DPIA for AI features: a step-by-step GDPR guide

A DPIA for AI is a data protection impact assessment, required by Article 35 GDPR, that you carry out before launching an AI feature likely to pose a high risk to people's rights, and most AI features that profile users, make or support decisions about them, or process sensitive data at scale will need one. It documents what the feature does with personal data, whether that is necessary and proportionate, which risks it creates and how you reduce them. The eight steps below take a product team from screening to sign-off, with a checklist at the end.

Key takeaways

• Article 35 GDPR requires a DPIA before processing that is likely to result in a high risk, "in particular using new technologies", and AI usually counts as a new technology.
• In Ireland, the DPC's list makes a DPIA mandatory for screened high-risk processing such as large-scale profiling, algorithmic decisions on access to services and combining datasets.
• AI-specific risks to assess include inaccurate outputs, bias, opacity, data leakage from prompts or models, function creep and transfers to model providers.
• If high residual risk remains after mitigation, you must consult the DPC before launch; it has up to eight weeks, extendable by six, to respond.
• Under the EU AI Act, deployers of high-risk systems must use the provider's information to carry out their DPIA, and some must also complete a fundamental rights impact assessment.

When does an AI feature need a DPIA?

An AI feature needs a DPIA when it is likely to result in a high risk to people's rights and freedoms. Article 35 of the GDPR makes it mandatory in three named cases: systematic and extensive automated evaluation, including profiling, that leads to decisions with legal or similarly significant effects; large-scale processing of special category or criminal data; and large-scale systematic monitoring of public areas.

The Data Protection Commission adds a rule of thumb from the EDPB-endorsed criteria: processing that meets at least two of the listed criteria, which include innovative use of technology, evaluation or scoring, and large-scale processing, will usually need a DPIA. An AI feature using personal data already ticks "innovative technology", so a second criterion is often enough.

Ireland also has its own list. The DPC's list of processing requiring a DPIA, adopted under Article 35(4), makes a DPIA mandatory, where screening shows likely high risk, for operations including:

• using personal data on a large scale for a purpose other than the one it was collected for;
• profiling vulnerable people, including children, for marketing or online services;
• using profiling, algorithmic means or special category data to determine access to services;
• profiling individuals on a large scale;
• combining or linking datasets for profiling or behavioural analysis.

Retraining a model on customer data, AI lead scoring, AI-assisted credit or hiring decisions and chatbots aimed at children all map directly onto these items.

Step 1: Screen the feature and record the decision

Start with a short screening note: what the feature does, what personal data it touches, and which of the criteria above apply. The DPC's list says organisations must assess, decide and document whether a DPIA is necessary, and that records of processing should include the reasons. If the answer is no, keep the note; it is your evidence.

Step 2: Describe the processing systematically

Article 35(7)(a) requires a systematic description of the processing and its purposes. For AI, map:

• Inputs: what users type or upload, data pulled from your systems, retrieval sources.
• Model: which model, who provides it, where it runs, whether inputs are used for training.
• Outputs: what the feature produces, who sees it, whether it drives decisions.
• Storage: prompts, outputs, logs, embeddings and their retention periods.
• Vendors and locations: model API providers, vector databases, hosting regions.

A data-flow diagram is the fastest way to get engineers and legal reading the same picture.

Step 3: Test necessity, proportionality and legal basis

Article 35(7)(b) requires an assessment of necessity and proportionality. Ask whether you need personal data at all, or whether pseudonymised or synthetic data would do; whether you need the full record or a few fields; and how long data must be kept. Then confirm the legal basis for each purpose. The EDPB's Opinion 28/2024 on AI models sets out a three-step test for relying on legitimate interests for developing or deploying AI models, and warns that a model trained on unlawfully processed personal data may affect the lawfulness of its deployment unless it has been properly anonymised.

Step 4: Identify AI-specific risks

Assess risks to people, not only to your company. Typical AI risks:

Risk	What it looks like
Inaccuracy	Hallucinated facts about a person, wrong summaries, misclassification
Bias and discrimination	Unequal error rates across groups in scoring or screening
Opacity	People cannot understand or challenge an automated outcome
Data leakage	Personal data exposed through prompts, logs, retrieval or model memorisation
Function creep	Data collected for support reused for training or marketing
Automated decisions	Decisions with significant effects made without meaningful human review
Transfers	Prompts sent to model providers outside the EEA
Security	Prompt injection exposing other users' data or tools

Rate each by likelihood and severity, as Article 35(7)(c) requires an assessment of the risks to the rights and freedoms of data subjects.

