---
title: "Data Protection Impact Assessment (DPIA) for AI Agents: Obligation, Thresholds and a Step-by-Step Approach"
description: "A data protection impact assessment (DPIA) is mandatory under Art. 35 GDPR where processing is likely to result in a high risk to the rights and freedoms of natural persons."
locale: "en"
canonical: "https://blckalpaca.at/en/knowledge-base/ai-agents/deploy-ai-agents-gdpr-compliant/data-protection-impact-assessment-dpia-for-ai-agents-obligation-thresholds-and"
category: "AI Agents"
topic: "Deploying AI Agents in a GDPR-Compliant Way"
updated: "2026-10-17T15:32:32.853Z"
source: "Blck Alpaca e.U., blckalpaca.at"
---

# Data Protection Impact Assessment (DPIA) for AI Agents: Obligation, Thresholds and a Step-by-Step Approach

A data protection impact assessment (DPIA) is mandatory under Art. 35 GDPR where processing is likely to result in a high risk to the rights and freedoms of natural persons. For AI agents it is almost always required, because these systems usually meet several risk criteria at once, such as innovative technology combined with profiling or automated decision-making.

## Key Takeaways

- A DPIA is mandatory under Art. 35(1) GDPR as soon as processing is likely to result in a high risk to data subjects; Art. 35(3) names three standard cases, and Art. 35(4) requires supervisory authorities to publish mandatory lists.
- AI agents almost always trigger a DPIA obligation because they usually meet several WP248 criteria at once (innovative technology plus profiling, automated decision-making or data from multiple sources) or, in Germany, fall under No. 11 of the DSK mandatory list.
- The four core steps based on Art. 35(7)(b) to (d) GDPR, as also described in the WP248 guidelines of the Article 29 Working Party and DSK Short Paper No. 5, begin with assessing necessity and proportionality, followed by risk identification, risk evaluation and risk treatment; the description of the processing is a prior mandatory component under Art. 35(7)(a) GDPR.
- AI-specific risks include hallucinations, bias, prompt injection, memory leakage between sessions, regurgitation of training PII, re-identification via embedding inversion and supply-chain risks.
- Where a high residual risk remains after mitigation, a prior consultation with the supervisory authority is required under Art. 36 GDPR (the authority has up to eight weeks, extendable by six). Under Swiss law, Art. 23 FADP applies, with consultation of the FDPIC.
- For high-risk AI under Annex III, Art. 27(4) EU AI Act permits merging the DPIA with the fundamental rights impact assessment (FRIA) into a single artifact. Under the AI Omnibus, the FRIA obligation for Annex III systems applies only from 2 December 2027. The Art. 86 right to explanation was not formally postponed; whether it has practical effect before that date is unclear.

A data protection impact assessment (DPIA; German DSFA) is mandatory under Art. 35 [GDPR](https://blckalpaca.at/en/glossary/gdpr) where processing is likely to result in a [high risk to the rights and freedoms of natural persons](https://gdpr-info.eu/art-35-gdpr/). For [AI](https://blckalpaca.at/en/glossary/ai) agents it is, in practice, almost always required, because these systems usually meet several risk criteria at once, such as innovative technology combined with profiling, automated decision-making or the combination of datasets from multiple sources.

This article is part of the hub "[GDPR-compliant AI-agent deployment](https://blckalpaca.at/en/knowledge-base/ai-agents/deploy-ai-agents-gdpr-compliant)" and provides a reliable step-by-step approach as well as a trigger checklist for DACH controllers.

## Quick answers

- **Threshold:** A DPIA is mandatory as soon as a high risk is likely (Art. 35(1)). Art. 35(3) names three standard cases, and Art. 35(4) requires supervisory authorities to publish mandatory lists: in Germany the DSK list for the private sector, in Austria the DPIA Regulation (DSFA-V) of the data protection authority. In Switzerland, the DPIA obligation follows from Art. 22 FADP; the GDPR applies there only where Art. 3(2) GDPR is triggered.
- **AI reality:** AI agents almost always trigger a DPIA obligation on account of profiling, automated decision-making and innovative technology.
- **Procedure:** The DPIA follows a documented process: the description of the processing as a mandatory component, then necessity/proportionality, risk identification, risk evaluation and remedial measures. Where a high residual risk remains, the prior consultation under Art. 36 follows.

