INDEPENDENT UK DATA PROTECTION GUIDANCESource review: 1 November 2026 Our editorial standards ↗
GDPR.me.ukDisclaimer

Screen. Record. Revisit.

Does this project need a DPIA?

Check the proposed processing, understand the risk indicators and keep a reasoned screening record you can save and reopen.

Sources checked 1 November 2026UK GDPR · DPA 2018 · PECROfficial sources linked

Entries stay in this page. Save a working copy before leaving.

1. Set the context

Use short descriptions and evidence references. Do not enter client, patient or employee records.

2. Check the processing and risk indicators

Select all that apply. Leave uncertainty visible. These indicators support a reasoned review; counting ticks is not the legal test.

Keep the legal test in view

A single factor can be sufficient. Multiple factors are not an exhaustive legal formula. Check the statutory high-risk test, the ICO’s mandatory list and your actual circumstances. Where high residual risk cannot be reduced, assess the prior-consultation requirement before proceeding.