Is this legal advice?

No, and it is not a compliance assessment either. Cadral is an automation consultancy, not a law firm. What this produces is a list of questions to take to somebody qualified to answer them; a verdict would be worth less, not more.

Why is there no score out of 100?

Because a score implies a line above which you are fine, and there is no such line. Two organisations with identical answers can be in different positions depending on context the tool cannot see, so it counts open questions instead.

Where do the risk indicators come from?

The ICO's own published list of processing operations likely to result in a high risk, and the criteria it endorses alongside them. The counting rule is the ICO's too, quoted in full in section 01 above. Nothing here is a Cadral threshold.

Why does answering “not sure” change the result?

Because on this subject not knowing is the finding. A “not sure” raises a question to settle, usually the cheapest thing on the list to find out. It never counts towards the tally: not knowing something is true is not evidence that it is.

Is any of this changing?

Yes, so every figure carries a date. The Data (Use and Access) Act 2025 changed parts of the UK GDPR: the automated decision-making guidance is still in draft, and the ICO's DPIA guidance is under review. Check the sources before relying on any figure.

What if the process touches no personal data at all?

Then most of this falls away, and the tool says so. Double-check that first, though: a name in a filename, an email address in a log, a photograph of a person, and a customer reference that maps to a single person are all personal data.

Are you allowed to automate this?

Seventeen questions to ask before you automate something that touches people's data, mapped to the risk indicators the ICO publishes. It returns a list of things to go and find out, never a verdict that you are compliant.

FREE
NO EMAIL
6 MINUTES
NOT LEGAL ADVICE

READ THIS BEFORE YOU START

This is a prompt for a conversation, not legal advice, and not a compliance assessment. Cadral is an automation consultancy, not a law firm: nothing here can tell you that you are compliant, or replace asking somebody qualified to answer.

What it does is give you the questions in the right order, with the ICO's own published criteria behind them, so the conversation you do have is a short one. Every figure on this page is sourced and dated in section 01 below.

What the process actually touches. Start here, because if there is no personal data most of the rest falls away.

Does this process touch information about identifiable people at all? Customers, staff, job applicants, or somebody's name in a spreadsheet.

Does it touch health, ethnicity, religion, sexual orientation, trade union membership, biometric or genetic data, or criminal offence data?

Was any of this data collected from somewhere other than the person it is about?

Does it combine, compare or match personal data from more than one source?

QUESTIONS TO ANSWER FIRST

17

17 of them you have not answered, or were not sure about. Those are the cheapest things to go and find out.

This is not legal advice and it is not a compliance assessment. Cadral is not a law firm. It is a set of questions to take to somebody who is.

What this is checked against

Four sources, all read on 26 August 2026, with the figures printed in full so you can check them against the original instead of trusting this page. Thresholds and fees change: treat the date as part of the figure.

There are three data protection fee tiers and controllers pay between £52 and £3,763. Tier 1, micro: turnover up to £632,000 or no more than 10 staff, £52. Tier 2, small and medium: turnover up to £36 million or no more than 250 staff, £78. Tier 3, large: £3,763. Paying by direct debit gets an automatic £5 discount. Charities that are not otherwise exempt pay the tier 1 fee whatever their size.: ico.org.uk, “Guide to the data protection fee” · checked 26 August 2026
A notifiable personal data breach must be reported to the ICO without undue delay and not later than 72 hours after becoming aware of it. Where the breach is likely to result in a high risk to people's rights and freedoms, those people must be told directly and without undue delay. Every breach must be recorded, including the ones that are not reported.: ico.org.uk, “Personal data breaches: a guide” · checked 26 August 2026
A DPIA is required where a type of processing is likely to result in a high risk to people's rights and freedoms. The ICO publishes a list of indicators, and says of them: “In most cases, a combination of two of these factors indicates the need for a DPIA. However, this is not a strict rule.” The ICO also notes that this guidance is under review following the Data (Use and Access) Act 2025.: ico.org.uk, “When do we need to do a DPIA?” · checked 26 August 2026
To work out whether the automated decision-making provisions apply, the ICO asks three questions together: is a system making a decision about a person, is the decision significant, meaning it has legal or similarly significant effects, and is it solely automated, meaning there is no meaningful human involvement. If all three are yes, you must comply with those provisions and put the required safeguards in place. This guidance is explicitly still in draft and was updated on 31 March 2026 to reflect the Data (Use and Access) Act 2025.: ico.org.uk, “What is ADM?” · checked 26 August 2026

How the check works

Is this legal advice?: No, and it is not a compliance assessment either. Cadral is an automation consultancy, not a law firm. What this produces is a list of questions to take to somebody qualified to answer them; a verdict would be worth less, not more.
Why is there no score out of 100?: Because a score implies a line above which you are fine, and there is no such line. Two organisations with identical answers can be in different positions depending on context the tool cannot see, so it counts open questions instead.
Where do the risk indicators come from?: The ICO's own published list of processing operations likely to result in a high risk, and the criteria it endorses alongside them. The counting rule is the ICO's too, quoted in full in section 01 above. Nothing here is a Cadral threshold.
Why does answering “not sure” change the result?: Because on this subject not knowing is the finding. A “not sure” raises a question to settle, usually the cheapest thing on the list to find out. It never counts towards the tally: not knowing something is true is not evidence that it is.
Is any of this changing?: Yes, so every figure carries a date. The Data (Use and Access) Act 2025 changed parts of the UK GDPR: the automated decision-making guidance is still in draft, and the ICO's DPIA guidance is under review. Check the sources before relying on any figure.
What if the process touches no personal data at all?: Then most of this falls away, and the tool says so. Double-check that first, though: a name in a filename, an email address in a log, a photograph of a person, and a customer reference that maps to a single person are all personal data.

Carry on next door

Which job to automate first

If this check turns one candidate into a longer conversation than you wanted, this ranks the others so you know what else is on the table.

Open it

Build, buy or wait

Four questions on frequency, judgement, budget and who would build it. A straight answer, with the reasoning shown.

Open it

Take the list to somebody qualified

If the list is short, it is a short conversation; if it is long, that is worth knowing before you commission a build rather than after. We scope and build the automation around the answers, and the answers themselves come from a data protection adviser.

Book twenty minutes