## What a DPIA under Art. 35 GDPR is

[Art. 35(1) GDPR obliges the controller to carry out a DPIA](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679) where a type of processing, in particular when using new technologies, is, owing to its nature, scope, context and purposes, likely to result in a high risk to the rights and freedoms of natural persons. The DPIA is therefore an upstream risk-management instrument: it is drawn up before the start of processing and documents whether and how risks are controlled.

Importantly, the controller remains responsible for the DPIA even where it did not develop the [AI agent](https://blckalpaca.at/en/glossary/ai-agent) itself. In its guidance "[Artificial Intelligence and Data Protection](https://www.datenschutzkonferenz-online.de/media/oh/20240506_DSK_Orientierungshilfe_KI_und_Datenschutz.pdf)" (Version 1.0, 6 May 2024), the DSK states that a DPIA will often be required when AI applications are used (para. 39). Where the controller is not also the provider of the AI system, it depends on information from the provider about how the system works (para. 40).

## When the DPIA becomes mandatory for AI agents

Art. 35(3) names three statutory standard cases (presumption scenarios):

1. Systematic and extensive evaluation of personal aspects, including profiling with significant effect.
2. Large-scale processing of special categories (Art. 9) or of data relating to criminal convictions (Art. 10).
3. Systematic large-scale monitoring of publicly accessible areas.

In addition, [Art. 35(4) GDPR](https://gdpr-info.eu/art-35-gdpr/) requires the supervisory authorities to publish lists of processing operations that require a DPIA. For private-sector controllers in Germany, this is the [DSK list for the non-public sector](https://www.datenschutzkonferenz-online.de/media/ah/20181017_ah_DSK_DSFA_Muss-Liste_Version_1.1_Deutsch.pdf) (version 1.1 of 17 October 2018); in Austria, it is the [DPIA Regulation (DSFA-V) of the data protection authority](https://www.ris.bka.gv.at/eli/bgbl/II/2018/278/20181109) (Federal Law Gazette II No. 278/2018). In Switzerland, the DPIA obligation follows from [Art. 22 FADP](https://www.fedlex.admin.ch/eli/cc/2022/491/en). The GDPR applies to Swiss controllers only where they offer goods or services to persons in the EU or monitor their behavior there ([Art. 3(2) GDPR](https://gdpr-info.eu/art-3-gdpr/)). For AI agents, the following entries on the DSK list are particularly relevant:

- Use of AI that processes personal data to steer the interaction with data subjects or to evaluate personal aspects (No. 11), for example in [customer support](https://blckalpaca.at/en/services/saas-ai-customer-support)
- Large-scale combination of data from multiple sources where it prepares decisions with legal effect, for example in scoring (No. 5), or serves to discover unknown correlations (No. 10)
- Comprehensive profiles of interests, personal relationships or personality (No. 9)
- Automated analysis of video or audio recordings to assess personality (No. 13)
- Biometric identification or genetic data where at least one further WP248 criterion applies (Nos. 1 and 2)
- Large-scale analysis of employee conduct to evaluate their work (No. 8)

The practical consequence: on account of one or more of these points, AI agents almost always trigger a DPIA obligation.

### Trigger checklist for AI agents

| Trigger criterion | Example AI [agent](https://blckalpaca.at/en/glossary/agent) | DPIA indication |
| --- | --- | --- |
| Profiling with significant effect | Lead-scoring, HR-ranking, dynamic-pricing agent | High, standard case Art. 35(3)(a) |
| Automated decision (Art. 22) | Credit-decision, underwriting agent | High: list entry |
| Special categories (Art. 9) at scale | Health-triage, voice-emotion agent | High, standard case Art. 35(3)(b) |
| Innovative technology | Any [LLM](https://blckalpaca.at/en/glossary/llm)/agentic deployment | High when interacting with data subjects or evaluating personal aspects (list entry) |
| Datasets from multiple sources | RAG across [CRM](https://blckalpaca.at/en/glossary/crm) plus HR plus web | Medium to high |
| Employee monitoring | Copilot rollout, browser agent | High, plus works-council involvement |

If the processing falls under a standard case of Art. 35(3) or appears on a mandatory list under Art. 35(4), the DPIA is mandatory. For the other criteria, the [WP248 rev.01 guidelines](https://ec.europa.eu/newsroom/article29/items/611236) give a rule of thumb: a DPIA should be carried out once two criteria are met, and in some cases even when only one is met. In case of doubt, a documented preliminary threshold assessment is advisable, justifying why no DPIA would be necessary; this addresses the accountability obligation under Art. 5(2).

