What are a DPIA and a FRIA?
A DPIA (Data Protection Impact Assessment) is the written assessment that the GDPR requires before processing personal data in ways likely to pose a high risk to individuals. A FRIA (Fundamental Rights Impact Assessment) is the written assessment that the EU AI Act requires from certain deployers before they put a high-risk AI system into use. The two documents come from different laws, cover overlapping ground, and are often produced together for the same AI project.
The DPIA is older and better understood. Article 35 of the GDPR triggers it for systematic and extensive profiling with significant effects, large-scale processing of sensitive data, and systematic monitoring of public areas, and supervisory authorities publish lists of further triggers. Most AI systems that make decisions about people meet at least one.
How a DPIA and a FRIA work
| Aspect | DPIA | FRIA |
|---|---|---|
| Legal basis | GDPR Article 35 | EU AI Act Article 27 |
| Who must do it | The data controller, for any high-risk processing of personal data | Deployers that are public bodies or provide public services, and deployers using high-risk AI for credit scoring or life and health insurance pricing |
| Scope of harm | Risks to individuals’ rights and freedoms from the data processing | Risks to fundamental rights from the system’s use, including non-discrimination, dignity, and access to services |
| Required content | Description of processing, necessity and proportionality, risk assessment, mitigation measures | Description of use, period and frequency, affected groups, specific risks, human oversight measures, response plan if risks materialize |
| Who sees it | The data protection officer, and the supervisory authority if residual risk stays high | The market surveillance authority, which must be notified |
The Act states that where a DPIA already covers an obligation, the FRIA can build on it instead of repeating it. In practice teams write one combined assessment with sections that map to each law.
DPIA and FRIA in practice
A consumer lender in the Netherlands introduces an AI credit scoring system from a vendor. Because the system profiles applicants and decides on credit, the DPIA is mandatory, and because credit scoring is a listed high-risk use, so is the FRIA. The combined assessment describes the data fields used and why each is necessary, tests outcomes across protected groups, documents the human review an applicant can request, and sets out what the lender will do if monitoring shows a disparity. The data protection officer signs off, the FRIA is notified to the authority, and both are filed with the AI inventory entry.
What to watch for
- Start the assessment before the vendor is selected, because its findings often change the requirements.
- A DPIA alone does not cover the FRIA’s questions about human oversight and affected groups, so check the gaps.
- Update both documents when the model, the data, or the population served changes.
- Many US companies owe a DPIA for their European operations without realizing it, since the trigger is the processing of EU residents’ data wherever the head office sits.