DPIA for an AI tool

How the tool works

1. The screening. The mandatory cases of art. 35(3) GDPR, the eight types of the APD list, then the nine criteria of the WP248 list that the APD applies. Generative AI counts as an innovative use: that criterion is ticked by default, to untick for a conventional tool.
2. The result. A mandatory case: DPIA mandatory. Two criteria or more: DPIA required. One criterion: DPIA recommended. No criterion but client data: a short DPIA recommended before first use. Otherwise, a DPIA is not required. Where the firm may do without, the tool asks it to record its reasons.
3. The context. The tool, the provider, the use (drafting, summaries, translation, transcription, research, the firm's own documents), the data, the persons concerned, the data flow, hosting, retention and training. With the vault open, this information can be taken from the AI tools register.
4. The principles. Necessity and proportionality, legal basis, minimisation and pseudonymisation, accuracy, retention, information, rights of the persons concerned, processor, transfers.
5. The risks. Ten pre-filled risks (breach of professional secrecy, reuse by the provider, access by foreign authorities or the provider's staff, leakage between matters, security incident, inaccurate output, bias, loss of control, unlawful model), with their measures and a severity and likelihood on the CNIL's four-level scales, to adjust.
6. The validation. The residual risk, the advice of the data protection officer if there is one, prior consultation of the APD if a risk stays high (art. 36), the decision, the action plan and the signature.

The DPIA exports to PDF and Word, in the language chosen. With a verified address, it carries your firm's letterhead, and the firm's name is used as the controller.

What the texts say

• GDPR, art. 35: a DPIA is required before a processing likely to result in a high risk, "in particular using new technologies". Recital 91 says that the client data of an individual lawyer are not processed on a large scale.
• APD decision 01/2019: the Belgian list of processing that requires a DPIA. Generative AI is not on it, which does not rule out a DPIA under art. 35.
• APD guidance: in most cases, two criteria of the WP248 list call for a DPIA.
• CNIL AI factsheet: generative AI is an innovative use. CNIL PIA methodology: context, fundamental principles, risks, validation.
• La Tribune of AVOCATS.BE (no. 280) considers a DPIA unavoidable in practice before the first use of a generative AI tool.

Points to watch

• A DPIA is not automatically mandatory for a law firm: the tool recommends one by default before first use with client data, and lets the firm document a reasoned decision not to carry one out.
• One DPIA may cover several similar processing operations and may be reused from a similar processing.
• The severity and likelihood levels offered are a starting point, to review for your case.

What the tool does not do

• It does not consult the APD for you and does not check the provider's statements.
• It sends nothing: your answers stay in this tab's memory.

Verification

The sources were verified on 7 October 2026. The tool assists the lawyer, who remains responsible for the assessment and the decision.