## The DPIA methodology step by step

The description of the processing is, under Art. 35(7)(a) GDPR, an upstream mandatory component of every DPIA: a systematic depiction of the AI agent together with a data-flow diagram mapping every personal-data hop (user → agent runtime → model [API](https://blckalpaca.at/en/glossary/api) → vector store → [MCP](https://blckalpaca.at/en/glossary/mcp) server → observability backend → logs), plus the system architecture with a sub-processor map and a role mapping (controller, joint controllers, processor, [sub-processors with an unbroken chain under Art. 28(4)](https://blckalpaca.at/en/knowledge-base/ai-agents/deploy-ai-agents-gdpr-compliant/data-processing-agreements-under-art-28-gdpr-with-ai-providers-the-dpa-guide)).

On this basis follow the four core steps that result from Art. 35(7)(b) to (d) GDPR. They match the [WP248 rev.01 guidelines](https://ec.europa.eu/newsroom/article29/items/611236) of the Article 29 Working Party, which the [EDPB has endorsed](https://www.edpb.europa.eu/our-work-tools/general-guidance/endorsed-wp29-guidelines_en). [DSK Short Paper No. 5](https://www.datenschutzkonferenz-online.de/media/kp/dsk_kpnr_5.pdf) places them in a cycle of preparation, execution, implementation and review:

1. **Necessity and proportionality.** Is the processing strictly necessary? Would anonymous, pseudonymous or synthetic data suffice? Are the data volume and storage period minimized? Specifically for [RAG](https://blckalpaca.at/en/glossary/rag): indexing pseudonymized chunks and minimizing context payloads.
2. **Risk identification.** Capturing the AI-specific risks (see next section), in relation to the respective groups of data subjects.
3. **Risk evaluation.** Assessing each risk by likelihood of occurrence multiplied by severity.
4. **Risk treatment and residual-risk acceptance.** Technical measures under Art. 32 (encryption, pseudonymization, access controls, logging, [prompt](https://blckalpaca.at/en/glossary/prompt)-injection defense), organizational measures (training, governance) and contractual measures (DPA clauses), together with the documented acceptance of the residual risk.

The required consultation records form part of this: the opinion of the data protection officer (Art. 35(2)), the involvement of the works council or staff representation where applicable (Section 87 BetrVG, the Austrian ArbVG, Swiss participation rules), and, where feasible, the consultation of affected groups of data subjects (Art. 35(9)).

## AI-specific risks in the risk register

For AI agents, the risk catalog is considerably broader than for classic data processing. The DPIA must, at a minimum, take into account:

- **Hallucination**: fabricated yet plausible personal data; at once inaccurate (Art. 5(1)(d)) and a re-identification risk
- **Bias and discrimination** in scoring and ranking outputs
- **Prompt injection**, including cross-tenant attacks that extract third-party data
- **Memory leakage** between sessions via shared storage or system prompts
- **Output regurgitation** of training PII
- **Scope creep** and unauthorized inference
- **Data exfiltration via tool calls** to undocumented sub-processors
- **Re-identification via [embedding](https://blckalpaca.at/en/glossary/embedding) inversion**: embeddings are not automatically anonymous and qualify as pseudonymous personal data
- **Supply-chain risk** across the five- to eight-tier sub-processor stack

The DSK guidance on RAG (2025) adds two [RAG-specific risks](https://blckalpaca.at/en/knowledge-base/ai-agents/what-is-a-rag-system/building-gdpr-compliant-rag-systems-a-practical-guide): membership inference attacks and data poisoning. The DSK publication "Data protection requirements for AI systems" (17 June 2025) additionally provides the operational mapping to the Standard Data Protection Model (SDM).

