What triggers a DPIA under the GDPR?

Processing likely to result in a high risk to the rights and freedoms of individuals. Article 35(3) names three cases explicitly: systematic and extensive automated evaluation of personal aspects including profiling, where decisions with legal or similarly significant effects are based on it; large-scale processing of special categories or criminal-offence data; and systematic monitoring of a publicly accessible area on a large scale. The controller performs it before processing begins.

Who has to do a fundamental rights impact assessment under the EU AI Act?

Not every deployer. Article 27 applies to deployers that are bodies governed by public law, private entities providing public services, and deployers of the Annex III high-risk uses covering creditworthiness and credit scoring and risk assessment and pricing for life and health insurance. It is done before first use, and the result is notified to the market-surveillance authority.

What is the difference between a DPIA and a FRIA?

A DPIA is a GDPR instrument owed by the controller and confined to risks to personal data. A FRIA is an EU AI Act instrument owed by certain deployers of high-risk systems, covering the wider fundamental-rights impact of a particular deployment including harms with no personal-data dimension. They overlap and can share work, but neither substitutes for the other.

Does a deployer perform the conformity assessment?

No. The conformity assessment is a provider duty performed before the system is placed on the market, and it cannot be pushed onto a deployer. For most Annex III high-risk uses it is internal control carried out by the provider itself, with a notified body required only in specific cases such as certain biometric systems.

Which of the following trigger a mandatory DPIA under GDPR Art. 35? (Select all that apply.)

Systematic, extensive automated evaluation producing legal or similar effects.

Large-scale processing of special-category or criminal-offence data.

Systematic monitoring of a publicly accessible area on a large scale.

Processing on a list the supervisory authority publishes as requiring one.

Deploying any system that meets the definition of an AI system.

A DPIA concludes that high risk to individuals remains even after every available mitigation. What does the GDPR require next?

Consult the supervisory authority before the processing begins.

Inform the affected individuals of the residual risk before starting.

Proceed, because completing the assessment discharges the duty.

Record the residual risk and review it at the next annual cycle.

Who performs the conformity assessment for a high-risk AI system, and when?

The provider, before the system is placed on the market.

The deployer, before the system is first put into service.

A notified body, in every case, before market placement.

The market-surveillance authority, after the system is registered.

An organisation moves personal data to a vendor’s United States cloud region under standard contractual clauses. What else does the GDPR require?

A transfer risk assessment of whether local law undermines the clauses.

Nothing more — standard contractual clauses are a complete safeguard.

An adequacy decision, since clauses alone cannot authorise a transfer.

A data protection impact assessment, triggered by the transfer itself.

Which assessment, and who owes it

Individually these are straightforward. Collectively they are one of the most reliable sources of lost marks, because six instruments across three regimes have different owners, different triggers and different timing — and a question will happily offer you a real assessment owed by the wrong party. Sort by who and when before you judge what.

Assessment	Instrument	Who owes it	When
DPIA	GDPR Art. 35	The controller	Before the processing begins
FRIA	EU AI Act Art. 27	Certain deployers of high-risk systems	Before first use of the system
Conformity assessment	EU AI Act Art. 43	The provider	Before the system is placed on the market
AI impact assessment	ISO/IEC 42005	Whoever operates the management system	Across the life cycle, revisited on material change
Transfer risk assessment	GDPR Chapter V, post-Schrems II	The exporting controller or processor	Before transferring, and kept under review
LIA	GDPR Art. 6(1)(f)	The controller	Before relying on the basis

Each one in full

DPIA Data protection impact assessment GDPR Art. 35

What triggers it: Processing "likely to result in a high risk" to rights and freedoms. Art. 35(3) makes three cases explicit: systematic and extensive automated evaluation of personal aspects, including profiling, on which decisions with legal or similarly significant effects are based; large-scale processing of special categories or criminal-offence data; and systematic monitoring of a publicly accessible area on a large scale.
What it produces: A documented assessment of necessity, proportionality and risk, with mitigations. Where high risk remains after mitigation, Art. 36 requires prior consultation with the supervisory authority before proceeding.
Worth knowing: The DPO must be consulted where one is designated. Supervisory authorities also publish lists of processing that always requires a DPIA, and lists that never does.

FRIA Fundamental rights impact assessment EU AI Act Art. 27

What triggers it: Not every deployer. It applies to deployers that are bodies governed by public law, to private entities providing public services, and to deployers of the Annex III high-risk uses covering creditworthiness and credit scoring, and risk assessment and pricing for life and health insurance.
What it produces: A description of the deployment processes, the period and frequency of use, the categories of people affected, the specific risks of harm to them, the human-oversight measures, and what happens if the risks materialise. The result is notified to the market-surveillance authority.
Worth knowing: Where a DPIA has already been done, the FRIA complements it rather than repeating it — the assessments overlap deliberately and can share work.

