IT emails the privacy officer: Copilot goes live for the whole organisation next month, and does that need a DPIA? The privacy officer knows the answer is not in the licence contract, and not in the name of the tool either.
The answer is: not automatically, but in most organisations, yes. The obligation attaches to the risk of the processing. For generative AI used by dozens of people, with customer or staff data in the prompts, that risk rarely comes out low.
When does Article 35 GDPR require a DPIA?
Article 35 GDPR requires a data protection impact assessment when processing, taking into account its nature, scope, context and purposes, is likely to result in a high risk to the rights and freedoms of individuals. The article itself names three situations, including large-scale processing of special categories of data and systematic evaluation of personal aspects.
The EDPB guidelines (WP248 rev.01) make that workable with nine criteria: evaluation or scoring, automated decisions with legal effect, systematic monitoring, sensitive data, large-scale processing, matching or combining datasets, vulnerable data subjects, innovative use of new technology, and processing that can prevent people from exercising a right or using a service. The rule of thumb: if processing meets two criteria, a DPIA is generally required.
On top of that, the Dutch Autoriteit Persoonsgegevens keeps a list of processing operations for which a DPIA is always mandatory, with seventeen categories, including the monitoring of employees and large-scale processing of health data. If your processing is on that list, the weighing is no longer needed.
Why does AI at work often meet several criteria?
One criterion is almost always met with generative AI: innovative use of new technology. In practice, more follow quickly.
| What the assessment looks at | How it plays out with AI tools at work |
|---|---|
| Innovative use of new technology (criterion) | Generative AI, especially with memory or a connection to your own documents |
| Large-scale processing (criterion) | Dozens to hundreds of employees, daily, with different data every time |
| Sensitive data (criterion) | Absence, health, finances and appraisals in prompts from HR, care and finance |
| Vulnerable data subjects (criterion) | Employees, whose data and behaviour end up in the tool |
| Transfers outside the EU (context) | Most well-known tools process in the US, unless a business contract arranges otherwise |
Transfer is not a criterion of its own in the list of nine, but it belongs to the context Article 35 asks you to weigh, and with AI tools it is rarely neutral. What the table shows: the outcome is decided by the use, not by the tool. A single employee having job adverts rewritten meets at most the first criterion. An organisation where customer service, HR and finance all use the same tool meets four. Which data is at stake in each case is covered in GDPR and AI tools at work.
What goes into the DPIA for AI use?
The GDPR broadly prescribes the contents: a description of the processing and its purpose, an assessment of necessity and proportionality, the risks to individuals, and the measures. For AI use that comes down to:
- Which tools. Not only the approved ones. Also the tools people are already using, because the DPIA describes the actual processing, not the intended one.
- Which data. Per kind of work: customer contact, personnel files, contracts, client records. And which of those are special categories of data.
- Which legal basis. Often legitimate interest, with the balancing test attached; for public bodies, the public task. The measures the GDPR asks for with AI use belong here.
- Which measures. An approved alternative per kind of use, a data processing agreement with the vendor, an explanation for staff, and a marking of sensitive data before a prompt leaves.
- Who maintains it and when. A DPIA is a document with a date. It needs a moment at which the description is held up against practice again.
The relation to the AI Act in two sentences: the FRIA in Article 27 assesses the impact on fundamental rights of deploying a high-risk system, and is mandatory from 2 December 2027 for public bodies and a limited group of private organisations. For everyday use of AI tools the DPIA remains the instrument, and Article 26 of the AI Act refers to it itself.
What does this look like in an organisation?
A housing association writes a DPIA for Copilot in the spring: which data, which legal basis, which settings, an explanation for staff. The document is solid. Six months later an inventory shows that ChatGPT, Perplexity and a meeting transcription tool are in use alongside Copilot. The last one processes tenants' voices and names, and appears in no document at all.
That is not an incident, it is the normal distance between a description and a working day. The DPIA described one tool; practice had four. The association adds the tools to the overview, takes a decision per tool, and puts a fixed date in the DPIA on which the description is compared again with what is actually used.
How do you show the measures are actually running?
A DPIA describes. It says that sensitive data gets a marking before it disappears into a prompt, and that employees see an approved alternative when they open a tool a decision has been taken on. Whether that actually happens is not in the document. It is in the figures afterwards: how many markings there were, what happened to them, and what share of AI use ran through approved tools. What those figures are worth in front of a regulator is covered in what all those AI metrics are good for.