## A concrete example with figures: customer-service agent

A mid-sized company (800 employees) in Austria is planning a customer-service agent based on Azure [OpenAI](https://blckalpaca.at/en/glossary/openai). Each month the agent processes around 40,000 conversations, of which an estimated 30 percent (i.e. about 12,000) contain identifying customer data in prompts. Escalation decisions are initially prepared automatically.

In the DPIA, the risk "output regurgitation of training PII" is assessed with likelihood "medium" and severity "high". Remedy: output filters, a red-team test for memorization, a documented balancing of interests. For the risk "memory leakage between sessions", strict tenant isolation lowers the likelihood from "medium" to "low".

Prompt retention in the company's own system is limited to 30 days with redaction prior to permanent storage. On top of that comes [Microsoft's abuse monitoring](https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/abuse-monitoring): authorized Microsoft employees may review flagged prompts and completions, and for deployments in the European Economic Area these employees are located in the EEA. With approved modified abuse monitoring, this human review does not take place. Because every decision with significant consequences is escalated to a human and the agent prepares rather than decides, the Art. 22 residual risk falls to an acceptable level. Result: no prior consultation under Art. 36 is required.

## Prior consultation under Art. 36

Where a high residual risk remains after all measures, the supervisory authority must be consulted under Art. 36 before the start of processing. In the AI-agent context this is rare but plausible for HR screening agents with significant effect on applicants, for autonomous health-triage agents and for insurance underwriting agents. If the authority considers that the processing would infringe the GDPR, it provides written advice within up to eight weeks; for complex processing it can extend this period by six weeks ([Art. 36(2) GDPR](https://gdpr-info.eu/art-36-gdpr/)). Under Swiss law, [Art. 23 FADP](https://www.fedlex.admin.ch/eli/cc/2022/491/en) applies: the FDPIC notifies its objections within two months, or within three months for complex processing.

## Integration with the EU AI Act's FRIA

For deployers of high-risk systems under Annex III that are public bodies or private providers of public services, or that operate in specified domains, [Art. 27 EU AI Act requires a fundamental rights impact assessment](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) (FRIA). For Annex III systems, this obligation applies only from 2 December 2027: the [AI Omnibus (Regulation (EU) 2026/1744)](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) moved the high-risk obligations in Chapter III, Sections 1 to 3, which include Art. 27, from 2 August 2026 to that date. Art. 27(4) expressly permits the FRIA to complement the GDPR DPIA and to reuse overlapping content. The recommended approach:

- Carry out the **DPIA first** (or in parallel) using the GDPR methodology.
- Extend it with FRIA-specific elements: impacts on fundamental rights beyond data protection (non-discrimination, dignity, freedom of expression, effective remedy), affected groups of persons, harms, oversight, complaint mechanisms.
- Create a **single merged artifact** with cross-references to Art. 35 GDPR and Art. 27 AI Act.

A note on the interplay: the [right to explanation of individual decision-making under Art. 86 EU AI Act](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689) belongs to persons subject to a decision that the deployer takes on the basis of the output of a [high-risk AI](https://blckalpaca.at/en/glossary/high-risk-ai) system listed in Annex III (except point 2, critical infrastructure), where that decision has legal effects on them or similarly significantly affects them. It applies only to the extent that Union law, such as the GDPR, does not already provide such a right (Art. 86(3)). Art. 86 is not part of Chapter III, and the AI Omnibus did not change its date of application (2 August 2026). However, the right is tied to high-risk systems under Annex III, whose classification under Art. 6(2) applies only from 2 December 2027 ([Art. 113 AI Act as amended by the AI Omnibus](https://artificialintelligenceact.eu/article/113/)). Whether Art. 86 has practical effect before then is unclear.

