DPIA for AI tools: a practical outline for advice firms

Most advice firms now accept that they need a data protection impact assessment before AI tools touch client data. The harder part is writing one that does a job: a document that describes what really happens to the data, weighs the risks honestly and records decisions someone can stand behind. A DPIA for AI tools that is copied from a vendor template and filed away does none of that.

This article sets out when a DPIA is required, what the law says it must contain, and a practical outline an advice firm can adapt. It is general guidance for firms, not legal advice.

When a DPIA for AI tools is required

The legal test is in UK GDPR Article 35(1). Where processing "in particular using new technologies ... is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data."

Two words in that passage matter in practice. "Controller" means the firm: the duty sits with you, not with the software vendor. "Prior" means before the processing starts, not after a pilot has already run on live client files.

The regulator's guidance points firmly towards doing one. The Information Commission (formerly the ICO) says in its guidance on AI and data protection: "In the vast majority of cases, the use of AI will involve a type of processing likely to result in a high risk… and will therefore trigger the legal requirement for you to undertake a DPIA." Its guidance on when a DPIA is needed lists innovative technology "(including AI)" among the types of processing that require a DPIA when combined with another high-risk criterion. The ICO marks its guidance as under review following the Data (Use and Access) Act, so check for updates before you finalise.

For an advice firm using AI on fact finds, valuations, meeting recordings and questionnaire answers, the sensible default is simple: do the DPIA.

What the law says a DPIA must contain

Article 35(7) sets the minimum. The assessment must contain "at least":

1. "a systematic description of the envisaged processing operations and the purposes of the processing";
2. "an assessment of the necessity and proportionality";
3. "an assessment of the risks to the rights and freedoms of data subjects";
4. "the measures envisaged to address the risks".

The ICO also says, in its guidance on how to do a DPIA: "You can use or adapt our sample DPIA template if you wish". The outline below follows the four statutory parts, with the practical detail an advice firm usually needs added to each.

A practical outline, section by section

1. Systematic description

Describe the tool, the job it does and every party that touches the data. The most useful format is a data map. Here is a worked example for a firm using Freeboard to assess adviser competency from recorded meetings; replace it with your own tools and settings.

Note what the map shows. IFA Tools does not hold the firm's client data, but client data does leave the computer: it goes to the AI provider for processing, and the meetings sit with Fireflies. A hosted platform would have a different map, with the vendor's service at the centre. Either way, every party belongs in the description, with where it stores data and for how long.

2. Necessity and proportionality

Explain why AI is used for this job and whether the processing is no more than the job needs. Useful questions:

• What is the purpose, in one sentence? For example: "to assess adviser competency consistently against a dated standard".
• Could the job be done with less data? Do all the staged documents need to be read, or only some?
• What is the lawful basis? The ICO says "it is your responsibility to decide which lawful basis applies". Record it, and check it matches your privacy notice.
• Would clients reasonably expect this use? If not, what will you tell them?

3. Risks to clients

Assess risks to the people whose data it is, not to the firm. For advice work, the list usually includes:

• Inaccurate outputs. A wrong figure or a misstated circumstance in an assessment or a client document.
• Sensitive information. Meetings and fact finds can contain health and family details, especially where vulnerability is discussed.
• Retention. Copies held by a provider for longer than the firm intends.
• Secondary use. Data used to train models, depending on the provider's plan and settings.
• Access. Former staff or shared credentials reaching client data.

Rate each for likelihood and severity, in whatever simple scale the firm already uses for risk.

4. Measures to address the risks

For each risk, name the control and its owner. Typical measures:

• a firm-controlled AI account with the training setting checked and recorded (for example, Anthropic's pricing page, seen 7 October 2026, says its Team plan has "No model training on your content by default");
• human review of every output before it is relied on, supported by tools that show their sources (Freeboard quotes the client's own words for every conclusion);
• keys stored in the computer's keychain and revoked when staff leave;
• retention periods aligned with your records policy;
• a short written AI policy saying what may and may not go into AI tools.

Sign-off and review

Record who approved the DPIA, the date and the next review date. If the assessment shows a high risk you cannot reduce, Article 36(1) requires you to consult the Commission before the processing begins.

Common weak points

• Written after the event. Article 35 says "prior to the processing".
• Borrowed wholesale. A vendor's document can inform yours, but it cannot describe your settings, your staff or your clients.
• Parties missing. The meeting recorder or the AI provider left off the map.
• Risks without owners. A risk with no named control is a note, not a decision.
• Never revisited. The provider changed its plan, the firm added a tool, and the DPIA still describes last year.

Keeping the DPIA current

Treat these as triggers for a review: a new AI tool, a change of AI provider or plan, a change in the training setting or terms, a new type of client data, a significant error that reached a client, and changes to ICO guidance after the Data (Use and Access) Act. Diary an annual review regardless.

For the wider data protection steps, see AI data protection for advice firms, and for the supplier questions that feed the DPIA, our AI vendor due diligence checklist.

Frequently asked questions

Do we need a separate DPIA for each AI tool?

Our practical suggestion is one DPIA per tool, or per distinct data flow, so each can be reviewed when that tool or its provider changes. Where tools share the same provider and account, much of the content can be reused.

Is there a template we can use?

Yes. The ICO says "You can use or adapt our sample DPIA template if you wish". Make sure the finished document covers the four items in Article 35(7).

Can our software vendor do the DPIA for us?

No. The duty sits with the controller, which is the firm. A vendor can supply information about its product, but the assessment of your processing, your risks and your controls is yours.

To see how Freeboard records a dated, versioned standard and quotes the evidence behind each conclusion, look at Freeboard or book a demo: twenty minutes on Microsoft Teams with Adam Booth, run live on a demo firm with nothing for you to prepare.