Do we need a data protection impact assessment (DPIA) before using AI?
Short answer
A DPIA is required when processing is likely to result in a high risk to people. With AI, that is usually the case when the AI systematically assesses or profiles people (such as applicants or employees), processes sensitive data at scale, monitors employees, or uses new technology in a way that affects people. It describes the processing, why it is necessary, the risks and the measures. For high-risk AI, you must use the provider's information in your DPIA (Article 26(9) AI Act).
Typical AI uses that need a DPIA
| AI use | DPIA? |
|---|---|
| Screening job applicants | Usually yes |
| Evaluating or monitoring employees | Usually yes |
| AI on health data in a clinic | Usually yes |
| Credit scoring of customers | Usually yes |
| Summarising customer enquiries with pseudonyms | Usually not |
| Drafting newsletters with no personal data | No |
Template in GoalCube
GoalCube has a draft DPIA that is filled in from the use in your AI register: purpose, data, risk, human decision and pseudonymisation. You add your own assessments and keep it alongside the register.
What to do
- Describe the use.Purpose, data, AI tool, who is affected and who sees what.
- Assess necessity and proportionality.Do you need the AI? Can you use less data?
- Identify the risks to people.Errors, discrimination, leaks, transfers outside the EU, lack of insight.
- Describe the measures.Pseudonymisation, human decisions, access control, logging, deletion.
- Talk to your DPO, if you have one.And consult your supervisory authority if the risk is still high.
What the law says
- Article 35 GDPR – data protection impact assessment
- Required when a high risk is likely; Article 35(7) sets out the content.
- Article 36 GDPR – prior consultation
- If the risk remains high, you must consult the supervisory authority.
- Article 26(9) AI Act
- Use the provider's information about the high-risk AI in your DPIA.
Questions and answers
Do we need a DPIA for using ChatGPT to write emails?
Usually not, if no significant personal data is involved and nobody is being assessed.
Do we need a DPIA for AI in recruitment?
Usually yes. Systematically assessing applicants with new technology is a classic example.
Does the supervisory authority have a list?
Yes. Every national supervisory authority publishes a list of processing that always requires a DPIA. Check it for your use.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.