Skip to main content

Data protection impact assessment (DPIA) for AI systems: GDPR Article 35

The DPIA is a GDPR duty, not an AI Act duty. When AI systems need one and how it relates to the FRIA.

A data protection impact assessment (DPIA) is a duty under GDPR Article 35, not under the AI Act. A controller must carry one out before processing that is likely to result in a high risk to people’s rights and freedoms. AI systems that profile people, process special-category data at scale or monitor public areas are typical cases.

The AI Act refers to the DPIA in Article 26(9) and Article 27(4). GDPR fines for breaking Article 35 reach EUR 10 million or 2% of worldwide annual turnover, whichever is higher (GDPR Article 83(4)). Next step: check whether your system processes personal data and who is the controller.

GDPR Article 35(3) names three cases that require a DPIA

  • Systematic and extensive evaluation based on automated processing

    This covers evaluation of personal aspects, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the person (Article 35(3)(a)). Example: credit scoring.

  • Large-scale processing of special categories or offence data

    This covers special categories of data under GDPR Article 9(1) and data on criminal convictions and offences under Article 10 (Article 35(3)(b)). Example: an AI system that processes health data at scale.

  • Systematic monitoring of a publicly accessible area on a large scale

    This covers monitoring of public areas on a large scale (Article 35(3)(c)). Example: video analytics in a public space.

Supervisory authorities publish lists of further processing types that require a DPIA (GDPR Article 35(4)).

A DPIA has four minimum parts

  • Description of the processing

    A systematic description of the processing operations and their purposes, including the legitimate interest pursued where applicable (Article 35(7)(a)).

  • Necessity and proportionality

    An assessment of whether the processing is necessary and proportionate to the purposes (Article 35(7)(b)).

  • Risks to data subjects

    An assessment of the risks to the rights and freedoms of the people whose data is processed (Article 35(7)(c)).

  • Measures against the risks

    The safeguards, security measures and mechanisms that address the risks and show compliance with the GDPR (Article 35(7)(d)).

The controller also seeks the advice of the data protection officer, where designated (Article 35(2)). It seeks the views of data subjects or their representatives where appropriate (Article 35(9)). It reviews the DPIA at least when the risk changes (Article 35(11)). If the DPIA shows a high risk that the controller does not mitigate, it consults the supervisory authority first (Article 36).

A DPIA and a FRIA are separate assessments that can share content

  • Different laws and subjects

    The DPIA comes from the GDPR and concerns the protection of personal data. The FRIA comes from AI Act Article 27 and concerns fundamental rights.

  • Different duty holders

    A DPIA falls on the controller, public or private. The FRIA falls only on the deployers listed in Article 27(1).

  • Shared content

    If the DPIA already meets an obligation of Article 27, the FRIA may cross-refer to it or include parts of it (Article 27(4)). The FRIA still has to cover each element of Article 27(1).

What Scanara’s DPIA assessment does

Scanara does not decide whether a DPIA is required. You, as controller, decide with your data protection officer.

Guided DPIA questions

A question bank follows the content of GDPR Article 35(7). You answer; Scanara stores the answers as evidence and drafts the DPIA report.

Answers pre-filled from scans

If you scanned a repository, Scanara pre-fills answers from the scan results. You check and correct them.

Link to the FRIA

A FRIA assessment can reference an approved DPIA of the same system (Article 27(4)).

Open the Scanara demo

Read more on the surrounding rules

Common questions about the DPIA

Does the AI Act require a DPIA?

No. The duty comes from GDPR Article 35. The AI Act only refers to it: deployers of high-risk systems use the provider’s information under Article 13 for their DPIA where applicable (Article 26(9)).

Does a GDPR data protection impact assessment replace the FRIA?

No. A data protection impact assessment can supply parts of the FRIA, because Article 27(4) lets the deployer cross-refer to it or include relevant parts, but only for obligations of Article 27 that it already meets. The FRIA still has to cover each element of Article 27(1).

When is a DPIA needed for an AI system?

When the processing is likely to result in a high risk to the rights and freedoms of natural persons (GDPR Article 35(1)). Article 35(3) names three cases that require one: systematic and extensive evaluation based on automated processing, large-scale processing of special categories or offence data, and large-scale monitoring of public areas. Check your supervisory authority’s list as well.

What happens if a required DPIA is skipped?

Fines of up to EUR 10 million or, for an undertaking, up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher (GDPR Article 83(4)(a)).

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.