A DPIA for an AI agent describes the personal data the agent reads and acts on, why, on what lawful basis, the risks to the people concerned, and the measures that reduce them. GDPR Article 35 and the UK GDPR require one where processing is likely to result in a high risk. A template and sample follow.
What is different about a DPIA for an agent?
A DPIA for a reporting system describes data flowing in and reports flowing out. An agent also acts: it changes records, sends messages, routes cases and drafts decisions. So the risks include not just exposure of data but harm from what the agent does with it. A wrong address update sends a customer's statements to a stranger. A decline drafted from incomplete data affects someone's access to credit. How data protection duties map to agent controls is covered in AI agent regulation, mapped to controls.
Two GDPR provisions deserve particular attention. Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects. And Article 5's principles, especially data minimisation, push you to limit what the agent can read to what each task needs. More in GDPR Article 35 DPIA for AI agents and, for the UK, UK GDPR DPIA for AI agents.
When should you use it?
Before the agent processes personal data in a way likely to result in high risk, which in practice covers most agents that act on customer records, handle special-category data, or support decisions about individuals. Screen every new agent first; running DPIA screening for new processing with an AI agent explains how.
Under the EU AI Act, deployers of high-risk systems use the provider's information to carry out the DPIA. Where a fundamental rights impact assessment is also needed, run the two together; the FRIA template for AI agents is built to sit beside this one.
How do you fill in each section?
- Processing description names each capability, the data it reads, the data it writes and the systems involved. A table works better than prose.
- Lawful basis is recorded per purpose under Article 6, and the condition for any special-category data.
- Necessity and proportionality asks whether the agent needs each field. Remove what it does not.
- Automated decisions asks whether any outcome is decided solely by the agent with significant effect. If so, the Article 22 conditions and safeguards apply.
- Risks are risks to people, not to the firm. Score likelihood and severity.
- Measures must be specific and evidenced: depth limits, holds for a person, source restrictions, retention.
- Human oversight describes who reviews what, linked to your human oversight procedure.
The template
| No. | Section | What to write |
|---|---|---|
| 1 | Agent and controller | Agent, ID, controller, processors |
| 2 | Processing description | Capability, data read, data written, systems |
| 3 | Purposes and lawful basis | Per purpose; special-category conditions |
| 4 | Data subjects | Who, how many, any vulnerable groups |
| 5 | Necessity and proportionality | Fields needed and why; fields removed |
| 6 | Automated decision-making | Any solely automated significant decisions; safeguards |
| 7 | Transparency | What people are told and where |
| 8 | Retention | Inputs, outputs, verdict records |
| 9 | Risks to individuals | Description, likelihood, severity |
| 10 | Measures | Control, evidence, owner |
| 11 | Residual risk | After measures; consult supervisory authority if high |
| 12 | DPO advice | Advice and response |
| 13 | Sign-off and review | Approver, review date |
A filled sample
A hypothetical bank's collections agent, sections 2, 6, 9 and 10.
2. Processing description.
| Capability | Data read | Data written | Depth |
|---|---|---|---|
| Summarise arrears position | Balance, payment history, contact notes | None | 1 |
| Draft contact message | Name, arrears amount, preferred channel | Draft message | 2 |
| Record payment promise | Promise date and amount | Collections record | 3 |
6. Automated decision-making. No solely automated decisions. Forbearance, fees and default decisions stay with collections staff.
9 and 10. Risks and measures.
| Risk to individuals | Likelihood | Severity | Measure | Evidence |
|---|---|---|---|---|
| Message sent to wrong person | Low | High | Agent drafts only; a person sends; contact details read from core banking | Depth record; source list |
| Customer in difficulty pressured | Medium | High | Vulnerability signals stop collections actions and route to specialist team | QA scorecards |
| Health information in notes exposed beyond need | Medium | Medium | Agent cannot read the health notes field | Permission config |
| Inaccurate arrears figure used | Low | Medium | Figures read only from core banking, not from notes | Provenance record |
The third row shows minimisation in action: the agent works without access to health notes at all.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Who should complete the DPIA?
The agent owner, with the data protection officer's advice. The controller remains responsible. A vendor can supply information but cannot complete your DPIA for you.
Is one DPIA enough for several agents?
One DPIA can cover similar processing operations with similar risks. Agents with different data, capabilities or depth usually need their own, or at least their own sections.
When should the DPIA be updated?
Whenever the agent gains a capability, a data source or a higher depth, and at the review date. A depth change is a change to the processing.