DPIA template for AI in social care

UK GDPR requires a DPIA before any processing that is likely to result in a high risk to people’s rights and freedoms, in particular processing that uses new technologies. The ICO’s list of processing likely to be high risk includes:

The ICO says a DPIA is required when that is combined with any other high-risk criterion, and care records usually bring two: health information, which is special category data, and people who may be vulnerable, including children and adults who lack capacity. CQC’s May 2026 statement on AI expects a DPIA too:

In practice: if staff will use AI with anything about the people you support, complete a DPIA before they start.

• Download the Word file and replace everything in [square brackets].
• Work through the seven steps in order. The example answers describe a typical setup; delete what does not apply and add what is specific to your service.
• Rate each risk in step 5 for your own service, then record the measures and the residual risk in step 6.
• Ask your data protection officer or lead to review it and sign off step 7. If a high risk remains that you cannot reduce, you must consult the ICO before you start.
• Keep it with your governance evidence, pair it with an AI acceptable use policy, and review it whenever anything changes.

The structure follows the ICO’s sample DPIA template and its seven steps, so if your organisation already uses the ICO template, the content here drops straight into it.

The full text of the template, as it appears in the Word download. Example answers are shown in boxes; fill in the [highlighted fields] and rate the risks for your service.

Explain what the project aims to achieve, what processing it involves, and why you identified the need for a DPIA.

Nature: how will you collect, use, store and delete the data? What is the source? Will you share it with anyone, including processors? Which types of processing identified as likely high risk are involved?

Scope: what data is involved, including any special category or criminal offence data? How much, how often, how long will you keep it, how many people are affected, and what geographical area does it cover?

Context: what is your relationship with the individuals, how much control will they have, would they expect this use, do they include children or other vulnerable groups, and are there concerns or issues of public interest?

Purposes: what do you want to achieve, what is the intended effect on individuals, and what are the benefits?

Describe how you will seek the views of individuals or their representatives, or why that is not appropriate, and who else you will involve, including processors and security experts.

Record your lawful basis, whether the processing achieves the purpose, whether there is another way, how you will prevent function creep, how you will ensure data quality and minimisation, what you will tell individuals, how you support their rights, how you ensure processors comply, and how you safeguard any international transfers.

Describe each source of risk and its potential impact on individuals. Rate likelihood as remote, possible or probable; severity as minimal, significant or severe; and overall risk as low, medium or high. The risks below are the ones that most often arise when care providers use AI. Rate them for your service and add your own.

For each risk rated medium or high, record the measures that reduce or eliminate it, the effect (eliminated, reduced or accepted), the residual risk (low, medium or high) and whether the measure is approved.