Templates / GDPR Art. 35 and AI Act Art. 27
DPIA templates for AI systems
Assessment templates structured on Article 35(7), with the hop-by-hop questions LLM deployments raise and an Article 27 FRIA companion. Preview every section, then download the one you need.
Systematic description of the processing
| Hop | Location | Retention |
|---|---|---|
| AI gateway | eu-central | none |
| Model endpoint | germanywestcentral | ZDR |
| Vector store | fr-par | 30 d |
- Retention at each hop, including abuse monitoring
- Whether inputs or outputs may be used for training
- 4
- templates with 44 sections: three GDPR Article 35 DPIAs for AI and one AI Act Article 27 FRIA companion
- 2 of 9
- WP248 criteria met usually means a DPIA is required; LLM deployments typically meet the innovative technology criterion
- WP29 Guidelines on DPIA, WP248 rev.01
- 8 + 6 weeks
- for the supervisory authority's written advice after prior consultation, extendable for complex processing
- GDPR Article 36(2)
- EUR 15M or 3%
- of worldwide annual turnover: EU AI Act ceiling for breaching high-risk and other operator obligations
- Regulation (EU) 2024/1689, Art. 99(4)
General LLM deployment DPIA
Internal copilots, retrieval over company documents, and LLM features inside back-office workflows.
- For
- DPOs and AI platform teams rolling out LLMs to employees or internal systems.
- Why it is usually required
- New technology plus large-scale or highly personal data usually meets two WP248 criteria.
Sections (10)
Art. 5(2), 35(2), 35(11)
Accountability under Article 5(2) means you must be able to show who assessed what, when, and with whose advice. Article 35(2) requires the controller to seek the advice of the DPO, where one is designated, when carrying out the assessment. Article 35(11) requires review at least when the risk represented by the processing changes.
- Controller (legal entity, address) and, if different, the business owner of the AI system.
- Data Protection Officer consulted (name, date, summary of advice, whether the advice was followed and why).
- Version, date of this assessment, and the scheduled review date.
- Processors and sub-processors in the inference path (gateway, model provider, retrieval store, logging).
Build your copy
The file is generated in your browser. Nothing you type here is sent to YTT Secunet.
- sections
- 10
- prompts
- 37
- tables
- 4
yttsecunet-dpia-general-llm-deployment.md
Markdown opens in any editor and converts cleanly to Word or Confluence. Checkboxes and empty answer lines are ready to fill.
| Template | Use case | Why it is usually required | Legal anchors |
|---|---|---|---|
| DPIA-01 General LLM deployment DPIA | Internal copilots, retrieval over company documents, and LLM features inside back-office workflows. | New technology plus large-scale or highly personal data usually meets two WP248 criteria. |
|
| DPIA-02 Customer-facing AI assistant DPIA | Chat and voice assistants used by your customers, including B2B SaaS assistants processing your customers' end users. | Large-scale processing of customer conversations, possible vulnerable users, and innovative technology. |
|
| DPIA-03 Special category / health data AI DPIA | Clinical documentation, triage, claims and research use of LLMs on health or other Article 9 data. | Large-scale processing of special category data is a mandatory DPIA case under Art. 35(3)(b). |
|
| FRIA-27 EU AI Act FRIA companion (Article 27) | Fundamental rights impact assessment for deployers of high-risk AI, built to sit alongside your GDPR DPIA. | Article 27 applies to these deployers before first use of an Annex III high-risk system. |
|
- 01
Screen against Article 35 and WP248
Record which Article 35(3) cases and WP248 criteria apply. Keep the reasoning even if you conclude no DPIA is required. - 02
Describe the inference path hop by hop
Client, gateway, model endpoint, retrieval store and observability: entity, parent, location, what each stores and for how long. - 03
Settle roles, basis and transfers
Article 6 basis per purpose, Article 28 terms with each processor, and the Chapter V tool and TIA for anything that leaves the EEA. - 04
Score the risks before measures
Likelihood and severity from the data subject's side: retention, training use, out-of-region failover, third-country access, inaccurate outputs. - 05
Attach evidence to every measure
Policy pack version, signed residency receipts for a sample period, and the masking recall you measured. Evidence beats vendor statements. - 06
Sign off, consult if needed, set triggers
Residual risk, Article 36 prior consultation where high risk remains, accountable approver, and the events that reopen the assessment.
The measures section asks for evidence that each control operates. For the inference path, a signed residency receipt answers the questions an assessor would otherwise take on trust: which endpoint answered, in which region and facility, under which policy version, and whether zero retention applied.
{
"req": "sha256:3b1f0c4e...e09c",
"policy": "eu-gdpr-strict@4.2.0",
"endpoint": "azure-openai/germanywestcentral",
"region": "germanywestcentral",
"facility": "FRA-AZ-02",
"tls_sha256": "5e:9a:41:...:c1",
"model": "gpt-4o",
"zdr": true,
"ts": "2026-11-06T13:42:07Z"
}Receipts are leaves in an hourly Merkle tree with a published root, so the sample you attach can be checked offline with ytt-verify. How the proofs work
Is a DPIA the same as a transfer impact assessment?
No. A DPIA under Article 35 assesses risks to data subjects from the processing as a whole. A TIA assesses whether the law and practice of a third country undermine the Chapter V tool you rely on, following EDPB Recommendations 01/2020. The templates include a transfers section that records the TIA reference; the TIA itself is a separate document.
When do I need the FRIA rather than a DPIA?
Article 27 of the AI Act applies to specific deployers of high-risk systems: bodies governed by public law, private entities providing public services, and deployers of credit scoring or life and health insurance pricing systems under Annex III, points 5(b) and 5(c). It complements the GDPR DPIA rather than replacing it, which is why the FRIA template cross-references the DPIA.
We are a SaaS vendor. Do we have to carry out the DPIA?
For end-user conversations you process on your customers' instructions you are usually their processor, and the DPIA duty sits with each customer as controller. Article 28(3)(f) requires you to assist them. The customer-facing assistant template is written so you can hand it to your customers' DPOs as an assistance pack.
What format are the downloads, and can we change them?
Markdown, generated in your browser from the template you select. It opens in any editor and converts to Word, Google Docs or Confluence. Edit freely: delete rows that do not apply, add your own risks, and keep the legal anchors so reviewers can trace each section.
Does using YTT Secunet complete the assessment for us?
No. YTT Secunet supplies evidence for the measures section, such as residency receipts, policy pack versions and records of processing exports. The assessment, the residual risk judgement and any Article 36 consultation remain the controller's responsibility.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.