DPIA vs FRIA: what is the difference? 5 points (2026)

The core difference: a DPIA covers privacy risks of processing personal data under the GDPR, while a FRIA assesses the full spectrum of fundamental rights when high-risk AI systems are deployed under the EU AI Act. A DPIA is triggered by risky processing of personal data, a FRIA by certain deployers using AI in the high-risk areas of Annex III. Organisations deploying high-risk AI often need both, and Article 27(4) AI Act lets the FRIA refer to the parts of an existing DPIA that already cover an obligation.

First want to know whether you need a DPIA at all? Check it in five steps in when a DPIA is required for AI. Ready to start on the FRIA? Download the free FRIA template for Article 27 (Word) or read the FRIA guide to Article 27.

The difference between a DPIA and a FRIA in one table

Why two different impact assessments?

The GDPR, applicable since 25 May 2018, introduced the Data Protection Impact Assessment (DPIA) as an instrument to identify and limit risks to the rights and freedoms of people when personal data is processed. With the EU AI Act, which entered into force in August 2024, the Fundamental Rights Impact Assessment (FRIA) was added, specifically for high-risk AI systems.

This dual obligation arises because AI systems can pose broader risks than data protection alone. Where a DPIA concentrates on privacy-related risks, a FRIA looks at the full spectrum of fundamental rights that AI can affect.

DPIA: data protection at the centre

When is a DPIA mandatory?

Under Article 35 of the GDPR you carry out a DPIA when processing is "likely to result in a high risk to the rights and freedoms of natural persons." That is always the case for (Article 35(3)):

• a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based;
• large-scale processing of special category or criminal offence data;
• systematic monitoring of a publicly accessible area on a large scale.

On top of that come the supervisory authority's list of mandatory DPIAs and the test against the nine criteria of the EDPB guidelines. How to decide this for an AI system in five steps is explained in when a DPIA is required for AI.

Minimum content of a DPIA

Article 35(7) of the GDPR requires a DPIA to contain at least:

• a systematic description of the processing operations and their purposes;
• an assessment of the necessity and proportionality of the processing;
• an assessment of the risks to the rights and freedoms of data subjects;
• the measures envisaged to address those risks.

FRIA: a broader focus on fundamental rights

Legal basis and purpose

The Fundamental Rights Impact Assessment (FRIA) is laid down in Article 27 of the EU AI Act as a tool to assess the impact on fundamental rights before a high-risk AI system is put into use. Unlike the DPIA, which focuses primarily on data protection, the FRIA looks at all relevant fundamental rights an AI system may affect, including human dignity, non-discrimination, freedom of expression and access to justice.

When is a FRIA mandatory?

Article 27(1) of the AI Act requires two categories of deployers to carry out a FRIA, not the providers of AI systems. It always concerns high-risk systems in Annex III, with the exception of point 2 (critical infrastructure).

Category 1: bodies governed by public law and private entities providing public services

This category covers all bodies governed by public law and private entities providing public services. According to recital 96, those public services include education, healthcare, social services, housing and the administration of justice. An ordinary private employer using AI for recruitment therefore does not fall into this category.

Category 2: creditworthiness and life and health insurance (all deployers)

The second category applies to any organisation, public or private, that uses high-risk AI to evaluate the creditworthiness of natural persons or establish their credit score (Annex III point 5(b)), or for risk assessment and pricing in life and health insurance (point 5(c)). Banks, lenders and insurers using such systems must therefore carry out a FRIA, even if they do not provide a public service.

Which AI systems require a FRIA?

The FRIA duty applies only to high-risk AI systems under Article 6(2) and Annex III of the AI Act. Those are the areas of biometrics, education and vocational training, employment and workers management, access to essential private and public services, law enforcement, migration, asylum and border control, and administration of justice and democratic processes. Annex III point 2 (critical infrastructure) is excluded.

What must a FRIA contain?

Article 27(1) lists six elements:

1. a description of the deployer's processes in which the system will be used in line with its intended purpose;
2. the period of time within which, and the frequency with which, the system is intended to be used;
3. the categories of natural persons and groups likely to be affected;
4. the specific risks of harm likely to affect those categories, taking into account the information given by the provider under Article 13;
5. a description of the implementation of human oversight measures, according to the instructions for use;
6. the measures to be taken if those risks materialise, including internal governance and complaint mechanisms.

FRIA process and requirements

A FRIA is carried out before the first use of the high-risk AI system (Article 27(1) and (2)). In similar cases the deployer may rely on a previously conducted FRIA or on an existing impact assessment carried out by the provider. The FRIA only needs to be updated when one of the elements changes or is no longer up to date (Article 27(2)).

Once completed, the deployer notifies the market surveillance authority of the results and submits the filled-out template that the AI Office develops under Article 27(5) (Article 27(3)). In the case of Article 46(1), an exceptional authorisation by the market surveillance authority for reasons of public security, the protection of life and health of persons, environmental protection or the protection of key industrial and infrastructural assets, the deployer may be exempt from that notification.

Overlap and coherence

An integrated approach is possible

The AI Act recognises the overlap between the two assessments. Where an obligation from Article 27 is already met through the DPIA, the deployer may refer in the FRIA to the relevant parts of that DPIA or include them (Article 27(4)). In practice organisations can choose:

1. Two separate assessments: a separate DPIA and FRIA document
2. One integrated assessment: one combined document that meets both sets of requirements

Conditions for integration

For a successful integration the document must:

• cover all DPIA elements of Article 35(7) GDPR;
• contain all six FRIA elements of Article 27(1) AI Act;
• address the broader scope of fundamental rights, not only data protection.

