DPIA for an AI project: the step-by-step method for compliant impact assessment
·
Updated on ·
By 
Aymeric Guyard · 7 min read
In brief
- The DPIA (GDPR Art. 35) is often the first concrete step in an AI project. It is required as soon as processing presents a high risk (scoring, sensitive data at large scale, surveillance, new technology). Conducted from the design stage, it secures the project and documents compliance.
When is a DPIA mandatory?
A DPIA is required when processing presents a high risk to individuals. For AI, this is frequent: evaluation or scoring, large-scale processing of sensitive data, systematic monitoring, use of new technology. When in doubt, carry one out. See also our general DPIA guide.
The 8-step method
- Describe the AI project: purposes, data, actors, lifecycle.
- Verify the necessity and proportionality of the processing.
- Map personal data and legal bases.
- Identify risks to individuals (unlawful access, alteration, loss, bias).
- Assess the severity and likelihood of each risk (matrix).
- Define mitigation measures (security, oversight, transparency).
- Obtain the DPO's opinion and, if necessary, consult the data subjects.
- Date, document and schedule periodic review.
The risk matrix
| Severity \ Likelihood | Low | High |
|---|---|---|
| Low | Acceptable risk | To monitor |
| High | To reduce | Priority measures / CNIL consultation |
Interaction with the AI Act
For a high-risk system, supplement the DPIA with the fundamental rights impact assessment (FRIA). A single document avoids duplication — see our dedicated DPIA + FRIA method.
Take action
Conduct your AI project DPIAs and manage your GDPR and AI Act compliance with Data Comply One.
Discover the AI Act software →Test my compliance free of charge