Conformity assessment Conformity assessment EU AI Act Art. 43

What triggers it: Any high-risk AI system, without exception. It is the pre-market gate: satisfy the Art. 9–15 requirements, verify conformity, draw up the EU declaration of conformity, affix the CE marking, register in the EU database.
What it produces: The declaration of conformity and CE marking that authorise market placement, backed by the Annex IV technical documentation.
Worth knowing: For most Annex III uses this is internal control performed by the provider itself. A notified body is required only in specific cases, notably certain biometric systems, and for high-risk AI that is a safety component of a product already regulated under EU sectoral law.

AI impact assessment AI system impact assessment ISO/IEC 42005

What triggers it: No legal trigger — this is guidance, not law. It is the method organisations use to run the assessments the law does require, and an ISO/IEC 42001 management system will expect it as a documented process.
What it produces: A documented evaluation of effects on individuals, groups and society: affected stakeholders, benefits, harms with likelihood and severity, mitigations, residual risk, and an explicit deploy or do-not-deploy decision.
Worth knowing: Broader than a DPIA, which is confined to personal-data risk. An AIA reaches safety, fairness, autonomy and environmental effects with no personal-data dimension at all.

Transfer risk assessment Transfer risk assessment GDPR Chapter V, post-Schrems II

What triggers it: Relying on Art. 46 appropriate safeguards — most often standard contractual clauses — to move personal data outside the EEA. Not required where an adequacy decision covers the destination.
What it produces: An assessment of whether the destination country’s law undermines the safeguards in practice, plus any supplementary measures needed. If the gap cannot be closed, the transfer must not proceed.
Worth knowing: Frequently missed on AI fact patterns, because the transfer is buried in the choice of cloud region rather than stated as a transfer.

LIA Legitimate interests assessment GDPR Art. 6(1)(f)

What triggers it: Choosing legitimate interests as the Art. 6 lawful basis — very common for AI training on data the organisation already holds.
What it produces: The three-part balancing test recorded: is the interest legitimate, is the processing necessary for it, and is it overridden by the individual’s interests, rights and freedoms?
Worth knowing: Not named as "LIA" in the Regulation, but the balancing is required in substance and accountability means being able to show it. Art. 21 gives a right to object that can defeat the basis afterwards.

How questions exploit the overlap

The right assessment, the wrong party

The most common distractor shape. A FRIA offered as a provider duty; a conformity assessment offered as something a deployer performs on the provider’s behalf. Settle who the question is asking about before you judge what they owe.

Assuming the DPIA covers it

A DPIA is confined to personal-data risk. A system can be fully compliant on data protection and still cause safety or fairness harms — which is exactly the gap the FRIA and an AIA exist to close. They complement, they do not substitute.

Assuming every deployer owes a FRIA

Art. 27 is narrower than it looks: public bodies, private entities providing public services, and the credit and insurance Annex III uses. A private company deploying a high-risk hiring tool does not automatically owe one.

Assuming a notified body is always involved

For most Annex III systems the conformity assessment is internal control performed by the provider itself. Third-party involvement is the exception, not the rule.

Missing the transfer

A vendor processing "in its US cloud region" is a Chapter V transfer. It needs adequacy or safeguards plus a transfer risk assessment, and the fact pattern will rarely use the word "transfer".

The one-line version

The provider certifies the system; the deployer assesses the deployment. A conformity assessment asks whether the thing as built meets the Act's requirements. A FRIA asks what this particular use, on these particular people, in this particular organisation, will actually do to them — which is the question a provider cannot answer, because it does not know the context. Everything else follows from that split.

Test yourself

5 questions on what is above, with every option explained. Your score is kept in this browser and shown on your dashboard, and saved to your account if you are signed in.

Quick check: which assessment, and who owes it1 / 5 · score 0

A private company deploys a high-risk AI system to screen job applicants. Does it owe a fundamental rights impact assessment under Art. 27?

AYes — because employment screening affects fundamental rights of applicants.
BNo — Art. 27 does not reach an ordinary private employer using a hiring tool.
CNo — the FRIA is a provider duty performed before the system reaches market.
DYes — every deployer of any high-risk AI system owes a FRIA before first use.

Which assessment, and who owes it

Each one in full

How questions exploit the overlap

The one-line version

Test yourself

Study the whole syllabus free