Rules
When you must conduct a DPIA for an AI chatbot or AI search feature, what it needs to contain and how to approach the assessment in seven steps.
A DPIA is mandatory if using the AI tool is likely to present a high risk to the rights and freedoms of people in your files. This certainly applies when you process special category data on a large scale, or when the tool assesses people and decisions follow. In other cases, assess nine criteria.
The duty is in Article 35 GDPR. The law calls a DPIA a data protection impact assessment. The first paragraph expressly mentions processing “using new technologies” and requires assessment before processing. On its DPIA page, the Autoriteit Persoonsgegevens (AP) gives three aids for deciding whether one is required: the law itself, its own list and the nine criteria from European supervisory authorities.
Article 35(3) specifies three cases in which a DPIA is required in any event:
For an office AI tool, the first two matter. A healthcare practice making patient files searchable processes health data. An HR department having a model rank applicants assesses people.
Under Article 35(4), the AP has adopted a list of processing activities requiring a DPIA. The decision is dated 19 November 2019 and has applied since 27 November 2019. It lists seventeen types, from covert investigations and blacklists to camera surveillance and biometric data.
Artificial intelligence is not a separate type. That does not mean AI is excluded. The list describes what you do with data, not the technology used. With an AI tool, you are most likely to encounter these types:
The AP adds that the list is not exhaustive. If your processing is not listed, assess for yourself whether the risk is high. According to the AP, ad hoc or occasional processing does not count as systematic.
The nine criteria come from European supervisory authorities' WP248 guidelines, adopted on 4 April 2017 and last revised on 4 October 2017. The AP's rule of thumb is to conduct a DPIA when your processing meets two or more criteria. The guidelines themselves say this applies “in most cases”, and sometimes one criterion suffices.
The table applies the criteria to an AI chatbot or AI search feature over client files.
| Criterion | When it matters for an AI tool |
|---|---|
| 1. Evaluation or scoring | When the tool assesses or ranks people: applicants, clients, pupils. Not when it only retrieves passages from documents. |
| 2. Automated decision-making with legal effects | When output leads without human intervention to a decision significantly affecting someone, such as rejection. |
| 3. Systematic monitoring | When you systematically track employees' use of the tool or use it to monitor behaviour. |
| 4. Sensitive data | When files contain health, criminal offence, financial or other highly personal data. Almost always in healthcare, legal work and HR. |
| 5. Data processed on a large scale | When you open up an entire archive or all a department's files rather than one document. |
| 6. Matching or combining datasets | When the tool combines sources created for different purposes in a way people do not expect. |
| 7. Vulnerable data subjects | When files concern employees, patients, children or others in an unequal relationship with your organisation. |
| 8. Innovative use of new technology | Generally applies to generative AI: the technology's consequences are not yet fully known. |
| 9. Preventing exercise of a right, service or contract | When output determines whether someone receives a service or can enter into a contract. |
Take a fictional example. Lindehof consultancy wants employees to use an AI assistant to search all clients' personnel files. The files contain absence data (criterion 4), the whole archive is involved (criterion 5), the data subjects are employees (criterion 7) and the technology is new (criterion 8). That makes four. A DPIA is necessary here.
Another fictional example: an employee asks a chatbot to improve a newsletter's tone, without personal data. No criterion applies, and there is no personal data processing for which a DPIA arises.
Document why. The AP is explicit: even someone meeting no criteria or only one must substantiate why they do not conduct a DPIA. This is part of accountability. Half a page testing the nine criteria, with a date and name, is enough and far better than nothing.
The AP is also working on a list of processing activities not requiring a DPIA. It requested comments on a provisional list in June 2026, intended for groups including SMEs and the self-employed. Consultation has closed. The list applies only after European supervisory authorities have advised and the AP has published it in the Dutch Official Gazette. Until then, you cannot rely on it.
You may choose your own method provided it includes the four elements in Article 35(7).
