Your AI tool needs a DPIA: a GDPR Article 35 write-up sheet for small businesses (the four required parts, risk scores, sign-off and when to ask the authority)
What you get: a finished DPIA write-up sheet: one row per AI tool that screened in, one column for each of the four parts Article 35(7) GDPR requires, likelihood and severity scores before and after your measures, columns for DPO advice, people's views and the EU AI Act inputs, a decision formula that tells you when to consult your data protection authority (Article 36), a sign-off and review date, and two made-up example rows.
Short answer: if your DPIA screening says an AI tool needs a DPIA, you must write it before you start using the tool. It must at least describe the processing and purposes, explain why it is necessary and proportionate, assess the risks to people, and list the measures that address those risks. If a high risk remains that your own measures cannot reduce, you must consult your data protection authority before you start.
Step 1: before you write
- Run the DPIA screening sheet first. This write-up sheet is for the tools that screened in.
- One DPIA can cover a set of similar processing operations with similar high risks (Art. 35(1)), so a firm using the same AI transcription tool in three offices can write one row.
- Collect what you already have: the tool's entry in your Article 30 records, the supplier's processor agreement, your legitimate interest assessment if you rely on it, and for high-risk AI systems the provider's instructions for use.
Step 2: the DPIA write-up sheet (one row per AI tool, risk lines underneath)
| Column | What to write | Source |
|---|---|---|
| A. Processing and AI tool | [what you do] · [AI tool or supplier] · one row can cover a set of similar processing operations with similar high risks | Art. 35(1) |
| B. Screening result | Date and reason the tool screened in (for example two or more criteria on the DPIA screening sheet, or one of the three Article 35(3) cases). The DPIA must be done before the processing starts | Art. 35(1), 35(3) |
| C. Description and purposes | What data, about whom, from where, which AI features, who receives it, how long it is kept, and the purpose. If you rely on legitimate interests, name the interest | Art. 35(7)(a) |
| D. Necessity and proportionality | Why this processing is needed for the purpose; a less intrusive option you considered and why you did or did not take it; which fields you switched off; retention | Art. 35(7)(b) |
| E. Risks to people | One line per risk: what could go wrong for the person (wrong AI output used against them, data reused for training, staff monitored, leak of a transcript). Rate likelihood L and severity S from 1 to 3 (your own working scale) | Art. 35(7)(c); Recitals 84, 90 |
| F. Score before measures | =E_L*E_S per risk line, for example =F2*G2 if L and S sit in their own columns | Recital 90 (likelihood and severity) |
| G. Measures | Safeguards, security measures and ways to show compliance, one per risk: switch off training on your data, shorter retention, human review before decisions, access limits, notice wording | Art. 35(7)(d) |
| H. Score after measures | Re-rate L and S with the measures in place; same formula | Art. 35(7)(d); Art. 36(1) |
| I. DPO advice | If you have designated a DPO: date and summary of the advice, and whether you followed it. If not designated: write "none designated" | Art. 35(2) |
| J. Views of people or their representatives | Where appropriate: staff or works council asked, customer feedback, or why you did not ask | Art. 35(9) |
| K. AI Act inputs | High-risk AI systems: the provider's instructions for use read and used (Art. 26(9) AI Act). Fundamental rights impact assessment needed? Note where the DPIA already covers it (Art. 27(4) AI Act). Approved code of conduct followed (Art. 35(8) GDPR) | AI Act Art. 26(9), 27(4); GDPR Art. 35(8) |
| L. Decision | =IF(MAX(H2:H9)>=$Z$1,"Consult authority before start (Art. 36)",IF(MAX(H2:H9)>=$Z$2,"Start only with listed measures","Start")) with your own thresholds in Z1 and Z2 (for example 6 and 4 on the 1 to 9 scale). These numbers are a working aid, not a legal rule | Art. 36(1); Recital 84 |
| M. Sign-off | Name of the role that signs, date, and where the DPIA file is stored | Art. 5(2), 24(1) |
| N. Review | Change that triggers a review (new AI feature, new data, new supplier, new purpose) and next planned review date, for example =EDATE(M2,12) as your own routine | Art. 35(11) |
Keep the risk lines (E to H) on rows 2 to 9 under each tool, or on a second tab with the tool name in the first column. Sort by column L so "Consult authority before start" comes first. The 1 to 3 scales and the thresholds are your own working numbers; the GDPR asks you to assess likelihood and severity (Recital 90) but does not set a scale.
