Screening decides whether a new use of personal data needs a full data protection impact assessment. An agent can read the project's intake form and design documents, test them against your screening criteria and propose an answer with reasons. The privacy lead or data protection officer makes the call, and "not required" answers get the closest look.
What is DPIA screening, and who owns it?
Under GDPR Article 35, and the same provision in UK GDPR, a controller must carry out a data protection impact assessment before processing that is likely to result in a high risk to people's rights and freedoms. Screening is the step before: a short, consistent test applied to every new project, system or change, so that the full assessment is done where it is needed and not where it is not.
The privacy function owns the screening criteria and the decision. Project owners supply the facts. The data protection officer, where one is appointed, advises and monitors. The agent helps the privacy team cope with volume, which matters most in firms where every product change touches customer data. The wider frame is our guide to AI compliance agents as second line, never the last word.
What are the steps, and at what depth?
- Person, privacy lead: sets the screening criteria. Typical triggers include special category data, large scale processing, systematic monitoring, automated decisions with significant effects, new technology, vulnerable people, and combining datasets in new ways.
- Agent, depth 1: reads the submission. The intake form, plus any design document, data flow or supplier contract attached. The form alone is rarely enough.
- Agent, depth 1: extracts the processing facts. Data categories, people affected, purposes, lawful basis claimed, recipients, transfers, retention, and whether any decision is automated.
- Agent, depth 1: checks existing records. Is this a change to processing already in the record of processing activities, and was that processing assessed before?
- Agent, depth 2: applies the criteria and proposes a result. Required, not required, or unclear, with each criterion marked met, not met or unknown, and the passage behind each mark.
- Agent, depth 2: drafts questions back to the project owner for every "unknown".
- Person, privacy lead: decides. Confirms the result or changes it, with a reason. Every "not required" is decided by a person, never defaulted.
- Agent, depth 2: opens the DPIA where required, pre-filling the facts already gathered into your DPIA template for an AI agent or your standard form.
- Agent, depth 3: files the screening record and flags the processing record entry for update.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Criteria | Nothing | none | Setting the criteria |
| Read | Reads form and attachments | 1 | Nothing |
| Extract | Lists the processing facts | 1 | Nothing |
| History | Checks prior records | 1 | Nothing |
| Propose | Marks each criterion, proposes result | 2 | The decision |
| Questions | Drafts queries to project owner | 2 | Sending them |
| DPIA start | Pre-fills the assessment | 2 | Writing the risk analysis |
| File | Files the screening record | 3 | Nothing |
Which controls matter, and what evidence does each leave?
Unknown is not "not met". A criterion the agent cannot assess stays open until the project owner answers. Evidence: the criterion-by-criterion marks, including unknowns.
Negative results are a person's decision. The agent cannot close a screening as "not required". Evidence: the privacy lead's name on every negative result.
Quoted basis for each mark. Evidence: the extract from the submission stored against each criterion.
Project statements are declared facts. A team saying "no special category data" is a claim to be tested against the design. Evidence: provenance marks on each extracted fact.
Screening and records stay linked. Evidence: each screening refers to the processing record entry it creates or changes. Whether an agent can keep that record itself is covered in can an AI agent maintain a record of processing activities?
What should you measure?
- Screenings by result: required, not required, unclear at first pass.
- Privacy lead changes to the proposed result, and in which direction.
- Unknowns per submission, by team. A team that always leaves gaps needs a better form or a conversation.
- Time from submission to decision.
- Projects that went live without a screening, found later through change records. This is the number that matters most.
Where does it usually go wrong?
Vague submissions pass. "We will use customer data to improve service" hides profiling. The agent should treat vague purposes as unknown, not as low risk.
Changes slip through. A new field, a new supplier, or a new use of existing data counts as new processing. Screening has to be triggered by change requests, not only new projects.
The agent screens itself out. New AI agents that read customer data are new processing too. Screen each one, and see UK GDPR DPIA for AI agents for what the full assessment should cover.
Screening becomes the assessment. A detailed screening record is not a DPIA. If the result is "required", the full assessment still has to be done and the risks still have to be weighed by people.
Criteria drift. Teams add exceptions over time. Version the criteria and record which version each screening used.
Suppliers are taken at their word. A supplier's privacy statement says what it intends, not what its system does. Where the processing depends on a supplier, the agent should mark their assurances as declared and list what the contract actually commits them to, so the privacy lead weighs the two side by side.
Questions people ask
Can the agent decide that a DPIA is required without a person?
It can open one as a precaution, since starting an assessment is cautious and reversible. Closing a screening as not required always needs the privacy lead.
What about processing that screening and adverse media checks both touch?
Screening tools that search the web for customer information are processing in their own right, with their own DPIA questions. Adverse media screening with an AI agent is one example that should be screened before it starts.
How do you test the agent's screening?
Replay it on past submissions your privacy team has already decided, including ones later found to need a DPIA. Disagreements, especially missed triggers, are the cases to read.