li>Processing involving vulnerable people or significant power imbalance<\/li><\/ul><h2 class=\"wp-block-heading\">Map the AI data flow<\/h2><p class=\"wp-block-paragraph\">Understand what reaches the model or provider, what is logged, what is retained, whether information is reused and which sub-processors are involved.<\/p><h2 class=\"wp-block-heading\">Document mitigations<\/h2><p class=\"wp-block-paragraph\">Data minimisation, access controls, human review, transparency, retention limits, supplier terms and testing should be linked to the specific risks identified.<\/p><h2 class=\"wp-block-heading\">A practical next step<\/h2><p class=\"wp-block-paragraph\">Complete the assessment early enough to change the design. A DPIA completed after deployment has much less value.<\/p>","protected":false},"excerpt":{"rendered":"<p>How to think about data-protection impact assessments when AI involves personal data or higher-risk processing.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-34","post","type-post","status-publish","format-standard","hentry","category-data-protection"],"_links":{"self":[{"href":"https:\/\/assuredata.assetsphere.uk\/index.php?rest_route=\/wp\/v2\/posts\/34","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/assuredata.assetsphere.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/assuredata.assetsphere.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/assuredata.assetsphere.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/assuredata.assetsphere.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=34"}],"version-history":[{"count":0,"href":"https:\/\/assuredata.assetsphere.uk\/index.php?rest_route=\/wp\/v2\/posts\/34\/revisions"}],"wp:attachment":[{"href":"https:\/\/assuredata.assetsphere.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=34"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/assuredata.assetsphere.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=34"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/assuredata.assetsphere.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=34"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}