Step 3: if column L says "Consult authority before start"
- Do not start the processing. Article 36(1) requires prior consultation where the DPIA indicates a high risk in the absence of measures you take to mitigate it.
- Send the authority: the responsibilities of controller, joint controllers and processors where applicable; the purposes and means; the measures and safeguards; the DPO's contact details where applicable; the DPIA itself; and anything else it asks for (Art. 36(3)).
- Put the dates in your calendar: written advice within up to eight weeks of receipt, extendable by six weeks for complex processing; the authority tells you of an extension within one month, and the periods can be paused while it waits for information it asked for (Art. 36(2)).
Two example rows (made-up businesses, for illustration only)
Example 1, a small recruitment agency, "Example AI CV ranking tool": A. ranking applicants for client roles · B. screened in 01/10/2026: evaluation or scoring, and the tool is a high-risk AI system under Annex III (employment) · C. CVs, cover letters, AI fit score; applicants; shared with the client; kept 6 months · D. needed to handle volume; option of manual first sift kept for small roles; photo and age fields not sent to the tool · E. risk "good applicants dropped by a wrong score": L 2, S 3 → F 6 · G. recruiter reviews every rejection before it is sent; applicants told about the tool; scores not shared with clients · H. L 1, S 3 → 3 · I. none designated · J. two past applicants asked about the notice wording · K. provider's instructions for use read, oversight steps copied into G; fundamental rights impact assessment not required for this private agency, noted · L. "Start" with the measures in G (with thresholds 6 and 4) · M. managing director, 10/10/2026 · N. review on any new model version, next 10/10/2027.
Example 2, a dental clinic, "Example AI call transcription and summary tool": A. transcribing and summarising patient calls · B. screened in: health data (Art. 9) and new technology · C. call audio, transcripts, appointment and symptom notes; patients; supplier in the EU; audio deleted after 7 days · D. needed to reduce missed details; option to type notes by hand kept when the patient objects · E. risk "transcript with health details exposed": L 2, S 3 → F 6; risk "summary wrong about symptoms": L 2, S 2 → 4 · G. role-based access, two-step login, training on clinic data switched off, staff check every summary · H. L 1, S 3 → 3; L 1, S 2 → 2 · I. external DPO advised shorter audio retention, followed · J. patient notice reviewed by reception staff · K. not a high-risk AI system on its facts; noted · L. "Start" · M. practice owner, 15/10/2026 · N. review on any supplier change, next 15/10/2027.
Do this week
- List the AI tools that screened in and give each one row
- Fill C and D in plain words; most of it is already in your Article 30 records
- Write at least three risk lines per tool and score them before and after measures
- Check the measures against the privacy by default settings sheet and the access security sheet
- For high-risk AI systems, also check the Article 27 fundamental rights impact assessment and the human oversight log
- Sign off, file it, and set the review date
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 35 and 36 and Recitals 84 and 90, as published on gdpr-info.eu), Regulation (EU) 2024/1689 (AI Act Articles 26(9) and 27(4), as published on artificialintelligenceact.eu) and the Article 29 Working Party Guidelines on Data Protection Impact Assessment (wp248rev.01). Your national data protection authority publishes its own list of processing that needs a DPIA (Art. 35(4)); check it. Example rows are made up for illustration and do not describe any real business or supplier. Checked on 24 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients who start using AI for recruitment, call recording or customer scoring often find out about the DPIA only when a customer or employee asks for it. Hand them the screening sheet and this write-up sheet together with the client AI inventory, so each tool has a dated, signed row. Stay inside your professional rules and refer legal questions on.
Keep the DPIA next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once and attach its DPIA row and sign-off as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: DPIA screening sheet · Article 22 automated decision sheet · do we need a DPO? · Article 9 health data sheet
Sources
- Article 35 GDPR, Data protection impact assessment (with Article 36, Prior consultation, Recital 84 and Recital 90); official text: Regulation (EU) 2016/679
- EU AI Act Article 26, Obligations of deployers of high-risk AI systems (paragraph 9) and Article 27, Fundamental rights impact assessment (paragraph 4)
- Article 29 Working Party, Guidelines on Data Protection Impact Assessment (DPIA) (wp248rev.01)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.