{"data":{"slug":"ai-dpia-supplement","title":"AI Supplement to a Data Protection Impact Assessment","type":"assessment","formats":["docx","xlsx"],"topics":["risk","governance"],"frameworks":["eu-ai-act"],"short":"Fifteen AI-specific questions to add to a DPIA (inferences, training on personal data, accuracy across groups, automated decisions, model attacks, suppliers), with the privacy and impact-assessment duties on record.","covers":{"categories":["privacy_data_protection","impact_assessment"]},"version":1,"dataset_version":"c6967b988bb5","generated_at":"2026-10-05T15:51:24+00:00","citations":22,"downloads":0,"files":[{"format":"docx","filename":"ai-dpia-supplement-v1.docx","bytes":14406,"url":"https://aipolicytracker.org/templates/ai-dpia-supplement#download"},{"format":"xlsx","filename":"ai-dpia-supplement-v1.xlsx","bytes":16822,"url":"https://aipolicytracker.org/templates/ai-dpia-supplement#download"}],"url":"https://aipolicytracker.org/templates/ai-dpia-supplement","inside":["Fifteen questions in nine areas, each with answer, risk rating and mitigation","Document version with a section per area","Privacy and impact-assessment duties sheet"],"legal_basis":["eu-ai-act","uk-ico-ai-data-protection-guidance"],"caveat":null,"covered_obligations":[{"slug":"eu-ai-act-fundamental-rights-impact-assessment","title":"Carry out a fundamental rights impact assessment before deployment","policy":"eu-ai-act","source_reference":"Article 27","url":"https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment"},{"slug":"eu-ai-act-art-26-9-dpia-using-provider-information","title":"Deployers must use the provider's transparency information in their data protection impact assessment","policy":"eu-ai-act","source_reference":"Article 26(9)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information"},{"slug":"india-dpdp-consent-and-notice","title":"Process personal data only with valid consent or a legitimate use, after notice","policy":"india-dpdp-act","source_reference":"Sections 4 to 7","url":"https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice"},{"slug":"india-dpdp-significant-data-fiduciary-duties","title":"Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits","policy":"india-dpdp-act","source_reference":"Section 10","url":"https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties"},{"slug":"nepal-privacy-act-consent-and-purpose","title":"Collect and use personal information only with consent and for the stated purpose","policy":"nepal-individual-privacy-act","source_reference":"Chapter on collection and protection of personal information (reviewer to cite sections)","url":"https://aipolicytracker.org/obligations/nepal-privacy-act-consent-and-purpose"},{"slug":"us-new-york-city-local-law-144-data-policy-disclosure","title":"Employers and employment agencies must disclose the data collected and their retention policy for the tool","policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","source_reference":"NYC Administrative Code Section 20-871(b)(3); 6 RCNY Section 5-303","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure"},{"slug":"singapore-pdpc-consent-or-exception-for-ai-data","title":"Identify consent or an applicable PDPA exception before using personal data in AI","policy":"singapore-pdpc-ai-advisory-guidelines","source_reference":"Advisory guidelines, sections on consent, business improvement and research exceptions","url":"https://aipolicytracker.org/obligations/singapore-pdpc-consent-or-exception-for-ai-data"},{"slug":"south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment","title":"Operators of high-impact AI should assess its impact on fundamental rights before use","policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","source_reference":"Article 35","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-35-high-impact-ai-impact-assessment"},{"slug":"uae-pdpl-impact-assessment-new-technologies","title":"Conduct a data protection impact assessment for high-risk processing using new technologies","policy":"uae-personal-data-protection-law","source_reference":"Article on data protection impact assessment (reviewer to cite article number)","url":"https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies"},{"slug":"uk-ico-dpia-for-ai","title":"Carry out a data protection impact assessment for high-risk AI processing","policy":"uk-ico-ai-data-protection-guidance","source_reference":"UK GDPR Article 35; ICO guidance, accountability and governance section","url":"https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai"},{"slug":"us-nist-ai-rmf-map","title":"Map context, intended use and potential impacts (Map)","policy":"us-nist-ai-rmf","source_reference":"MAP function","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-map"}],"versions":[{"version":1,"generated_at":"2026-10-05T15:51:24+00:00","dataset_version":"c6967b988bb5","changelog":"First version, built from dataset c6967b988bb5.","stats":{"sheets":{"AI questions":15,"Privacy and impact duties":11},"blocks":93,"headings":22,"citations":22}}]},"meta":{"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","disclaimer":"This template is generated from the records on aipolicytracker.org. It is an informational resource, not legal advice, and completing it does not make an organisation compliant with any law or standard. Every row that cites a duty links to the record it came from; check the official source before relying on it."}}