A DPIA is required for an AI agent when its processing is likely to result in high risk to people, especially with new technology. In practice, an agent that evaluates or profiles people, influences decisions about them, handles sensitive data, works at scale or monitors them will need one. If you decide it does not, record why.
What triggers a DPIA under GDPR?
Article 35 requires a data protection impact assessment before processing that is likely to result in a high risk to the rights and freedoms of people, taking into account its nature, scope, context and purposes, and in particular where new technologies are used.
It lists three cases where a DPIA is required in particular:
- systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal or similarly significant effects;
- large-scale processing of special category data, or data on criminal convictions and offences;
- systematic monitoring of a publicly accessible area on a large scale.
Supervisory authorities must publish lists of processing that requires a DPIA and may publish lists of processing that does not. European regulators' guidance also sets out factors that indicate high risk. In substance they include: evaluation or scoring; automated decisions with legal or similar effect; systematic monitoring; sensitive or highly personal data; large scale; matching or combining datasets; data about vulnerable people; innovative use of technology; and processing that prevents people exercising a right or using a service. Where several are present, a DPIA is generally expected.
Who must make the call?
The controller, before the processing starts, with advice from the data protection officer where one is appointed. In the UK, the ICO publishes its own list under UK GDPR; see UK GDPR DPIA for AI agents.
Which features of an agent deployment trigger one?
Agents tick several factors almost by design. Run each deployment against this list:
Innovative technology. Agents built on large language models are a new technology in the sense regulators mean. On its own this is a factor, not a trigger, but it starts the count.
Evaluation or scoring. Any agent that assesses people, such as affordability, fraud risk, vulnerability, complaint severity or job suitability, is evaluating. One that ranks or prioritises cases by personal characteristics is scoring.
Decisions with significant effect. An agent that declines, blocks, closes or prices, or whose drafts a person approves with little change, influences decisions with significant effects.
Sensitive data. Agents that read free-text notes, emails, call transcripts or documents encounter health, family and financial hardship information even when no one intended them to.
Large scale. A service agent handling every customer contact processes at scale.
Combining datasets. Agents that retrieve from several systems to answer one question combine data in ways the original collection did not envisage.
Vulnerable people. Collections, hardship, health, children's and social services agents deal with people more exposed to harm.
Blocking a service. An agent that gates access to an account, a claim or support can prevent people using a service.
A customer service agent with access to account history, handling every contact, already meets innovative technology, large scale and probably sensitive data. That is enough for most firms to run a DPIA.
How do you decide and record the decision?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Screen every agent deployment | Screening checklist run at design and before each material change | Completed screening per agent |
| Check the Article 35 named cases | Questions on profiling with significant effects, special category data at scale, public monitoring | Answers in the screening record |
| Check the authority's list | Screening refers to the relevant supervisory authority's published list | Reference in the record |
| Count the high-risk factors | Each factor answered yes or no with a reason | Factor table |
| Seek DPO advice | DPO reviews the screening result | DPO note |
| Run the DPIA where indicated | Full assessment before processing starts | Signed DPIA |
| Record a decision not to run one | Reasons, factors considered and DPO view documented | Signed screening decision |
| Re-screen on change | New capability, source, population or provider triggers re-screening | Change records linked to screening |
The decision not to run a DPIA is as important to document as the DPIA itself. A supervisor reviewing an agent without a DPIA will ask why. A screening record with reasons, signed and dated, answers that question. Silence does not.
If a DPIA is needed, our DPIA template for an AI agent and the guide to GDPR Article 35 DPIA for AI agents cover the content.
What will a supervisor or auditor ask?
- Did you screen this agent for a DPIA? Show us the record.
- Which high-risk factors applied, and how did you weigh them?
- Why did you decide a DPIA was not needed?
- What did the DPO advise?
- What has changed since, and did you re-screen?
What do the triggers not cover?
They do not tell you how to run the DPIA; Article 35 sets the content. They do not cover the EU AI Act's fundamental rights impact assessment, which has its own triggers. And they do not stay fixed: an agent that needed no DPIA at launch may need one after gaining a capability. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, an agent's capabilities, sources and depth are recorded per capability, and depth is earned through Attest. A new capability or a move to a higher depth is a visible event, which makes it a natural trigger for re-screening rather than something discovered at audit.
Questions people ask
Does an internal agent that only drafts need a DPIA?
It may not, if it processes limited personal data, makes no evaluations and is not at scale. Screen it, record the reasons, and re-screen if its access or use grows.
Is using a large language model alone enough to require a DPIA?
On its own it is one factor. Combined with almost any other, such as scale or sensitive data, most regulators would expect a DPIA.
Can a vendor's DPIA replace ours?
No. The controller must assess its own processing. A vendor's assessment and documentation are useful inputs, especially on how the platform handles data.