Do we need a DPIA before using an AI tool in our law firm?

In many cases yes. Under UK GDPR a data protection impact assessment is required where processing is likely to result in a high risk to people's rights, and putting client papers into a new system, at scale, using a technology the firm has not used before, will often meet that description. Where the answer is genuinely borderline, the sensible course is to carry out a short assessment anyway and record why you concluded the risk was manageable.

When an assessment is likely to be needed

The Information Commissioner's Office expects controllers to screen new processing and to document the decision either way. A few features tend to push an AI tool into DPIA territory:

• The data involved is confidential and often sensitive: medical records in a personal injury file, financial detail in a divorce, safeguarding material in a children matter.
• The volume is large. A tool that reads whole matters is processing far more than a single letter.
• The technology is new to the firm, and often new to the market.
• Data may be processed by a supplier, and possibly by that supplier's own subprocessors.
• Outputs may influence decisions about individuals, even indirectly.

A firm that uses an AI tool only on anonymised training scenarios, with no client data at all, is in a different position. Be honest with yourself about which of those two you are actually doing, because most firms move from the first to the second within weeks.

What the assessment should cover

A DPIA is not a form to be completed for its own sake. It is a record of thinking. Keep it short and specific to what your firm is doing.

1. What you are proposing. Which tool, used by whom, on which types of matter, with what categories of data. Be concrete. "Fee earners in the litigation team will upload witness statements, medical reports and correspondence" is useful. "Staff may use AI" is not.
2. Why you need to do it. The lawful basis for processing client data will usually flow from the retainer and the firm's legitimate interests in delivering the work, but write down the reasoning rather than assuming it.
3. Necessity and proportionality. Could you achieve the same result with less data? Does the whole file need to go in, or the documents relevant to the question? Is there a retention period, and who deletes what at the end of the matter?
4. Risks to individuals. Loss of confidentiality, unauthorised access inside the firm, data leaving the UK without adequate protection, data being reused to improve someone else's product, and inaccurate output being acted on without a check.
5. Mitigations. Access controls, authentication, contractual terms, staff training, supervision requirements, and the rule that a qualified person reviews anything that leaves the firm.
6. Residual risk and sign-off. What remains after the mitigations, and who accepted it.

If the residual risk still looks high after mitigation, that is the point at which the ICO expects to be consulted before you proceed. In practice, most firms find that tightening the arrangements is the better answer.

The questions that make the assessment possible

You cannot complete a DPIA on a supplier who will not tell you how the service works. Before you start, get written answers to:

• Where is our data held, and in which countries is it processed?
• Who else's data sits alongside ours, and how is ours separated?
• Is our data used to train models, for us or for anyone else?
• Which subprocessors are involved, and how will we be told if that changes?
• How long is data retained, and how is deletion evidenced?
• What authentication and access controls are available, and can we restrict access matter by matter?
• What happens to our data if we stop using the service?

Attach the answers to the assessment. If the supplier's terms contradict what a salesperson said, the terms win, and your DPIA should reflect the terms.

Keep it proportionate, and keep it alive

A firm of four to fifty fee earners does not need a forty page document. Two or three pages, written by whoever holds the compliance function with input from a fee earner who has actually used the tool, will usually be more useful than a long template filled with generalities.

The assessment should be dated and revisited when something changes: a new use case, a different type of matter, a change of supplier terms, a new subprocessor, or an incident. Record the review even when nothing has changed. Regulators and insurers are usually more interested in evidence of considered decisions than in the length of the document.

One last point. A DPIA covers data protection. It does not discharge your obligations on confidentiality and legal professional privilege, on supervision, or on competence. Those need their own thinking, and they should sit alongside the assessment in the same file so that anyone asking how the firm approached AI can see the whole picture at once.

Where Alesis fits

Alesis is an AI assistant for UK law firms, made by L25 Limited, and it is built so a firm can answer these questions in writing. A firm's information is held in the UK and processed only in the UK and the EU, kept apart from every other firm, and never used to train anything for anyone else. Inside a firm, people see only the matters they are on, and seniority alone grants no view; every account proves its email address and can add two-factor authentication and passkeys. Alesis assists qualified professionals and does not replace them, and it does not provide legal advice.