When is a data protection impact assessment required in the UK?

Before processing that is likely to result in a high risk to individuals, in particular systematic and extensive automated evaluation with legal or similarly significant effects, large scale processing of special category data, and large scale systematic monitoring of a publicly accessible area. The Information Commissioner's own list adds innovative technology, biometric and genetic data, tracking and targeting of children among others. Where the residual risk stays high after mitigation, the Commissioner must be consulted before processing begins.