AI and Data Protection: Checklist with Data Protection Impact Assessment

The GDPR applies as soon as an AI service processes personal data: in inputs, uploaded files, recordings, outputs, and logs. Anyone who uses the service for their own purposes is the controller; the provider is a processor if it processes data only on instructions. If it determines the purposes and means itself, for example by using inputs for its own purposes, it is considered a controller in that respect (Art. 28(10) GDPR). The AI Act (Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744) additionally sets out obligations for providers and deployers of AI systems; it does not replace a review under the GDPR.

In the legislative process, not applicable law: The Digital Omnibus proposal COM(2025) 837 (procedure 2025/0360(COD), in committee as of October 25, 2026, according to the Legislative Observatory) would, among other things, introduce EU-wide uniform lists for the data protection impact assessment and add rules on processing for AI development and operation. Until it is promulgated, Art. 35 GDPR and the Austrian regulations DSFA-V and DSFA-AV (Datenschutz-Folgenabschätzungs-Ausnahmenverordnung, the Austrian regulation listing processing operations exempt from a DPIA) apply.

• Use case described: which data, which purpose, which persons are affected, which outputs are used and how
• Roles clarified: you as the controller, the provider as the processor, and it is contractually excluded that the provider uses inputs for its own purposes, or this use has been deliberately assessed
• Data processing agreement (DPA) under Art. 28 GDPR concluded, with sub-processors, processing locations, and deletion periods
• Legal basis under Art. 6 defined; for legitimate interest, the three-step test (interest, necessity, balancing) documented as described by the EDPB in Opinion 28/2024
• Special categories under Art. 9 (e.g., health data) and criminal offense data under Art. 10 only with a separate legal basis, otherwise excluded by technical and organizational means
• Data minimization under Art. 5(1)(c): only necessary data, pseudonymized or without personal reference where possible
• Information for data subjects under Art. 13 and 14 supplemented, for example in the privacy policy, employee information, or a notice at the start of a conversation
• Third-country transfer reviewed: adequacy decision or safeguards under Chapter V, also for support and sub-processors
• No decision based solely on automated processing with legal or similarly significant effects without a basis under Art. 22(2) and safeguards under para. 3
• Data subject rights can be implemented: access, rectification of incorrect outputs, erasure of inputs and logs
• Origin of the model questioned: according to the EDPB, supervisory authorities consider whether the deployer has appropriately verified that the model was not developed through unlawful processing (Opinion 28/2024, para. 129)
• Technical and organizational measures under Art. 32: access, logging, retention period, configuration of the service
• Entry in the record of processing activities under Art. 30 supplemented
• Review for a data protection impact assessment carried out and documented (see pre-assessment)
• AI literacy of users under Art. 4 AI Act supported through training and rules

This checklist is a TOMORIS recommendation. The obligations of the GDPR and the AI Act cited are required by law; which of them apply to your use case depends on the data, purpose, and service.

Many AI services are operated or supported by providers in the US. For transfers to organizations listed on the Data Privacy Framework List of the U.S. Department of Commerce, there is an adequacy decision of the European Commission (Implementing Decision (EU) 2023/1795, Art. 1). For other recipients, you need safeguards under Art. 46 GDPR, such as standard contractual clauses. The General Court of the EU dismissed an action against the decision on September 3, 2025 (T-553/23); an appeal against this was lodged with the Court of Justice on October 31, 2025 (C-703/25 P), on which no judgment had been published as of October 25, 2026. Before deciding, check whether the recipient is listed and what the status of the proceedings is.

A data protection impact assessment (DPIA) must be carried out in advance if processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons (Art. 35(1) GDPR). Art. 35(3) names typical cases. In Austria, the DSFA-V, a regulation of the Austrian Data Protection Authority (Datenschutzbehörde), defines when a DPIA is required in any case, and the DSFA-AV defines when it is not. Both have applied unchanged since 2018 (RIS, version as of October 25, 2026).

Exemptions: For the processing operations described in the annex to the DSFA-AV (DSFA-A01 to DSFA-A22, such as customer management or HR administration), no DPIA is required (§ 1 DSFA-AV, § 2 para. 1 DSFA-V). Whether an AI deployment still falls within the description of an exemption must be assessed case by case. For employee data, § 2 DSFA-V contains special rules for cases with a works agreement or the consent of the staff representation.

If the deployment falls under no list, the guideline WP 248 rev.01 of the Article 29 Working Party, endorsed by the European Data Protection Board (EDPB), helps: it names nine criteria, including evaluation or scoring, automated decisions, systematic monitoring, sensitive data, large volumes of data, vulnerable persons, and innovative technologies. In most cases, a DPIA must be carried out if two criteria are met, sometimes even if only one is met.

1. 1

   Describe the processing systematically

   Operations, purposes, and, where applicable, the legitimate interests (Art. 35(7)(a)): data flows from input through the model to the output, storage and logging at the provider, sub-processors involved.

2. 2

   Assess necessity and proportionality

   Is the processing necessary for the purpose, are there less intrusive means, for example without personal reference or with less data (lit. b)?

3. 3

   Assess risks to data subjects

   Risks to rights and freedoms (lit. c); for AI, for example, incorrect outputs about persons, disclosure of confidential inputs, discrimination through evaluations, lack of traceability. For high-risk AI, use the provider's information under Art. 13 AI Act (Art. 26(9) AI Act).

4. 4

   Define remedial measures

   Safeguards, security measures, and mechanisms (lit. d), for example data minimization, human review before decisions, access restrictions, short retention periods, training.

5. 5

   Involve others

   Seek the advice of the data protection officer, if designated (Art. 35(2)), and, where appropriate, the views of data subjects or their representatives, such as the works council (para. 9).

6. 6

   Decide on the residual risk

   If a high risk remains despite the measures, consult the Data Protection Authority before processing (Art. 36(1)); it has up to eight weeks, extendable by six weeks (para. 2).

7. 7

   Review

   Where necessary, check whether the processing is performed in accordance with the DPIA, at least when the risk changes (Art. 35(11)), for example with a new model, new features, or a new provider.

• Private account instead of a company contract: without a contract under Art. 28 and proper configuration, it is unclear what the provider does with the inputs.
• DPIA only after the launch: it must be carried out in advance (Art. 35(1)); fundamental decisions are often hard to change afterward.
• Only the AI Act reviewed: an AI system that is not high-risk may still require a DPIA under the GDPR and the DSFA-V.
• Outputs adopted without review: incorrect statements about persons are inaccurate data; data subjects have a right to rectification (Art. 16 GDPR).
• Logs forgotten: inputs and histories are often stored at the provider and in your own system; retention period and access belong in the review.