Plain-Language DPIA and AI Risk Template

Important note

This template is not legal advice. It is a practical starting point. Use your organisation's formal DPIA process where required. The Data (Use and Access) Act 2025 has changed UK rules on automated decision-making — teams should check current ICO advice before using AI in decisions that may have legal or significant effects for residents.

When to use this template

Use it when an AI use case may involve:

Tenant, resident, staff or contractor personal data.

Complaint, arrears, repairs, tenancy, safeguarding, vulnerability or health-related information.

Automated or AI-supported decisions.

Profiling, scoring, prioritisation or prediction.

Supplier AI features connected to housing systems.

AI-generated content that may be sent to residents.

Quick screening

Question	Yes / No / Notes
Does the AI use personal data?
Does it use special category data or sensitive housing records?
Does it involve automated or AI-supported decisions affecting residents?
Does it involve profiling, scoring or predicting behaviour?
Does it use data at large scale or in new ways?
Is a full DPIA needed? (yes if any answer above raises concern)

Section 1: Describe the AI use case

What is the AI use case?
What housing problem does it address?
What type of AI is it? (assistant, supplier feature, bespoke model)
What data does it use?
Who will use it, and who will check outputs?
What decisions or actions might result from the AI output?

Section 2: Data protection assessment

The lawful basis for processing personal data has been identified (e.g. legitimate interests, legal obligation, task in the public interest).

Data minimisation applied — only necessary data is processed.

Special category or sensitive data has extra controls.

Privacy information updated where AI changes how personal data is used.

Individual rights considered: access, objection, correction, challenge.

Automated decision-making risk assessed with current ICO guidance.

Data Protection Officer or equivalent lead has reviewed high-risk use cases.

Section 3: Risk record

Risk area	Risk description	Mitigation	Residual risk (R/A/G)	Owner
Data protection
Tenant fairness and bias
Tenant transparency
Human oversight
Accuracy and reliability
Cyber and supplier risk
Staff capability

Section 4: Decision and sign-off

Overall risk rating
Decision: approve, approve with conditions, pause or reject
Conditions or actions before proceeding
Review date
DPO or governance sign-off required?
ICO consultation required? (where high residual risk remains)