Does using AI mean you need a DPIA?

If you use AI, this section is the one that matters

Last reviewed: August 2026.

The volume thresholds are what most people notice first. The automation trigger is what actually catches them.

What counts as automated decision-making or profiling

Broadly, any system that evaluates, scores, ranks, segments, or predicts something about a person, or that reaches a decision about them without a human making the final call. From the examples in the Commissioner's ADMP Guideline and in ordinary commercial practice, this covers a great deal of what businesses already run:

• credit scoring and automated loan or credit decisions
• insurance underwriting and pricing based on health or lifestyle data
• CV screening and candidate shortlisting
• automated employee performance scoring
• recommendation and personalisation engines
• customer segmentation for marketing
• dynamic or personalised pricing
• fraud and risk scoring
• facial recognition and biometric matching
• clinical or diagnostic support tools

If you have adopted an AI tool anywhere in a process that touches people, you are very likely inside this category.

Why this catches so many organisations

Because it does not scale with size. A company with 500 customers running a recommendation engine is caught. A company with 200,000 customers running nothing but a mailing list may not be. The volume thresholds are the intuitive test and the automation trigger is the one that actually decides most cases.

One point of drafting to be aware of

There is a difference in wording across the two guidelines that has not yet been resolved.

The DPIA Guideline's narrative list of qualitative factors contains six items and does not mention automated decision-making separately. Its own assessment template, however, adds a seventh option covering automated decision-making and profiling that pose a high risk to the data subject. The ADMP Guideline attaches no such qualification, and applies the trigger regardless of the extent of intended use.

So the same regulator has expressed the same rule in three slightly different ways across two documents.

Our view is that the ADMP Guideline governs, because it is the specific instrument addressing the specific subject, and because it is the later and more detailed treatment. On that reading, automated decision-making or profiling triggers a DPIA without a separate high-risk assessment first.

That is our reading rather than a settled position, and we would expect it to be clarified. Until it is, the conservative course is to carry out the DPIA. The cost of doing one unnecessarily is a few weeks of work. The cost of having skipped one is explaining to the Commissioner why you took the narrower reading.