A DPIA for generative AI: when is it required and how do you do it?
Short answer
A DPIA is required when processing is likely to result in a high risk to the people concerned. With generative AI that is often the case: it is new technology, a lot of sometimes sensitive information goes in, and the output can be wrong. The DPIA describes the processing, tests necessity and proportionality, maps the risks and records the measures. Where the model runs decides much of the outcome.
When is a DPIA required?
Article 35 of the GDPR requires a DPIA when processing is “likely to result in a high risk”. European data protection authorities set out nine criteria; once processing meets two or more, a DPIA is generally needed. For generative AI, these apply most often:
- New technology: generative AI counts as an innovative use.
- Large-scale processing: many staff, many documents, many people concerned.
- Special-category or sensitive data: health, criminal records, financial data.
- Systematic monitoring: when staff use is logged and analysed.
- Evaluation or scoring: when AI is used to assess people.
National authorities also publish lists of processing for which a DPIA is always required, such as the Dutch AP list, the German DSK “Muss-Liste” and the French CNIL list. Large-scale monitoring of employees and large-scale processing of health data feature on them.
The steps of a DPIA for an AI application
- Describe the processing. Which AI application, for what purpose, which data goes in, who uses it, where the model runs, which parties are involved and how long what is kept (prompts, output, logs)?
- Test necessity and proportionality. Can the purpose be reached with less data? Can names be left out? Is there a lawful basis?
- Map the risks to the people concerned, not to the organisation. See the AI-specific risks below.
- Record measures that reduce the risks, with an owner per measure.
- Ask the DPO for advice and record it.
- Decide and review. If a high risk remains after measures, you must consult the supervisory authority beforehand (Article 36 GDPR). Review the DPIA with every material change, such as a new model or a new data source.
Risks specific to generative AI
| Risk | Possible measure |
|---|---|
| Data is used to train models | Exclude it contractually, or use a model that runs on your own infrastructure and does not train on your input |
| Transfer outside the EU | Processing in the EU; preferably no outside party in the processing |
| Inaccurate output about people | Human review before output is used for decisions |
| Too much data in prompts | Safeguards that stop identifying patterns; instructions per department |
| Unauthorised access through the AI | Rights per role; the AI only sees sources the user has access to |
| Logs as a new collection of personal data | Short retention, limited access, set out in policy |
How your hosting choice shapes the DPIA
Much of the risk in an AI DPIA concerns the outside party: what does the vendor do with the data, where is it, who can access it, which law applies? With an AI service from a US vendor you must assess, among other things, the transfer and the CLOUD Act. See The CLOUD Act and your European data.
If the model runs on a node of your own in your server room, most of those questions fall away: there is no outside processor of the content, no transfer and no training on your data. The DPIA then focuses on what you arrange yourself: access, safeguards, retention and human review. With werqly you set those in werqly AI Control, with an audit log as evidence. See also Is ChatGPT GDPR-compliant?
Frequently asked questions
Questions on this topic
Is a DPIA required for ChatGPT?
Often, yes, when staff process personal data with it. Generative AI counts as new technology, and combined with large-scale use or sensitive data, for example, you quickly meet two or more of the criteria that make a DPIA mandatory.
Who carries out the DPIA?
The organisation deploying the AI, as controller. In practice the process owner does it with privacy and security specialists. The data protection officer advises, but does not carry out the DPIA.
What is the difference between a DPIA and a FRIA under the AI Act?
A DPIA concerns risks to the protection of personal data. A FRIA, the fundamental rights impact assessment, is required under the AI Act for certain deployers of high-risk AI, such as public bodies. The two can be combined in one exercise.
Does a DPIA need redoing if we switch AI model?
If the change alters the risks, yes: a different model at a different vendor, a new data source or a different purpose. A new version of the same model on the same own infrastructure usually needs only a short check.
Sources
- Article 29 Working Party / EDPB — Guidelines on DPIAs (WP248 rev.01)
- Dutch Data Protection Authority — Data protection impact assessment (DPIA)
- GDPR (Regulation (EU) 2016/679), Articles 35 and 36
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.