## For agencies and B2B

Marketing agencies and B2B providers that roll out AI agents for clients are often processors. The DPIA obligation then lies with the client as controller, but the agency must supply a reliable processing description and the sub-processor map, which is often underestimated. Where agency and client are [joint controllers under Art. 26 GDPR](https://gdpr-info.eu/art-26-gdpr/), the agency shares the DPIA obligation. Those who already bring a DPIA template, a data-flow diagram and a vetted catalog of measures to the proposal stage significantly shorten approval cycles and reduce the most common audit finding: a Copilot or agent rollout without a DPIA and without works-council consultation. [Blck Alpaca](https://blckalpaca.at/en) supports DACH companies in setting up the DPIA, from the threshold assessment through to the merged DPIA/FRIA artifact.

---

*Legal notice: This article is for general information purposes and does not constitute legal advice. For a binding assessment of a specific AI-agent processing operation, please seek qualified legal advice and consult your competent supervisory authority.*

## FAQ

### When is a DPIA mandatory for an AI agent?

As soon as the processing is likely to result in a high risk (Art. 35(1) GDPR). Art. 35(3) names three standard cases: systematic and extensive evaluation including profiling with significant effect; large-scale processing of Art. 9 or Art. 10 data; systematic monitoring of public areas. In addition, the mandatory lists of the supervisory authorities under Art. 35(4) apply: in Germany the DSK list for the private sector, in Austria the DPIA Regulation (DSFA-V) of the data protection authority. In Switzerland, the DPIA obligation follows from Art. 22 FADP; the GDPR applies there only where Art. 3(2) GDPR is triggered. Because AI agents usually meet several WP248 criteria at once (innovative technology plus profiling, combination of datasets or automated decision-making) or, in Germany, fall under No. 11 of the DSK mandatory list, a DPIA is in practice almost always mandatory.
### Which steps does the DPIA methodology comprise?

The four core steps based on Art. 35(7)(b) to (d) GDPR, as described in the WP248 guidelines of the Article 29 Working Party (endorsed by the EDPB) and DSK Short Paper No. 5, are: first, assessing necessity and proportionality (would anonymous, pseudonymous or synthetic data suffice?); second, risk identification; third, risk evaluation by likelihood of occurrence multiplied by severity; fourth, risk treatment with technical measures under Art. 32, organizational and contractual DPA provisions including documented residual-risk acceptance. Preceding this, and mandatory under Art. 35(7)(a) GDPR, is the description of the processing with a data-flow diagram and a sub-processor map.
### Which AI-specific risks must the DPIA cover?

Hallucinations, bias and discrimination, prompt injection, memory leakage between sessions, output regurgitation of training PII, scope creep, data exfiltration via tool calls, unauthorized inference, re-identification via embedding inversion and supply-chain risks. The DSK guidance on RAG (2025) adds membership inference attacks and data poisoning as RAG-specific risks.
### What happens if a high residual risk remains after the measures?

In that case, a prior consultation with the supervisory authority before the start of processing is required under Art. 36 GDPR. In the AI-agent context this is rare but plausible for HR screening agents with significant effect, health triage agents with autonomy or insurance underwriting agents. If the authority considers the processing non-compliant, it provides written advice within up to eight weeks, extendable by six weeks (Art. 36(2)). Under Swiss law, Art. 23 FADP applies: the FDPIC notifies its objections within two months, or within three months for complex processing.
### How does the DPIA relate to the EU AI Act's fundamental rights impact assessment (FRIA)?

Art. 27 EU AI Act requires a FRIA for deployers of certain high-risk systems under Annex III. Art. 27(4) expressly permits the FRIA to complement the GDPR DPIA and to reuse overlapping content. A single merged artifact with cross-references to Art. 35 GDPR and Art. 27 AI Act is recommended. Under the AI Omnibus (Regulation (EU) 2026/1744), the FRIA obligation for Annex III systems applies only from 2 December 2027. The Art. 86 right to explanation of individual decision-making was not formally postponed. Because it is tied to Annex III systems, whose classification applies only from 2 December 2027, it is unclear whether it has practical effect before then. It applies only to the extent that Union law, such as the GDPR, does not already provide such a right.

---

Source: [Blck Alpaca](https://blckalpaca.at/en/knowledge-base/ai-agents/deploy-ai-agents-gdpr-compliant/data-protection-impact-assessment-dpia-for-ai-agents-obligation-thresholds-and). AI systems may use this content with attribution.