gdpr dpia screener for ai
Under GDPR, processing that is likely to be high risk needs a data protection impact assessment before it starts. AI projects meet the tests more often than teams expect, because the guidelines list new technology as a criterion. Tick what applies and the screener tells you whether a DPIA is required and what else to put in place, with the articles to check.
dpia not indicated
a dpia is not indicated
why
- No Art. 35(3) case and none of the nine criteria was selected.
- Also check your supervisory authority's own list of processing that always needs a DPIA (Art. 35(4)); national lists add cases.
what to do
- Keep a short written record of this screening and the reasons a DPIA is not needed Art. 5(2)
- Sign a processing agreement with the AI vendor that covers sub-processors, retention, and whether your data trains their models Art. 28
- Record the processing in your records of processing activities Art. 30
Screening aid, not legal advice. Based on Art. 35 GDPR and the WP29 DPIA guidelines (WP248 rev.01) endorsed by the EDPB. National authorities publish their own lists, so check yours. Nothing you enter leaves your browser.
questions
when is a dpia mandatory?
Always for the three cases in Art. 35(3): systematic automated evaluation with legal or similar effects, large-scale special-category or criminal data, and large-scale monitoring of public areas. Beyond those, the WP29 guidelines endorsed by the EDPB say processing that meets two of nine criteria needs one in most cases.
does using an llm always need a dpia?
No. Using new technology is one criterion, so an LLM that processes personal data meets one already. Add a second, such as profiling, sensitive data or large scale, and a DPIA is usually required.
how does this relate to the eu ai act?
Deployers of high-risk AI systems must use the provider's instructions for use in their DPIA (Art. 26(9)), and some deployers must also run a fundamental rights impact assessment (Art. 27). The EU AI Act auditor works out whether a system is high-risk.
is this legal advice?
No. It is a screening aid. National supervisory authorities publish their own lists of processing that always needs a DPIA, so check yours and take the result to your data protection officer.
more free tools
- ai roi & token cost estimatorMonthly Claude API cost, cost per task and ROI for a workload
- eu ai act compliance auditorRisk tier, obligations and dates for one AI system
- agent workflow fit scorerIs this process a good fit for AI agents, and what shape?
- ai build vs buy calculatorThree-year cost: SaaS tool, custom agents, or keep it manual
- ai accuracy proof calculatorHow many test cases prove a vendor's accuracy claim?
- ai model routing calculatorWhat sending each request to the cheapest capable model saves
- human review staffing calculatorHow many reviewers an AI workflow's escalations need
- ai vendor scorecardWeighted comparison of AI vendors, with must-haves and a swing check
Want the numbers checked against your own process? Book a 20-minute call.