The law does not prescribe an AI chapter. These points belong in an honest processing description because they are where risks lie:
The AP expressly asks you to consider what remains after measures. Describe high risks you cannot completely prevent, the situations where they arise, their likelihood and resulting harm. This assessment determines whether you may proceed or must first approach the AP.
Start during design, the AP says, even before all details are known. Needing to revise the DPIA later is no reason to postpone it.
A DPIA is not a one-off task. Article 35(11) requires review at least when risk changes. With AI tools, that happens often: the provider changes terms, a connection to a new source is added or the tool is used for another purpose. The AP recommends repeating a DPIA periodically even without changes, for example every three years.
If the DPIA shows risk remains high and you cannot find measures to reduce it. Article 36 calls this prior consultation. The AP explains the procedure: complete an application form and submit the DPIA, plus your DPO's advice if you have one.
Three things to know:
Consultation is intended for residual risks. The AP does not assess which lawful basis you should choose in it. If measures do reduce the risk, you do not need to request consultation.
What goes wrong when employees nevertheless enter data, and when that is a breach, is in data breach through an AI chatbot. The broader explanation of chatbots and GDPR is on ChatGPT, Claude, Mistral Vibe and the GDPR.
PrivaSearch creates a DPIA starter document. According to GDPR and EU AI Act, it contains a test of the DPIA duty against nine WP248 criteria, risk analysis with gross and net scores per risk, measures and a conclusion about residual risk. It is not a completed legal judgement: review by a lawyer or DPO is necessary.
The document comes from one form, deterministically and without a language model. Its content follows your environment's actual configuration, so it contains no disabled measure. Alongside the DPIA starter document, your environment creates an AI policy, an entry for the record of processing activities and a written lawful basis with a balancing test.
Measures appearing in such a DPIA are described on how PrivaSearch works: personal data is detected within PrivaSearch and replaced with pseudonyms, a colleague approves before a document becomes searchable, access is per project and actions are logged. Parties involved in processing are in the sub-processor overview.
We are clear about what remains yours. Automatic detection is never complete; human review is therefore mandatory. The rest of your record, your DPO's advice and formal adoption are your work. These are starter documents, not legal advice. To see the starter document, book a demo.
That depends on what you do, not the product. If you use it to process health or other sensitive data on a large scale, or the tool assesses people, a DPIA is mandatory. In other cases, assess nine European criteria. The Autoriteit Persoonsgegevens' rule of thumb is: conduct a DPIA for two or more criteria.
No, not as a separate type of processing. The 2019 list names seventeen types, such as large-scale health data processing, profiling and employee monitoring. An AI tool may fall within them because the list describes what you do with data, not which technology. The list is also not exhaustive.
You conduct a DPIA yourself to identify processing risks and choose measures. Prior consultation is the next step, needed only when risk remains high despite measures. You then present processing to the Autoriteit Persoonsgegevens and may not start before it has assessed your application.
The duty depends on risk, not business size. A small practice processing health data on a large scale may qualify. The Autoriteit Persoonsgegevens is working on a list of activities requiring no DPIA, intended for groups including SMEs, but that list had not been finally adopted in October 2026.
The controller ensures the DPIA is conducted. That is the organisation using the AI tool, not the supplier. You may outsource the work, for example to a specialist firm, but retain ultimate responsibility. If you have a data protection officer, you must seek their advice and record in the report what you did with it.
The GDPR requires review at least whenever processing risk changes. With AI tools, that happens when the provider changes terms, you connect a new source or use the tool for another purpose. The Autoriteit Persoonsgegevens recommends repeating a DPIA periodically even without change, for example every three years.
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
What a deepfake is, which rules apply now, which prohibition is coming and how organisations tackle fraud using a fabricated voice or video.
What the Dutch Algorithm Register and IAMA are, what is mandatory and what is not, and what a municipality arranges when staff use AI chatbots.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →