Data protection impact assessment: when a small business needs one

A data protection impact assessment is required before processing that is likely to result in a high risk to individuals, and the regulator's list of what counts (new technology, profiling, tracking, biometrics, children's data, data matching, monitoring in public places) catches a surprising number of small businesses that assumed the assessment was for banks and hospitals: the shop installing facial recognition, the recruiter using an AI screening tool, the app that tracks location, the gym with fingerprint entry. The business needs a screening process that asks the question for each new activity, a template for the assessment when the answer is yes, and a record of the assessments it has done. I draft the screening checklist and the assessment template with the data processing agreement and the privacy notice for the business for a fixed fee of £795, delivered in five working days, with a note on the operational steps the documents assume.

Who this is for

Small and medium-sized businesses in England and Wales adopting new technology, monitoring, profiling or AI tools, and businesses whose supplier or customer has asked whether an assessment was done.

What matters in a data protection impact assessment

The assessment, the law and the small business that assumes it is for big ones

Article 35 of the UK GDPR requires a controller, before processing that is likely to result in a high risk to the rights and freedoms of individuals (in particular using new technologies), to carry out an assessment of the impact of the processing, and the obligation applies to every controller regardless of size, so that a two-person business installing a system the regulator's list describes is as bound as a bank; the assessment is the document the regulator asks for when a complaint about monitoring, profiling or a new tool arrives; the Data (Use and Access) Act 2025 left the obligation in place.

The triggers: high risk and the regulator's list

Article 35(3) names three cases that always require an assessment (systematic and extensive profiling with significant effects, large-scale processing of special category or criminal records data, and systematic monitoring of a publicly accessible area on a large scale), and the Information Commissioner's list under Article 35(4) adds processing that involves innovative technology, denial of a service or benefit based on automated decisions or profiling, large-scale profiling, biometric or genetic data, data matching, invisible processing (data the individual does not know is collected), tracking of location or behaviour, targeting children or vulnerable people, and the risk of physical harm; the European guidance's nine criteria are the screening test, and two of them usually means an assessment is needed.

The screening that decides whether a full assessment is needed

The business should screen every new project, system, supplier or use of data against the criteria before it starts, recording the screening and its outcome (no assessment needed, with the reason; or assessment required), so that the record shows the question was asked even where the answer was no; the screening checklist drafted for the business is a one-page form the project owner completes, reviewed by the person responsible for data protection, and the note that comes with the documents lists the activities the business already runs that should have been screened, because a business already doing high-risk processing should assess now rather than never.

What the assessment contains and who is consulted

Article 35 requires the assessment to contain a systematic description of the processing and its purposes (including the legitimate interest where relied on), an assessment of the necessity and proportionality of the processing, an assessment of the risks to individuals, and the measures envisaged to address the risks (the safeguards, the security, the mechanisms that demonstrate compliance), and the business should consult its data protection officer where it has one, seek the views of the individuals or their representatives where appropriate (the staff for monitoring, a sample of customers for profiling), and consult the processor where the processing is carried out by one (whose data processing agreement under Article 28 requires it to assist); the template drafted for the business follows the Information Commissioner's structure so that the assessment reads as the regulator expects.

Prior consultation with the regulator and the risk that cannot be reduced

Where the assessment concludes that the processing would result in a high risk even after the measures the business can take, Article 36 requires the business to consult the Information Commissioner's Office before starting, providing the assessment and the information the Article lists, and the regulator has up to eight weeks (extendable by six) to advise, which can include telling the business not to proceed; prior consultation is rare for a small business, because most high-risk processing can be brought to an acceptable level by the measures (less data, less retention, a human in the loop, an opt-out, a non-biometric alternative), and the assessment's purpose is to find those measures before the processing starts rather than to document a decision already taken.

The assessment as a living document and the project that changed

The assessment should be reviewed when the processing changes (a new purpose, a new tool, a wider scope, a new category of data), when the risk changes (a breach, a complaint, a change in the law, a new regulatory finding about the technology) and at a stated interval, with the review recorded, and the privacy notice, the records of processing under Article 30 and the retention policy updated to match; the business keeps the assessments and the screenings as the evidence that it considered the risks, the data processing agreement drafted alongside requires its processors to assist with assessments, and the privacy notice describes the processing the assessment approved in terms that match it, because an assessment that approved limited profiling and a notice that describes something wider have told the regulator the measures were not applied.

What it costs

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Review of a customer's DPA, £495. They sent theirs and you need to know what you are accepting. Returned marked up with the changes to ask for and an explanation. Three working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

We are a small business. Do we really need to do impact assessments?

Where the processing is likely to be high risk, yes, regardless of size: the regulator's list includes facial recognition, biometric entry, AI screening, location tracking, staff monitoring and children's data, which small businesses use. The screening checklist asks the question for each new activity and records the answer.

We installed CCTV years ago without an assessment. Is it too late?

Assess it now. The obligation is to assess before processing starts, but a business already doing high-risk processing without an assessment should do one rather than continue without, and the record shows the regulator the business addressed it.

What if the assessment finds the risk is too high?

First, reduce it with measures (less data, shorter retention, a human in the loop, an alternative for those who object). Where it remains high, consult the regulator before starting, which is rare for a small business because the measures usually work.

Related guidance and services

• Data protection agreements and privacy terms, £795, the service this page describes
• SaaS and technology contracts, £995
• Terms and conditions drafting, £995
• Records of processing for a small business
• Privacy notice for a company using AI tools on customer data

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.