Skip to content
>_<
AI EngineeringWiki
DEEN

Data Protection Impact Assessment (DPIA)

Compliance · 8 min · Updated: March 2026

A Data Protection Impact Assessment (DPIA) is required under Art. 35 GDPR when data processing is likely to result in a high risk to the rights and freedoms of natural persons. This is frequently the case with AI systems.

When is a DPIA required?

  • Automated individual decision-making with legal effects (Art. 22 GDPR)
  • Large-scale processing of special categories of personal data
  • Systematic monitoring of publicly accessible areas
  • Profiling with significant effects on data subjects
  • New technologies (AI systems qualify as new technology)
DPIA Process in 6 Steps — illustration from the German article

DPIA Process in 6 Steps

  1. 1. Describe the processing — What data, what purpose, what legal basis, what recipients?
  2. 2. Assess necessity and proportionality — Is the processing necessary? Are there less intrusive alternatives?
  3. 3. Evaluate risks to data subjects — Likelihood and severity of potential harm.
  4. 4. Define mitigation measures — Technical and organizational measures, pseudonymization, access controls.
  5. 5. Create documentation — Record findings, measures, and residual risks.
  6. 6. Review regularly — A DPIA is not a one-time document — update when the system changes.
DPIA and EU AI Act — illustration from the German article

DPIA and EU AI Act

The EU AI Act supplements the GDPR DPIA with AI-specific requirements:

  • High-risk AI systems require a DPIA plus an AI-specific risk assessment
  • Art. 27 EU AI Act requires a fundamental rights impact assessment for certain deployers
  • The DPIA can be combined with the AI risk assessment

Self-Hosted AI Advantage

With self-hosted AI (e.g., Ollama locally), the DPIA is significantly simpler: no third-country transfers, no data processing agreements needed, full control over data. Residual risk is lower than with cloud AI.

Further Reading

Sources

Related articles

Compliance

GDPR Basics

What does GDPR mean for AI applications? Data protection, consent, retention.

Compliance

Privacy Practices

Practical implementation — TOM, DPA, documentation, data subject rights.

Compliance

EU AI Act

Risk classes, prohibitions, transparency requirements for AI systems in the EU.

Was this article helpful?

Continue the learning path

The learning path puts these articles in order, and the Hub carries the building blocks we have checked in our own operations.

Open the learning pathOpen the Hub
Why AI Engineering
  • Local and self-hosted
  • Documented and verifiable
  • From our own operations
  • Made in Austria
Not legal advice.