Read the full text: Data Protection Act 2018 on legislation.gov.uk.
A GDPR risk assessment, formally known as a Data Protection Impact Assessment (DPIA), is a legal requirement under Article 35 of UK GDPR whenever processing personal data is likely to result in a high risk to individuals. It applies to businesses, charities, landlords and sole traders of any size — there is no small business exemption. Getting it wrong can mean fines of up to £17.5 million or 4% of global turnover, enforced by the Information Commissioner's Office (ICO).
Most UK small businesses will never need a full DPIA, but almost all of them process personal data and therefore have underlying UK GDPR obligations regardless. Knowing the difference between everyday data protection compliance and the specific trigger for a formal DPIA is the key to not over-engineering your paperwork while still staying on the right side of the law.
What a GDPR risk assessment requires
UK GDPR is the retained, UK-specific version of the EU General Data Protection Regulation, sitting alongside the Data Protection Act 2018. Together they set out the core principles for lawful processing of personal data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability (Article 5).
Article 35 of UK GDPR introduces a specific requirement: where a type of processing is "likely to result in a high risk to the rights and freedoms of natural persons," the controller must carry out a Data Protection Impact Assessment before the processing begins. The ICO publishes a non-exhaustive list of processing types that automatically trigger this requirement, including large-scale processing of special category data (health, biometric, criminal records), systematic monitoring of publicly accessible areas (CCTV at scale), profiling that produces legal or similarly significant effects, and use of new or innovative technology.
A DPIA must, at minimum, describe the processing and its purposes, assess necessity and proportionality, identify and assess risks to individuals, and set out measures to address those risks (Article 35(7)). Where a high risk remains after mitigation, the controller must consult the ICO before starting the processing, under Article 36.
Outside the specific DPIA trigger, every organisation processing personal data still has to apply the Article 5 principles and demonstrate accountability. A broader GDPR risk assessment — looking at what data you hold, why, how it is secured, and who has access — is good practice for every business even when a formal DPIA is not legally required.
Who it applies to
UK GDPR and the Data Protection Act 2018 apply to any controller or processor established in the UK that processes personal data, and to organisations outside the UK that offer goods or services to, or monitor, people in the UK. There is no exemption based on company size, turnover, or number of employees.
- Employers — holding staff records, payroll data, recruitment applications, and performance records must comply, and a DPIA may be needed for new monitoring technology such as keystroke logging or biometric clocking-in systems.
- Landlords and letting agents — holding tenant identity documents, right-to-rent checks, references and financial information are processing personal data and may need a DPIA if they introduce automated tenant screening or large-scale CCTV.
- Sole traders and small businesses — holding customer names, contact details, order history and payment records must comply with the core UK GDPR principles even where a formal DPIA is not triggered.
- Health and care providers — processing special category health data at scale is one of the clearest DPIA triggers under ICO guidance.
- Charities and membership organisations — holding donor, beneficiary or member data, particularly where vulnerable individuals or special category data is involved.
- Any organisation introducing new technology — such as CCTV with facial recognition, AI-based decision tools, or tracking apps — is likely to need a DPIA regardless of sector or size.
Key duties at a glance
The practical obligations under UK GDPR relevant to a risk-based approach are:
- Screen new processing for DPIA triggers (Article 35) — before starting any new project involving personal data, check it against the ICO's screening criteria.
- Carry out a DPIA for high-risk processing (Article 35(7)) — describe the processing, assess necessity, identify risks, and document mitigations.
- Consult the ICO where high risk remains (Article 36) — before processing begins, if mitigations do not reduce the residual risk to an acceptable level.
- Apply data protection by design and default (Article 25) — build privacy safeguards into new systems and processes from the outset, not as an afterthought.
- Maintain records of processing activity (Article 30) — most organisations with 250 or more employees must keep formal records; smaller organisations must keep records for processing that is not occasional, involves special category data, or is likely to result in a risk to individuals.
- Report notifiable data breaches within 72 hours (Article 33) — to the ICO, where the breach is likely to result in a risk to individuals' rights and freedoms.
- Appoint a Data Protection Officer where required (Article 37) — mandatory for public authorities and organisations carrying out large-scale systematic monitoring or large-scale processing of special category data.
- Review and update assessments when processing changes — a DPIA is a living document, not a one-off compliance exercise.
Penalties for non-compliance
UK GDPR breaches are enforced by the Information Commissioner's Office. Under the Data Protection Act 2018, the ICO can issue fines of up to £17.5 million or 4% of annual global turnover, whichever is higher, for the most serious breaches such as failing to carry out a required DPIA, processing without a lawful basis, or ignoring a required ICO consultation. Lower-tier breaches, such as record-keeping failures, carry fines of up to £8.7 million or 2% of global turnover.
In practice, the ICO's published enforcement action shows that most small organisations receive reprimands, enforcement notices or more modest fines rather than the headline maximum figures, which are reserved for large-scale or deliberate breaches. However, the ICO has repeatedly fined small and medium-sized organisations tens of thousands of pounds for failures such as inadequate security measures, unlawful marketing, and failure to respond to subject access requests.
The ICO's own guidance also makes clear that failing to carry out a DPIA when the law required one is, on its own, an enforceable breach — independent of whether any actual harm to individuals occurred. The cost of doing the assessment properly is almost always lower than the cost of a reprimand, an enforcement notice, or reputational damage following an ICO investigation.
How this relates to risk assessments
A DPIA is a specific type of risk assessment, applying the same underlying logic used across UK health and safety law: identify a hazard (here, a data protection risk), assess likelihood and severity, and put in place proportionate controls. The ultimate guide to risk assessment sets out this general methodology, which applies equally whether you are assessing physical hazards in a workplace or data protection risks in a customer database.
Many UK small businesses already produce a general risk assessment covering their legal compliance obligations. If you are unsure whether your business needs any formal risk assessment at all — for health and safety, data protection, or both — see do I need a risk assessment for a plain-English breakdown of when the law requires one. For a wider view of which UK regulations create documented assessment duties, see risk assessment legal requirements.
Anyrisks focuses on UK-compliant health and safety risk assessments rather than data protection paperwork, but the same discipline applies: document the hazard, the people affected, the controls, and the review date. If you need a compliant, site-specific health and safety risk assessment to sit alongside your data protection documentation, the AI risk assessment generator produces a tailored PDF and editable Word document in under two minutes. Get My Risk Assessment £29.
GDPR and landlords
Landlords and letting agents are a good example of how the DPIA threshold works in practice. A small landlord with a handful of rental properties, holding tenant names, contact details, right-to-rent documents and references, is processing personal data under UK GDPR but is very unlikely to trigger the DPIA requirement — this is routine, low-volume processing with no special category data or systematic monitoring involved.
That changes if the landlord introduces smart CCTV with facial recognition in a shared entrance, automated tenant credit-scoring software, or starts managing data for dozens of properties with shared referencing systems that combine financial and health-related disclosures. At that point, the scale, the use of new technology, or the inclusion of special category data can push the processing over the DPIA threshold, and a formal assessment becomes a legal requirement rather than good practice.
The practical lesson for landlords and any small business is the same: review new technology or new ways of collecting tenant or customer data against the ICO's screening criteria before rolling it out, not after a complaint or data breach forces the question.
Also see: The Ultimate Guide to Risk Assessment · Do I Need a Risk Assessment · Risk Assessment Legal Requirements · AI Risk Assessment Generator
