Data Protection Impact Assessment (DPIA) for AI

How to use this document

• Use it to decide whether processing of personal data with AI needs an impact assessment and, if it does, to document it: description, necessity and proportionality, risks to individuals, measures, residual risk, consultations and sign-off.
• It needs a clear owner: usually the data protection officer (DPO) or the privacy function, with the system owner responsible for supplying the system details.
• Before adopting it, the organization should decide its risk methodology (the scale in section 7 or the one it already uses), who approves assessments, and which residual risk level triggers escalation or consultation with the authority.
• Complete one assessment per AI system or per processing activity. If several activities are very similar, one assessment can cover them, explaining why.
• Always start with the screening in section 2. If it concludes that a full DPIA is not needed, file the record of that decision.
• Keep only the country variants for the jurisdictions where the processing takes place and delete the rest. Several variants may apply at once.
• Fields marked [COMPLETE] include points worth confirming with your advisor, especially deadlines, filings with the authority and the scope of recent rules.
• Before approval, have it reviewed by in-house legal or an outside advisor, and have the DPO give a written opinion.
• Have the assessment signed by a person with authority over the processing, store it under version control and link it to the record of processing activities.

Data Protection Impact Assessment (DPIA) for AI

Field	Content
Organization	[LEGAL ENTITY NAME] ([ORGANIZATION NAME])
System or processing assessed	[AI SYSTEM]
Main vendor	[VENDOR]
System owner	[OWNER]
Function	[RESPONSIBLE FUNCTION]
Countries where it operates	[COUNTRY]
Reference in the record of processing activities	[COMPLETE]
Assessment version and date	[COMPLETE] / [DATE]
Status	Draft / Under review / Approved / Superseded
Privacy contact	[PRIVACY EMAIL]

1. Purpose and scope

1.1. This assessment documents the analysis [ORGANIZATION NAME] carries out before starting, or materially changing, processing of personal data that involves an artificial intelligence system.

1.2. Its purpose is to identify the risks to the rights and freedoms of the people affected, decide on the measures that reduce them, and record the final decision and who made it.

1.3. It covers the full processing lifecycle: data collection, model training or fine-tuning where applicable, production use, outputs and decisions, retention, deletion and system retirement.

1.4. This assessment does not replace other assessments that may be required, such as the fundamental rights impact assessment under the EU AI Act or an internal ethics review, but it can serve as their basis.

2. Screening: is a DPIA needed?

2.1. Answer each criterion. One "Yes" in part A, or two or more in part B, means a full assessment should be carried out, unless the file documents why not.

Part A. Cases that usually require an assessment

Criterion	Yes / No	Comment
Systematic evaluation of personal aspects, including profiling, leading to decisions with legal or similarly significant effects (employment, credit, insurance, access to services)
Large-scale processing of sensitive or special category data (health, biometrics for identification, ethnic origin, sexual orientation, union membership, beliefs) or criminal data
Large-scale systematic monitoring of publicly accessible areas (for example, video surveillance with AI analysis)
The processing appears on the authority's published list of processing that requires an assessment
A national rule expressly requires it for this use (see "Country variants")

Part B. High-risk indicators

Indicator	Yes / No	Comment
Scoring, evaluating or predicting people (performance, creditworthiness, behavior, location)
Automated decisions, or AI outputs that in practice are applied without real human review
Systematic monitoring of people, including workers
Sensitive or highly personal data (communications, location, finances)
Large-scale processing (by number of people, data volume, duration or geographic reach)
Combining datasets collected for different purposes
Vulnerable people: minors, workers or job candidates, patients, people in economic dependence
Novel technology: generative AI models, AI agents that act on systems, biometric or emotion recognition
Training or fine-tuning models with personal data
The output may prevent people from exercising a right or accessing a service or contract
Transfer of data to AI vendors outside the country

2.2. Screening decision.

Field	Content
Result	Full DPIA needed / Not needed / Needed as a precaution
Reasoning	[COMPLETE]
Data protection officer opinion, if there is one	[COMPLETE]
Decided by and date	[OWNER] / [DATE]
Next screening review	[COMPLETE] (and whenever the system, data or purpose changes)

2.3. If the assessment is found not to be needed, this table and the completed parts A and B are kept as the record of the decision.