DPIA for AI tools: when Article 35 GDPR applies, how to do one and what an outline looks like

Checked on 13 November 2026. General information, not legal advice. The assessments below are orientation; whether a DPIA is needed is decided case by case, ideally with your data protection officer. UK teams: the UK GDPR has a parallel DPIA rule that this page does not cover; check the ICO’s guidance separately.

When does an AI tool need a DPIA?

A DPIA is needed when processing is likely to result in a high risk to the rights and freedoms of natural persons. Article 35(1) GDPR asks for it before the processing starts, takes into account the nature, scope, context and purposes, and names the use of new technologies expressly. A single assessment can cover a set of similar processing operations that present similar high risks.^[1]

Article 35(3) lists three cases in which a DPIA is in particular required: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; large-scale processing of special categories of data under Article 9 or of data on criminal convictions and offences under Article 10; and large-scale systematic monitoring of a publicly accessible area.^[1] Two further layers sit on top. Under Article 35(4) each supervisory authority publishes a list of processing operations that require a DPIA, and under Article 35(5) it may publish a list of operations that do not.^[1] Check the lists of the authority responsible for you.

For AI specifically, the German Datenschutzkonferenz (DSK), the joint body of the federal and state authorities, wrote in its 2024 guidance that a DPIA is often needed when AI is used.^[3] That is a regulator’s position, not a statutory rule: the word is “often”, not “always”. It is an instruction to check, not an automatism. The Hamburg authority also lists the DPIA question in its checklist for chatbots.^[4]

If you first need to settle which plan and contract apply, read Is ChatGPT GDPR compliant?. For the overall rollout, see use AI at work without leaking data.

Which AI uses point towards a DPIA?

The table sorts typical uses by the features Article 35 names. It is a starting point for the conversation with your data protection officer, not a classification. If a use shows a feature in the middle column, consider a DPIA seriously and, when in doubt, carry one out.

The columns do not exclude each other. One use can show features on both sides, and then the overall picture decides. When in doubt, carry out the DPIA: the effort can be kept proportionate, and the exercise also gives you a first proper written account of risks and safeguards.

How do you do a DPIA in six steps?

The steps are a practical suggestion. The GDPR prescribes the minimum content of a DPIA, not the sequence.

1. Screen first. Describe on half a page which tool is used for what, which data flows and who is affected. Compare with the table above and the list of your supervisory authority to see whether a high risk is likely. Owner: the business unit with data protection.
2. Involve the right people. If a data protection officer has been designated, the controller must seek their advice (Article 35(2)).^[1] Speak early to the staff representatives too if performance or behaviour could be evaluated. Owner: management.
3. Describe the processing. Purpose, data types, people affected, recipients, retention, plan, contract. Owner: IT and the business unit.
4. Assess necessity and risks. Can the purpose be reached with less data? What could happen to the people affected, how likely is it and how severe would it be? Owner: data protection.
5. Decide on measures. Technical and organisational measures that reduce the risks, such as data classes, choice of plan, pseudonymisation before sending, training. Owner: IT and data protection.
6. Decide, document, review. Management approves or declines and sets a review date. Article 35(11) calls for a review where necessary, at least when the risk changes.^[1] Owner: management.

Two further points from Article 35. Where appropriate, the controller seeks the views of the data subjects or their representatives (Article 35(9)); for employees that can include the works council or other staff representatives. And compliance with an approved code of conduct is to be taken into account when assessing the impact (Article 35(8)).^[1]

What must a DPIA contain?

Article 35(7) sets out four minimum elements: a systematic description of the processing and its purposes, including any legitimate interest pursued; an assessment of necessity and proportionality; an assessment of the risks to the rights and freedoms of data subjects; and the measures envisaged to address the risks, including safeguards, security measures and mechanisms to demonstrate compliance.^[1] The outline below follows those four points and adds details that AI tools need in practice. It is a starting point, not a finished DPIA: the sample wording describes an invented case and has to be adapted to your company.

A company with a limited use can often fill this in on two to five pages. Article 36(1) requires the controller to consult the supervisory authority prior to processing where the DPIA indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate it. In practice that is the case where your own measures do not bring the risk down sufficiently.^[2] Under Article 36(2), if the authority is of the opinion that the intended processing would infringe the GDPR, it provides written advice within up to eight weeks of receiving the request. That period may be extended by six weeks, taking into account the complexity of the processing, and the periods may be suspended until the authority has obtained information it has requested.^[2] Agree this step with your data protection officer.

How should a DPIA treat data you cannot follow after sending?

Treat it as a stated limit of the assessment, not as a gap to hide. After an input has been sent to an AI provider, you cannot observe where it is processed, copied or stored; the sources for the description of the processing are the provider’s documentation and contract, and those commitments come with documented exceptions, for example residency that covers storage at rest for eligible plans only. A processor may also engage further processors, so the description should name the chain as far as the provider lists it. What has been sent cannot be recalled, which raises the weight of “disclosure beyond the contract” in the risk table: the likelihood may be low, but the harm cannot be undone.

That shifts the measures towards what happens before sending. Minimisation and replacing identifying details are the measures a controller applies with its own means, and Article 35(7)(d) asks for safeguards the controller can actually put in place.^[1] Record them as measures with an owner. Pseudonymising before sending lowers what is exposed; it does not replace the contract, the legal basis or the check, and automatic detection does not find everything. Ainym is a browser extension in closed beta that works this way: it detects personal data on the user’s own device and shows every match for confirmation before anything is sent. For the provider side, see where your data goes when you use an AI assistant.

What do you record if you conclude that no DPIA is needed?

Write the result down anyway. This follows from the accountability principle: Article 5(2) GDPR requires the controller to be able to demonstrate compliance.^[9] The note is short and answers four questions. Which processing was considered? Why, in your view, is a high risk not likely? Which features from Article 35(3) and from your authority’s list did you check? When will it be reassessed?

The note is only as good as the working rule behind it. If it says “no personal data”, you need an AI acceptable use policy and training, otherwise the assumption does not hold, and shadow AI can undermine it quietly. Pseudonymising before sending is one possible safeguard. It does not make the data anonymous for whoever holds the key, and the DSK points out that removing names and addresses is regularly not enough, because context can still identify people.^[3] Pseudonymisation vs anonymisation explains the difference, and how to pseudonymise data before ChatGPT shows the practice. The glossary defines the terms used here.

How does a DPIA relate to the AI Act?

For high-risk AI systems, the AI Act provides that deployers use the information supplied by the provider to carry out their DPIA (Article 26(9)).^[7] For the use cases listed in Annex III, such as recruitment and the evaluation of staff,^[11] the Commission’s timeline gives 2 December 2027 as the date from which these high-risk rules apply; Annex I product-embedded systems follow on 2 August 2028.^[8] The two sets of duties exist side by side. An overview is in EU AI Act obligations for deployers. For Microsoft products, see Microsoft Copilot and the GDPR.

On enforcement: failing to carry out a DPIA that is required falls under Article 83(4) GDPR, which allows fines of up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher.^[6] We know of no enforcement action about a missing DPIA for a chat assistant, which does not remove the duty.

Next step

This week, do the screening for your most important AI tool: half a page on purpose, data, people affected and contract, with the table above as a checklist. Show the result to your data protection officer. Then decide together whether to fill in the outline or to file the “no DPIA required” note with its reasoning. For a rollout that also covers policy, training and contracts, see use AI at work without leaking data.

This article is general information and not legal advice. It does not replace an assessment of your own case by your data protection officer or a lawyer. Last updated: 13 November 2026.