DPIA template for AI: your impact assessment in three steps.
Describe your AI project in three short steps. The template turns it into the outline of a data protection impact assessment under Art. 35 GDPR or a checklist for your data processing agreement, with risks and measures that match your inputs.
Not legal advice · as of 13 October 2026
Your document, ready to edit.
Fill in the three steps above. Your outline then appears here, with your inputs, matching risks and measures, and [placeholders] for everything you still need to add.
Email me the result
Optional: we send you the result. Otherwise your answers only stay in your browser.
What is a DPIA, and what is a DPA?
Data protection impact assessment (Art. 35 GDPR)
You assess up front the risks of processing that is likely to pose a high risk to the people concerned, and set measures. As controller you prepare the DPIA yourself.
Data processing agreement (Art. 28 GDPR)
The contract with every service provider that processes personal data on your behalf, such as a hosting or AI provider. It covers instructions, security, sub-processors and deletion.
When is a data protection impact assessment required?
A DPIA is mandatory where processing is likely to pose a high risk to people’s rights and freedoms. With AI that is often the case: when employee or customer data is processed on a large scale, when special categories such as health data are involved or when new technologies are used systematically.
The data protection authorities publish lists of processing for which a DPIA is always required. Check that list and document it even when you conclude that no DPIA is needed.
The four parts of a DPIA under Art. 35(7).
Description
System, purpose, people concerned, data categories, retention and data flow.
Necessity
Legal basis, data minimisation, storage limitation and data subject rights.
Risks
What can go wrong for the people concerned, how likely and how severe?
Measures
Technical and organisational measures that reduce the risks.
From the template to the finished DPIA.
The template fills in everything that follows from your inputs and marks the rest as [placeholders]. Copy the text into your template, add the legal basis, assessments and further measures, and have your DPO review the document. If you run the AI yourself with a local model, the DPA for the platform usually falls away.
Questions about the DPIA.
When must a DPIA be carried out?
Whenever processing is likely to pose a high risk to people’s rights and freedoms. That applies, for example, to large-scale processing of special categories, systematic monitoring or new technologies such as AI working with personal data. The authorities’ lists name cases where it is always required.
Is the DPIA template legally sound?
The template provides the structure under Art. 35(7) GDPR and typical risks and measures for AI systems. The DPIA becomes sound only once you fill in the placeholders, assess the risks and your data protection officer reviews it. The template saves time on the structure but does not replace advice.
What is the difference between a DPIA and a DPA?
The DPIA assesses the risks of processing for the people concerned, and you prepare it yourself as controller. The DPA is a contract with a service provider that processes data on your behalf. An AI project often needs both: the DPIA for the project and a DPA with every external provider.
Can I edit the result in Word?
Yes. With the “Copy text” button you take the document with headings and lists into Word or your DPIA template. Alternatively we email you the result if you wish. The placeholders highlighted in yellow show what you still need to add or assess.
Do I need a DPA for RAGSuite?
In RAGSuite Engine we process data on your behalf, so you sign a DPA with us. If you run RAGSuite yourself and nobody but you has access to personal data, the platform needs no DPA. For an external language model you need a DPA with its provider.
Your DPIA is drafted, we show the technology behind it.
Go through the measures with us: deletion periods, audit log and data flow in the RAGSuite Engine or on your servers.