FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Data protection consultants
A DPIA for an AI system must be completed before the processing starts, and a consultant who drafts or reviews it is answerable for its quality. A client that relies on a deficient assessment can face ICO action and may look to its adviser.
Part of: AI in Data protection consultants
In short
Many AI deployments that use personal data are likely to need a data protection impact assessment, because Article 35 names new technologies as an indicator of high risk processing. Consultants are asked to screen, draft or review these DPIAs, and a designated DPO must be consulted on them under Articles 35(2) and 39. The ICO concluded in May 2024 that Snap had not adequately assessed the risks of its generative AI chatbot before launch. If a client relies on a thin or late DPIA and then faces enforcement or claims, a negligence claim against the adviser may follow. PI usually responds, subject to the wording.
DPIA work on AI comes in several forms. A client may ask whether a DPIA is needed at all for a new tool, such as a call transcription service, a customer service chatbot or a scoring model. The consultant may draft the DPIA from scratch, review a draft prepared by the client's project team, or assess a template supplied by the AI vendor. An outsourced DPO is often asked to give a formal opinion before sign-off.
Some consultants may use generative AI to produce a first draft from a project description. The output can be generic: it lists familiar risks, proposes standard mitigations and rarely reflects how the specific system handles data, what the vendor retains or how outputs feed into decisions about people. A DPIA that reads well but does not describe the actual processing can be a key weakness.
The ICO's AI and data protection risk toolkit gives a structure for the AI-specific risks.
The ICO issued a preliminary enforcement notice to Snap on 6 October 2023 over its "My AI" chatbot and concluded the investigation on 21 May 2024. It found Snap had not adequately assessed the data protection risks before launch. Snap then completed a risk assessment the ICO considered compliant, and the ICO warned that it may use its full powers, including fines, where organisations do not assess risks properly. The point for advisers is timing as well as content: an assessment completed after launch does not cure the failure to assess before.
Illustrative scenario: a consultant reviews a retailer's DPIA for an AI tool that analyses customer service calls. The consultant signs it off, but the DPIA does not address the vendor's right to use call recordings to improve its models, nor the transfer of recordings outside the UK. After a complaint, the ICO makes enquiries. The client has to pause the tool, renegotiate the contract and redo the DPIA, and then claims its costs from the consultant, alleging the review was negligent.
Other failure points include advising that no DPIA is needed, failing to update a DPIA when the system changes, and accepting a vendor's own assessment without testing it.
A claim that a DPIA review fell below the standard of a reasonably competent consultant is a classic professional negligence claim, and a civil liability PI policy usually responds to it, subject to the terms and excess. The client's wasted costs and remediation spend may be recoverable from the adviser if causation is shown. A fine imposed on the client is a different matter; see are AI regulatory fines insurable? Clear engagement terms on scope help, as do limits on contractual liability that the policy will follow. Background on DPIAs is in the DPIA glossary entry.
Apex arranges PI for data protection consultants and outsourced DPOs. A broker can check how your policy treats DPIA and DPO opinion work involving AI; see the data protection consultants' AI hub.
Not every one, but Article 35 requires a DPIA where processing is likely to result in a high risk, and it names new technologies as an example. Many AI systems that process personal data at scale or make decisions about people are likely to meet that threshold, so screening should be documented either way.
Article 35 requires the assessment before the processing. The ICO's Snap investigation shows the risk: Snap later produced a compliant assessment, but the ICO still found it had not adequately assessed risks before launch.
Not in itself. The question is whether the finished DPIA meets the standard of a reasonably competent consultant. Generic AI drafting that does not reflect the actual system, vendor terms and data flows is where the risk lies.
PI usually responds to a negligence claim from the client, subject to the wording, including defence costs. Whether a client can recover a fine from its adviser, and whether that is insurable, is a separate and difficult question that depends on the facts and policy terms.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
