Data Protection Impact Assessment (DPIA)

What is a data protection impact assessment?

A data protection impact assessment (DPIA) is a written review you do before you start using personal data in a way that could seriously affect people. It describes the plan, checks whether it is necessary, lists the risks to the people involved, and records how you will reduce those risks.

The requirement comes from GDPR Article 35. A DPIA is required when processing, "in particular using new technologies", is likely to result in a high risk to people's rights and freedoms. The GDPR names three cases where one is always required:

• Systematic, extensive evaluation of people based on automated processing, including profiling, that leads to decisions with legal or similarly significant effects on them.
• Large-scale processing of sensitive data (such as health data) or criminal records.
• Large-scale, systematic monitoring of a public place.

Each national regulator also publishes its own list of processing that needs a DPIA. If a DPIA shows a high risk you cannot reduce, you must consult the regulator before you start (Article 36).

Why it matters to you

Adding a new AI vendor is a common moment to ask whether you need a DPIA. AI is a new technology, and some AI uses touch exactly the cases above. Examples that may fit include scoring job candidates or automatically blocking payments flagged as fraud. See automated decision-making.

A simple AI writing helper that never sees customer personal data may not need one. A feature that sends customer records to a new AI subprocessor for analysis deserves a closer look.

Vendor terms feed directly into the risk section. Does the vendor train its models on your data? How long does it keep inputs? Does a person at the vendor review them? A vendor can change these answers after you finish the DPIA. For example, Lovable now trains its AI on your prompts and code by default. A change like that can make an older DPIA out of date.

Your vendor has to help. The EDPB says a processor "must also assist the controller in carrying out data protection impact assessments when required", but the controller stays accountable and has to ask for that help (EDPB Guidelines 07/2020, paragraphs 137 and 138).

What to check

• Before you turn on a new AI feature or vendor, write down what personal data it will receive and what it does with it.
• Check whether the use matches one of the Article 35 cases or your regulator's list.
• Read the vendor's DPA and AI terms for AI training, retention and human review. Quote them in your DPIA.
• Ask the vendor for its own documentation to support your DPIA, as its DPA may promise.
• Set a review date, and reopen the DPIA when the vendor changes its terms.

How Venpo helps

Venpo watches your vendors' AI terms, DPAs, privacy policies and subprocessor lists and emails you when one changes. Its Fine Print Scan answers whether each vendor trains AI on your data and how long it keeps data, two facts most DPIAs need.