Fundamental rights: more than privacy

The broader scope of the FRIA

Where a DPIA focuses primarily on Article 8 of the EU Charter of Fundamental Rights (protection of personal data), a FRIA assesses a much broader spectrum of rights. Think of human dignity (Article 1), equality before the law (Article 20), non-discrimination (Article 21), cultural, religious and linguistic diversity (Article 22) and the right to an effective remedy (Article 47), so that people can challenge AI decisions that affect them.

The practical challenge

This broader scope makes a FRIA more complex than a DPIA. Organisations need knowledge of fundamental rights beyond data protection, multidisciplinary teams that combine legal, technical and ethical expertise, and a systematic way to assess all relevant rights. That requires a step from the established method of privacy impact assessments to a broader assessment that many organisations are still building.

Where things stand in October 2026: when does the FRIA apply?

From 2 December 2027, and for existing public-authority systems by 2 August 2030

The FRIA duty follows the high-risk rules of Annex III. Since the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) those apply from 2 December 2027; for high-risk AI in products under Annex I the date is 2 August 2028. A high-risk system already in use before that date is caught only once it is significantly changed. If such a system is intended for use by public authorities, provider and deployer must comply by 2 August 2030 at the latest (Article 111(2)). A municipality with a system that has been running for years therefore does not necessarily face 2 December 2027 as its deadline.

The AI Office template

Article 27(5) tasks the AI Office with developing a template for a questionnaire, including through an automated tool, to help deployers meet their obligation in a simplified way. Check the AI Act Service Desk for whether that template is available. Until then, structure the FRIA along the six elements of Article 27(1), so your analysis fits the official template later.

Detecting bias with special category data: Article 4a

The Digital Omnibus also affects the DPIA. The legal basis for processing special categories of personal data to detect and correct bias now sits in Article 4a; Article 10(5) has been deleted. Providers of high-risk systems may do so exceptionally and only to the extent strictly necessary, under conditions such as pseudonymisation, strict access controls and deletion once the bias is corrected. Paragraph 2 opens the same possibility, under the same conditions, for other AI systems and models and for deployers. The GDPR continues to apply in full: record in the record of processing activities why the processing was strictly necessary and assess it in the DPIA.

Timing and approach

Organisations already using AI systems do well to work along three tracks. For existing systems they assess whether those fall under the FRIA duty and which date applies, including the transitional rule of Article 111(2). For new systems the FRIA becomes part of the design and procurement process from the earliest stage, so fundamental rights are built in rather than added afterwards. And for both, they set up a process to update the FRIA when one of the elements of Article 27(1) changes.

Compliance strategy: managing both assessments

For organisations with both obligations

Many organisations will face both assessments and benefit from one integrated approach. It starts with an inventory of all processing of personal data and all AI systems, so the full scope of the assessment duties is clear. Next comes a gap analysis to see where DPIA and FRIA requirements overlap and where they differ.

Where possible, organisations develop a combined template that meets both sets of requirements, and one process that supports both assessments without duplicate work. Finally, capability building is needed: compliance teams must be able to assess fundamental rights beyond data protection.

Risk management

Treat impact assessments as part of wider risk management, not as a stand-alone compliance exercise. That means building DPIA and FRIA processes into existing project workflows, linking them to existing frameworks such as ISO standards or sector rules, and using the outcomes as input for decisions on deploying AI.

Supervision and enforcement

Different supervisors

DPIAs fall under the supervision of the data protection authority, while the results of a FRIA are notified to the market surveillance authority. These different lines mean different expectations, procedures and update moments in practice. Take that into account in a combined document.

Sanctions

Non-compliance can lead to fines. Under the GDPR, DPIA violations can lead to fines of up to 10 million euro or 2% of worldwide annual turnover (Article 83(4) GDPR). Under the AI Act the picture is different from what is often assumed. The highest tier, up to 35 million euro or 7% of worldwide annual turnover, applies only to prohibited practices (Article 99(3)). Article 27 is also not listed in Article 99(4) (up to 15 million euro or 3%). Sanctions for FRIA non-compliance therefore follow from the national rules Member States lay down under Article 99(1). In the Netherlands that implementing act has not yet been adopted.

Looking ahead

The run-up to 2 December 2027 is expected to bring more guidance: the AI Office template under Article 27(5) and further Commission guidelines. For the DPIA, the EDPB put a common DPIA template out for consultation in 2026. As organisations and supervisors gain experience, DPIA and FRIA processes will grow closer together.

Conclusion

The arrival of the FRIA next to the DPIA marks a shift in how we think about AI governance. Where data protection was long the main lens, the EU now recognises that AI systems can affect a broader spectrum of fundamental rights.

For organisations this means more obligations, but also a chance to set up risk management more broadly. Those who see DPIA and FRIA not as separate duties but as complementary instruments build stronger governance.

Under Regulation (EU) 2026/1744 the Annex III high-risk rules apply from 2 December 2027 and those for product-embedded high-risk AI from 2 August 2028. Use that time to integrate FRIA and DPIA processes before implementation decisions become hard to reverse.

Ready to start? Use our FRIA generator to create a FRIA report step by step, or download the FRIA template as a starting point. For the full background on Article 27 read the FRIA guide, and for the DPIA side the five-step check for the AI DPIA. Want to test your own situation? Use the free case check.

Frequently asked questions