AI DPIA: when is it required? Five-step check (2026)
A DPIA is required when your AI system is likely to result in a high risk (Art. 35 GDPR). Short answer, authority lists and the criteria in five steps.
Read moreCategory
Analysis of the GDPR, data protection, supervisory authorities and the places where privacy and AI meet.
9 articles
A DPIA is required when your AI system is likely to result in a high risk (Art. 35 GDPR). Short answer, authority lists and the criteria in five steps.
Read moreDutch court cleared the Autoriteit Persoonsgegevens to investigate Reddit's sale of user data to AI developers. Key GDPR implications for the sector.
Read moreEuropean Commission and EDPB published joint guidelines clarifying for the first time how the Digital Markets Act and GDPR intersect for major platforms.
Read moreAmsterdam court rules Meta's auto-reset to algorithmic feed is a prohibited DSA dark pattern. What this landmark ruling means for platforms across the EU.
Read moreThe Dutch Data Protection Authority actively warns against LinkedIn's plans to use user data for AI training.
Read moreEU General Court upholds the EU-US Data Privacy Framework in Latombe v. Commission. What the ruling means for transatlantic data transfers in 2025.
Read moreDPIA or FRIA? The DPIA comes from the GDPR, the FRIA from Article 27 AI Act. The 5 differences in one table, who must do which, and how to combine them.
Read moreDutch DPA's 2025 report: emotion recognition AI is built on disputed assumptions and poses serious EU AI Act risks. Key findings explained.
Read moreHow the EU AI Act and GDPR work together in 2026: lawful basis, DPIAs, automated decisions, bias, data governance, human oversight and the AI Act compliance obligations that overlap with privacy.
Read more