Step 5: Choose measures to reduce each risk

Article 35(7)(d) requires the measures envisaged to address the risks. Common AI mitigations:

1. Minimise and redact personal data before it reaches the model.
2. Turn off training on your data in vendor settings and confirm it in the contract.
3. Keep a person in the loop for decisions with significant effects.
4. Test accuracy and bias before launch and monitor them afterwards; our guide to evaluating an LLM feature before launch covers methods.
5. Restrict retrieval to documents the user is entitled to see.
6. Set short retention for prompts and outputs.
7. Tell users clearly when AI is involved and how to challenge results.
8. Choose EU hosting or valid transfer tools for model providers.

For a deeper look at handling customer data in AI features, see GDPR and LLMs: using customer data safely.

Step 6: Get advice, then assess residual risk

Article 35(2) requires you to seek the advice of your data protection officer where one is designated, and Article 35(9) says you should seek the views of data subjects or their representatives where appropriate. Then rate the residual risk. If it remains high, Article 36 requires you to consult the supervisory authority before processing. The authority has up to eight weeks to give written advice, extendable by six weeks for complex cases, so build that into launch plans.

Step 7: Align with the EU AI Act

If your AI system is high-risk under the AI Act, the DPIA links to new duties. Article 26(9) of Regulation (EU) 2024/1689 requires deployers of high-risk AI systems to use the provider's instructions and information to carry out their DPIA, and Article 27 requires public bodies, private entities providing public services and deployers of certain credit and insurance systems to carry out a fundamental rights impact assessment. Following the Digital Omnibus on AI, the high-risk rules for Annex III systems now apply from 2 December 2027. To check whether your system is in scope, use our high-risk AI classification checklist.

Step 8: Sign off, publish what you can, and review

Record who approved the DPIA and when, link it to your records of processing and add a review date. Revisit it whenever you change model, vendor, data sources or purpose. Publishing a summary is not required by the GDPR but builds trust with enterprise buyers.

DPIA for AI checklist

• [ ] Screening note completed and filed
• [ ] Data-flow diagram covering inputs, model, outputs, storage and vendors
• [ ] Legal basis recorded for each purpose, with balancing test if legitimate interests
• [ ] Necessity and minimisation review done
• [ ] Risk table covering accuracy, bias, opacity, leakage, function creep, automated decisions, transfers and security
• [ ] Mitigations assigned to owners with deadlines
• [ ] DPO advice recorded, data subject views considered
• [ ] Residual risk rated; DPC consulted if still high
• [ ] AI Act classification checked
• [ ] Sign-off and review date recorded

Frequently asked questions

Does every AI feature need a DPIA?

No. A DPIA is required where processing is likely to result in a high risk. An internal tool that summarises non-personal documents may not need one, but features that profile users, influence decisions about them or process sensitive data usually will. Document the screening either way.

Who is responsible for the DPIA, us or the AI vendor?

The controller is responsible, which is usually the company deploying the feature for its own purposes. The vendor should supply the technical information you need, and under the AI Act providers of high-risk systems must give deployers information they use for their DPIA.

How long does a DPIA for an AI feature take?

There is no fixed duration. A focused feature with clear data flows can be assessed in days; a complex system with sensitive data and many vendors can take weeks. Starting during design is far cheaper than retrofitting after build.

What is the difference between a DPIA and an AI Act fundamental rights impact assessment?

A DPIA under GDPR focuses on risks from processing personal data. The AI Act's fundamental rights impact assessment under Article 27 applies to certain deployers of high-risk AI systems and covers wider impacts on affected people. Where both apply, they can be prepared together.

Do we need to send our DPIA to the DPC?

Only if residual risk stays high after mitigation, in which case Article 36 requires prior consultation. Otherwise you keep it on file and provide it if the DPC asks.

If you are planning an AI feature and want a privacy-first design from the start, book a free 30-minute call.

Cover photo by GB The Green Brand on Pexels.