When does an AI tool need a DPIA under the GDPR?

Before you start using it, when the processing is likely to result in a high risk to people's rights and freedoms (Article 35(1) GDPR). Article 35(3) names three cases where a DPIA is always required: systematic and extensive automated evaluation, including profiling, that leads to decisions with legal or similarly significant effects; large-scale processing of special category or criminal-offence data; and large-scale systematic monitoring of a publicly accessible area. The data protection authorities' guidelines (WP248 rev.01) add nine criteria: in most cases, processing that meets two of them needs a DPIA.

Is using a new AI tool on its own enough to need a DPIA?

Not on its own, but it counts. 'Innovative use or applying new technological or organisational solutions' is one of the nine criteria, and Article 35(1) mentions new technologies. So an AI tool that also meets one other criterion, such as processing staff data (employees count as vulnerable data subjects because of the power imbalance) or evaluating people, usually reaches two.

Do I have to publish the DPIA or send it to the authority?

No to both, in the usual case. The guidelines say publishing is not a legal requirement, though a summary can build trust. You must consult your data protection authority before processing only if the DPIA shows a high risk that you cannot reduce with your own measures (Article 36(1)); the authority then has up to eight weeks to give written advice, which it can extend by six weeks (Article 36(2)).

Does this AI tool need a DPIA? A one-page GDPR screening sheet for small EU businesses (the 9 criteria, a score per tool, 3 filled examples)

Updated 21 Oct 2026 · Disclosure: the EURO AI Register mentioned below is an Unadhi product with a free edition. This guide is for information only, not legal advice.

What you get: a finished DPIA screening sheet to fill once per AI tool that touches personal data: the three cases where the GDPR always requires a DPIA, the nine criteria the EU data protection authorities use (two or more usually means a DPIA is needed), a score and decision line, three filled example rows (made up, to show the level of detail), the four parts a DPIA must contain, and when you must consult your authority before you start.

The short answer

Under Article 35(1) GDPR, a controller must carry out a data protection impact assessment (DPIA) before processing that is likely to result in a high risk to people's rights and freedoms, "in particular using new technologies". One DPIA may cover a set of similar processing operations with similar high risks. If you have a data protection officer, you must ask for their advice (Article 35(2)).

To decide whether the risk is likely to be high, the Article 29 Working Party guidelines WP248 rev.01 (adopted 4 April 2017, last revised 4 October 2017) list nine criteria and say: "In most cases, a data controller can consider that a processing meeting two criteria would require a DPIA". Sometimes one criterion is enough. Many AI tools score two quickly, because new technology is itself a criterion.

Step 1: the three cases where a DPIA is always required

Systematic and extensive evaluation of people based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based (Article 35(3)(a)).
Large-scale processing of special category data (Article 9(1)) or criminal-offence data (Article 10) (Article 35(3)(b)).
Systematic monitoring of a publicly accessible area on a large scale (Article 35(3)(c)).

Any yes: you need a DPIA; skip to the decision line. Also check your own authority's published list of processing that always needs a DPIA (Article 35(4)); it may name AI uses such as employee monitoring or scoring.

Step 2: score the tool against the nine criteria

#	Criterion (WP248)	Ask about the AI tool	Typical AI examples	Met?
1	Evaluation or scoring	Does the tool rate, rank, profile or predict anything about a person: work performance, creditworthiness, health, interests, reliability, behaviour, location?	CV ranking, lead scoring, sentiment scores on support calls	[Y/N]
2	Automated decision with legal or similar significant effect	Does its output decide, or nearly decide, something that matters for the person: a job, a loan, a price, access to a service?	Auto-reject below a score; auto-decline of a refund	[Y/N]
3	Systematic monitoring	Does it observe, monitor or control people in an organised way, including in a publicly accessible place?	Productivity tracking, call recording for every call, camera analytics in a shop	[Y/N]
4	Sensitive or highly personal data	Special category data (health, biometrics, religion, union membership), criminal data, or highly personal data such as emails, private notes, financial or location data?	Transcripts that mention health; voiceprints; staff mailboxes	[Y/N]
5	Large scale	Many people, many data items, a long-running or permanent use, or a wide geographic reach?	Chatbot open to all website visitors; every customer call	[Y/N]
6	Matching or combining datasets	Does it join data collected for different purposes or by different organisations in a way people would not expect?	Enriching CRM records with scraped profiles; joining chat logs with purchase history	[Y/N]
7	Vulnerable data subjects	Children, employees, patients, elderly people, or anyone in a weaker position who cannot easily refuse?	Any tool used on your own staff or job applicants	[Y/N]
8	Innovative use or new technology	A new technology or a new way of using one, where the effects on people are not yet well known?	Generative AI, voice or face recognition, emotion detection	[Y/N]
9	Prevents a right or access to a service or contract	Can the result stop someone getting or keeping a service, a contract or a right?	Credit check before offering payment terms; fraud flag that blocks an account	[Y/N]

Decision line: criteria met = [count]. 0: no DPIA, write one line saying why and date it. 1: no DPIA unless that one criterion is serious (write your reason). 2 or more: carry out a DPIA before you use the tool on real data. Re-run the screen when you change the tool, its settings, its data or its use (Article 35(11)).

