In short. GDPR Article 35 requires a data protection impact assessment before personal data processing likely to create high risk to people’s rights and freedoms.
Definition: A data protection impact assessment (DPIA) examines the risks of processing personal data, meaning information about identified or identifiable people, and the measures to address those risks. Article 35 of the General Data Protection Regulation (GDPR) requires it before processing likely to create a high risk to people's rights and freedoms.
Key facts
- GDPR Article 35 places the assessment duty on the controller: the person or organisation deciding the purposes and means of processing.
- CNIL's AI assessment guidance of 7 June 2024 presumes a DPIA is required when processing meets at least two risk criteria, while retaining a case-specific assessment of high risk.
- CNIL's AI development recommendations of 5 January 2026 distinguish assessment during model development from assessment of deployment, when the system is put into use.
When is a DPIA required?
Under Article 35(1), the high-risk test considers the nature, scope, context and purposes of processing, particularly where new technologies are used. Article 35(3) specifically requires an assessment for:
- Systematic and extensive evaluation of personal aspects through automated processing, including profiling, where decisions have legal or similarly significant effects on people.
- Large-scale processing of special categories of personal data, such as health data, or data about criminal convictions and offences.
- Systematic monitoring of a publicly accessible area on a large scale.
Article 35(4) also requires supervisory authorities to publish lists of processing operations requiring assessment. A screening decision therefore considers the applicable authority's list alongside the general high-risk test.
How does CNIL apply the test to AI?
CNIL's AI assessment guidance highlights sensitive or highly personal data, large-scale collection, data about vulnerable people, combining datasets, and innovative uses. Meeting two criteria creates a presumption of an assessment; high risk can require one even below that threshold. Conversely, the controller can establish with sufficient certainty that processing meeting several criteria exposes people to no high risk.
For a concrete example, CNIL describes collecting a considerable volume of publicly accessible personal data from the internet to train a conversational agent's language model as large-scale processing. It also explains that established AI techniques with known risks may fall outside the innovative-use criterion.
What must the assessment contain?
Article 35(7) specifies the minimum contents. This outline summarises its structure:
GDPR Article 35(7)
(a) Processing operations and purposes
(b) Necessity and proportionality
(c) Risks to people's rights and freedoms
(d) Measures to address the risks and demonstrate compliance
The description includes any applicable legitimate interest pursued by the controller. Article 35(2) requires advice from the data protection officer where one is designated. Article 35(11) requires review where necessary, at least when the risk represented by processing changes.
For AI, CNIL's development recommendations identify risks including extraction of personal data from a system and false content about real people. The assessment must provide measures to reduce and maintain risks at an acceptable level.
Who assesses deployment, and what happens if high risk remains?
CNIL's development recommendations recommend a lifecycle assessment when operational use is known. Where the developer and deployer differ, the deployer is responsible for assessment of deployment. For a general-purpose system, which supports different applications, the developer's assessment covers development and should be supplied to users for their own analysis.
GDPR Article 36(1), read with recital 94, requires consultation with the supervisory authority before processing when the controller cannot sufficiently mitigate the identified high risk.
Related terms
- GDPR lawful basis for web data
- GDPR data minimisation
- CNIL guidance on AI web scraping
- GDPR transparency for web collection
FAQ
Does using AI automatically require a DPIA?
The trigger is processing likely to create high risk. CNIL's AI assessment guidance explains that using AI does not systematically meet the innovative-use criterion; the other risk criteria still require assessment.
Can you rely on a provider's assessment?
CNIL's development recommendations allow the provider's assessment to support your analysis. As controller for deployment, you remain responsible for assessing that phase and its processing risks.
Can one DPIA cover several processing operations?
Article 35(1) allows a single assessment for similar processing operations presenting similar high risks.
Sources
- European Union, "Regulation (EU) 2016/679", 27 April 2016
- CNIL, "Carrying out an data protection impact assessment if necessary", 7 June 2024
- CNIL, "AI system development: CNIL's recommendations to comply with the GDPR", 5 January 2026
Check how a page reads to answer engines. Open the GEO score analyzer