TOOLBOX · DOWNLOAD
Review AIand dataprotection.
As soon as employees enter personal data into an AI service, have conversations transcribed, or have documents analyzed, the GDPR applies, and alongside it the AI Act. This checklist guides you through the review before deployment: roles and contract with the provider, legal basis, information for data subjects, third-country transfers, and automated decisions. The focus is on the data protection impact assessment: when it is mandatory under Art. 35 GDPR and the Austrian DSFA-V (Datenschutz-Folgenabschätzungs-Verordnung, the Austrian regulation listing processing operations that require a DPIA), what it must contain at a minimum, and how it interacts with the AI Act.
Free PDF · Checklist
AI and Data Protection: Checklist with Data Protection Impact Assessment
- Topic
- AI in Business
- Format
- PDF, A4
- Length
- 8 pages
- Size
- 106 KB
- Updated
- Oct 25, 2026
- Sources
- 10
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
Review steps before deploying an AI service, obligation and minimum content of the data protection impact assessment, pre-assessment under the DSFA-V, and link to the AI Act.
- Data protection officers and those responsible for data protection who approve AI services
- Project managers who introduce chat assistants, transcription, or analyses with AI
- IT and purchasing teams that conclude contracts with AI providers
- Executive management responsible for lawful use
7 SECTIONS
What Is
Inside.
- 01
GDPR and AI Act: what applies to what
The GDPR governs personal data, the AI Act governs the AI system; both apply side by side.
- 02
Review steps before deploying an AI service
To check off before personal data flows into an AI service; go through once per use case.
- 03
Third countries: AI services from the US
What applies to transfers to the US and why you should check the status of proceedings before deciding.
- 04
When a data protection impact assessment is mandatory
Art. 35 GDPR, the Austrian list in the DSFA-V, and the exemptions in the DSFA-AV.
- 05
Procedure and minimum content of the DPIA
What the impact assessment must contain under Art. 35(7) and when the Data Protection Authority must be consulted.
- 06
Fillable DPIA pre-assessment
Fill in for each AI use case and file with the record of processing activities.
- 07
Common mistakes
Where AI rollouts often fail in terms of data protection law.
EXCERPT
When a data protection impact assessment is mandatory
A data protection impact assessment (DPIA) must be carried out in advance if processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons (Art. 35(1) GDPR). Art. 35(3) names typical cases. In Austria, the DSFA-V, a regulation of the Austrian Data Protection Authority (Datenschutzbehörde), defines when a DPIA is required in any case, and the DSFA-AV defines when it is not. Both have applied unchanged since 2018 (RIS, version as of October 25, 2026).
| Trigger | Citation | What it means for AI |
|---|---|---|
| New technologies that make it difficult to assess the impact, in particular artificial intelligence; one criterion from items 1 to 6 is enough | § 2 para. 2 no. 4 DSFA-V | The most important trigger for many AI deployments involving personal data |
| Evaluation or classification of persons, solely automated, with possible negative legal, physical, or financial effects | § 2 para. 2 no. 1 DSFA-V | For example, AI-supported pre-screening of applications or credit scoring forecasts |
| Systematic and extensive evaluation of personal aspects as the basis for decisions with legal effects | Art. 35(3)(a) GDPR | Profiling with decisions about persons |
| Large-scale processing of special categories (Art. 9) or of criminal offense data (Art. 10) | Art. 35(3)(b) GDPR | For example, analysis of health data with AI |
| Two or more criteria, including vulnerable persons such as employees, patients, or minors under 14 | § 2 para. 3 DSFA-V | For example, AI analyses about employees together with another criterion |
Exemptions: For the processing operations described in the annex to the DSFA-AV (DSFA-A01 to DSFA-A22, such as customer management or HR administration), no DPIA is required (§ 1 DSFA-AV, § 2 para. 1 DSFA-V). Whether an AI deployment still falls within the description of an exemption must be assessed case by case. For employee data, § 2 DSFA-V contains special rules for cases with a works agreement or the consent of the staff representation.
If the deployment falls under no list, the guideline WP 248 rev.01 of the Article 29 Working Party, endorsed by the European Data Protection Board (EDPB), helps: it names nine criteria, including evaluation or scoring, automated decisions, systematic monitoring, sensitive data, large volumes of data, vulnerable persons, and innovative technologies. In most cases, a DPIA must be carried out if two criteria are met, sometimes even if only one is met.
SOURCES
Supported
by Sources.
- Regulation (EU) 2016/679 (GDPR) (opens in a new tab)Art. 5, 6, 9, 10, 13, 14, 16, 22, 28, 30, 32, 35, 36, 46
- DSFA-V, BGBl. II No. 278/2018, current version in the RIS (opens in a new tab)§ 2 para. 1 to 3, version as of October 25, 2026 (original version)
- DSFA-AV, BGBl. II No. 108/2018, current version in the RIS (opens in a new tab)§ 1 and annex DSFA-A01 to DSFA-A22, version as of October 25, 2026
- Article 29 Working Party: Guidelines on Data Protection Impact Assessment, WP 248 rev.01 (October 4, 2017) (opens in a new tab)Section III.B: nine criteria, rule of thumb of two criteria
- EDPB: Endorsement 1/2018 of the Article 29 Working Party documents (opens in a new tab)No. 6: WP 248 rev.01
- EDPB: Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models (December 17, 2024) (opens in a new tab)Three-step test of legitimate interest, para. 129 on deployers
- Regulation (EU) 2024/1689 (AI Act) (opens in a new tab)Art. 4, 6, 13, 26(9), 27, 113
- Regulation (EU) 2026/1744 (Digital Omnibus Regulation on AI), OJ L of July 24, 2026 (opens in a new tab)New Art. 4, Art. 27(4), Art. 113(3)(c); in force since July 27, 2026
- Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework) and appeal C-703/25 P (opens in a new tab)Art. 1; appeal lodged on October 31, 2025, against judgment T-553/23 of September 3, 2025
- European Parliament, Legislative Observatory: Digital Omnibus 2025/0360(COD) (opens in a new tab)As of October 25, 2026: Awaiting committee decision; proposal COM(2025) 837
This checklist is a TOMORIS recommendation and provides an overview. It does not replace legal advice or a case-by-case data protection impact assessment; the statutory text in its current version is authoritative.
TOOLBOX
Explore
Further.
AI usage policy
Template for a policy on the use of AI in the company, with permitted tools, data classes, and AI literacy.
Learn MoreEU AI Act
How the AI Act classifies AI systems by risk and which obligations providers and deployers have, explained in the glossary.
Learn MoreData processing agreement (DPA)
When a service provider processes data on your behalf and what the contract for this must contain, explained in the glossary.
Learn MoreAI consulting
Assess use cases for AI, with data and permission concepts and a pilot with clear criteria.
Learn More
AI IN BUSINESS
More on
This Topic.
- PDF
AI Usage Policy
Sample text with placeholders for AI assistants: approved tools, data classes, human review, labeling and training, plus the legal status of the AI Act after the Digital Omnibus.
View - PDF
AI Act at a Glance
Roles, prohibitions, high-risk, transparency, AI literacy, and penalties under the AI Act, with all deadlines after the amendment by Regulation (EU) 2026/1744, plus first steps for companies.
View - PDF
Using Generative AI Safely
What may go into a prompt, approved tools only, checking results, recognizing prompt injection, labeling and AI literacy under the AI Act, and reporting incidents: ready to post.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.