Three filled example rows

Tool	Criteria met	Count	Decision
[AI writing assistant, staff paste no customer data; company policy forbids it]	[8 innovative use]	[1]	[No DPIA; reason: no personal data by policy, checked in staff AI use policy; review in 12 months]
[AI meeting note-taker on all sales and team calls]	[3 systematic monitoring, 4 highly personal data, 7 employees, 8 innovative use]	[4]	[DPIA before roll-out; owner [name]; due [date]]
[CV ranking in applicant tracking system]	[1 scoring, 2 significant effect if low scores are rejected, 7 applicants in a weaker position, 8 innovative use, 9 access to a contract]	[5]	[DPIA required; also high-risk under AI Act Annex III point 4; keep a person reviewing every rejection]

The three rows above are made-up examples to show the level of detail, not a statement about any real product. Your own answers depend on how you set up and use the tool.

Step 3: what the DPIA must contain (Article 35(7))

A systematic description of the processing and its purposes, including any legitimate interest you rely on. For an AI tool: what goes in (prompts, uploads, recordings), what comes out, who sees it, the supplier and its sub-processors. Your Article 30 entry for the tool is a good start.
Necessity and proportionality: why you need the tool for that purpose, and why less data or a less intrusive setting would not do.
The risks to people: for example wrong or biased outputs, people not knowing they are recorded, data reused to train the supplier's model, data kept too long, transfers outside the EU.
The measures that address each risk: settings, contracts, access limits, human review, notices to staff and customers, deletion periods.

Where appropriate, ask the people affected or their representatives for their views (Article 35(9)): with staff tools, that usually means the works council or staff representatives.

Step 4: do you need to consult your authority?

Only if the DPIA shows that the processing would result in a high risk without the measures you can take yourself, and you cannot bring it down (Article 36(1)). You then consult your data protection authority before you start. The authority gives written advice within up to eight weeks, which it can extend by six weeks for complex cases, telling you of the extension within one month (Article 36(2)). Send it the DPIA, the roles of each party, the purposes and means, your safeguards and your DPO's contact details if you have one (Article 36(3)).

How this links to the AI Act

If the AI tool is a high-risk AI system and you are the deployer, Article 26(9) of the AI Act tells you to use the information the provider must give you under Article 13 (the instructions for use) when you carry out your DPIA. Ask the provider for it in writing. Where you also have to carry out a fundamental rights impact assessment (Article 27), Article 27(4) lets you cross-refer to the relevant sections of your DPIA or include parts of it, so you do not write the same thing twice. See who must do a fundamental rights impact assessment.

Do this week

List every AI tool staff use with personal data, including free accounts (SME AI inventory template)
Run Step 1 and Step 2 for each tool and write the count and decision
For each tool at 2 or more, name an owner and a date to finish the DPIA before (further) use
Ask each of those suppliers for their instructions for use, data processing terms and sub-processor list
Diary a re-screen when you change a tool's settings or use, and at least once a year

This sheet is a screening aid, not a legal opinion or proof of compliance. GDPR references are to Regulation (EU) 2016/679 (Articles 35 and 36 text checked on 21 October 2026). The nine criteria, the two-criteria rule of thumb and the point that publishing a DPIA is not required are quoted or summarised from WP248 rev.01, downloaded on 21 October 2026 from the European Commission's Article 29 Working Party archive. AI Act Articles 26 and 27 were checked against the Commission's AI Act Service Desk (consolidated text as at 27 July 2026). Your national authority's Article 35(4) list may add cases; check the official source. Spot an error in this guide? Write to mininglife7@gmail.com.

For accountants and tax advisers

Clients often roll out an AI tool on staff or customer data without asking whether a DPIA is needed. At the next review, run Step 1 and Step 2 with them for each tool alongside the client AI inventory workshop, and hand over the count and decision line. Stay inside your professional rules and pass the DPIA itself to a privacy professional or lawyer where the score is 2 or more.

Keep the screen next to your AI register

The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, pick your role (usually deployer), and attach the filled screening sheet, and the DPIA where you needed one, as evidence records.

When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.