Yes, it can draft one; it cannot conclude one. An AI agent can describe the processing, map the data flows, list the systems and processors involved and propose risks and mitigations. Judging necessity and proportionality, weighing the risk to people and accepting the residual risk stay with the accountable owner, advised by the data protection officer.
What does a DPIA actually require?
GDPR Article 35, and its UK equivalent, require a data protection impact assessment before processing that is likely to result in a high risk to people's rights and freedoms. In substance it must describe the processing and its purposes, assess whether it is necessary and proportionate, assess the risks to individuals, and set out the measures to address them. Where high risk remains after those measures, the regulator may need to be consulted before the processing starts.
The descriptive half is the slow half. Someone has to find out which fields are collected, where they go, who can see them, how long they are kept and which processors touch them. In most organisations that knowledge is spread across product, engineering, procurement and legal. That is the part an agent can gather. Whether your agents themselves trigger a DPIA is covered in do AI agents need a data protection impact assessment?
What evidence does the agent assemble?
- The processing description: purpose, data subjects, data categories and volumes, drawn from the project brief and the record of processing activities.
- Data flows: systems, integrations and transfers, from architecture documents and the systems inventory.
- Processors and transfers: which third parties receive data, under which contracts and in which countries.
- Retention: the retention rule that applies to each category, and whether the new processing fits it.
- Special category data: whether health, biometric or similar data is involved, which raises the bar.
- Existing controls: access controls, encryption, logging and testing that already apply.
- Prior assessments: related DPIAs and their open actions.
From that it drafts the assessment in your template, with a risk table and proposed mitigations. Each statement cites the document it came from, and anything it could not find is listed as a gap.
Which decisions stay with people?
| Decision | Why a person |
|---|---|
| Whether the purpose justifies the processing | A judgement about necessity and proportionality |
| How likely and severe each risk to individuals is | Requires understanding of the people affected, not only the data |
| Whether mitigations are enough | The organisation is accepting risk on others' behalf |
| Whether to consult the regulator | A formal step with consequences |
| Sign-off | The accountable owner answers for it |
The data protection officer advises; the business owner decides. The agent's draft supports both, and records their changes.
What does a draft look like?
Take a lender planning to use an agent to read applicants' bank statements and summarise income and spending for underwriters. The agent drafts the DPIA.
It describes the data: statements covering several months, including transactions that can reveal health, religion or political affiliation through who people pay. It maps the flow from upload to the document store, to the agent, to the underwriter's case. It lists the model provider as a processor and notes where it hosts data. It proposes mitigations: excluding transaction descriptions from the agent's summary unless relevant to affordability, short retention for the raw statements, and restricting who can see the full file.
It also flags a gap it cannot close: whether the summary feeds an automated credit decision, which would bring in Article 22 and the EU AI Act's treatment of credit scoring as high-risk. The DPO raises that with the product owner, who confirms an underwriter always decides. The owner accepts the residual risk with that condition recorded. Assessing the agent's wider effects, beyond data protection, is a separate exercise; see the NIST AI RMF impact assessment for AI agents.
What controls keep the draft reliable?
- Sources cited. A claim about data flows with no source is marked as unverified.
- Gaps listed, not filled. The agent does not guess retention periods or processor locations.
- Triggered by change. A new data field, processor or purpose re-opens the assessment.
- Local law applied by people. Where processing falls under other regimes, such as the Nigeria Data Protection Act and AI agents, the agent can lay out the requirements but counsel or the DPO decides how they apply.
- Draft and decision on record. The agent's draft and the owner's changes are both kept.
The same pattern runs through AI compliance agents: second line, never the last word.
Questions people ask
Can the agent decide that no DPIA is needed?
It can run your screening questions and recommend an answer with reasons. A person confirms it, because a wrong "no" means high-risk processing with no assessment.
How long does an agent-drafted DPIA take to finalise?
The drafting is fast; the review is not. Expect the DPO and owner to spend their time on the risk judgements, which is where it belongs.
Should the agent consult the people affected?
Consultation with data subjects or their representatives is a choice for the owner. The agent can draft the questions and summarise responses.