# AI data protection impact assessment (EU and UK GDPR oriented)

> For reference purposes only. Not legal advice. Draft for review by a qualified professional.

> How to use this template. A data protection impact assessment structure with screening questions for AI that uses personal data. Replace every [placeholder], delete guidance notes and have a qualified professional review the result. Template version 1.0, last reviewed 2026-10-03. Certainty: simplified.

## Screening: is an assessment needed?

Is the processing likely to result in a high risk to people? Consider scale, sensitive data, automated decisions and new technology. Confirm with your data protection officer.

[Enter your text here]

## Description of the processing

Purpose, data, data subjects, recipients, retention, systems and vendors.

[Enter your text here]

## Necessity and proportionality

Lawful basis, data minimization, accuracy, transparency and rights handling.

[Enter your text here]

## Risks to people

Identify risks, their likelihood and severity.

[Enter your text here]

## Measures to address the risks

Safeguards, residual risk and who accepts it.

[Enter your text here]

## Consultation and sign-off

Data protection officer advice, outcome and review date.

[Enter your text here]

## Certainty notes

- Simplified: a general starting point. Rules differ by region.

> For reference purposes only. This site offers general guidance for learning and planning; it is not legal advice and creates no lawyer-client relationship. Rules change often, so check the primary sources and qualified counsel before you act.