Data protection impact assessment
The Art. 35 GDPR DPIA – structured, approved and linked to the AI system.
Under Art. 35 GDPR a DPIA is required whenever processing is likely to result in a high risk to the rights and freedoms of natural persons. With AI systems that is frequently the case – automated evaluation, profiling, systematic monitoring, large data volumes. SimpleAct keeps the DPIA as its own record with risks, mitigations, residual risk and a real approval.
At a glance
- Included from
- Professional
- Where in the app
- Data protection → DPIA
- Output
- An approved DPIA with residual risk rating, part of the full GDPR export
- Legal basis
- Art. 35 GDPR
- API
- /api/v1/dpia
Structure of a DPIA
Necessity assessment
A flag for whether a DPIA is required, plus the reasoning. A "not required" belongs in the file too – the decision against a DPIA must be as defensible as the decision for one.
Description of the processing
What is processed, for what purpose, at what scale. Linking to a processing record means you do not maintain the base data twice.
Risks
A list of individual risks, each with title, description, likelihood and severity – low, medium or high. Not prose, but individually assessable items.
Mitigations
Per mitigation: title, concrete description, optionally a reference to an existing control, and an effectiveness rating – yes, partial or no.
Residual risk
Low, medium, high or unknown. This single value decides the next step: with a high residual risk, prior consultation of the supervisory authority is required under Art. 36.
Consultation and approval
A consultation flag with notes, responsible person and email, approval status with approver and timestamp, and the next review date.
Approval status
| Status | Meaning |
|---|---|
| DRAFT | In progress. |
| IN_REVIEW | With the data protection officer for an opinion – Art. 35(2) requires seeking their advice. |
| APPROVED | Approved, with the approver’s name and timestamp. |
| REJECTED | Rejected – the processing must not start in this form. |
| ARCHIVED | Superseded but retained. A DPIA remains evidence after the processing ends. |
Which systems need a DPIA
A dedicated view lists AI systems that have no DPIA linked yet and are either classified as high risk or process personal data. That is your worklist – and the answer to the second question an authority asks.
A DPIA is not a FRIA
A DPIA protects personal data. The AI Act’s fundamental rights impact assessment (Art. 27) looks at fundamental rights as a whole, including processing without personal data, and applies to certain deployers of high-risk systems. The analyses overlap – they cannot replace each other. In SimpleAct the FRIA lives in the assurance file of the respective AI system.