T02 Impact Assessment (FRIA and DPIA Combined)
Verification required. This is a working template, not a regulator-approved form. Where it cites an article or a date, the citation comes from secondary sources or from memory of the legal text and is a pointer to check. This is not legal advice.
How to use: This is a blank form. Copy it and fill in the empty cells and blanks for your system. To copy it, follow the "Suggest an edit to this page" link in the footer to reach its Markdown source.
Wiki controls: AI-CTRL-013, AI-CTRL-037, AI-CTRL-041, AI-CTRL-042. The GDPR Art. 35 DPIA and the AI Act Art. 27 FRIA are [Recalled]. Confirm which legal duties are triggered. The combined form is a convenience and does not replace either legal assessment. Consult your DPO.
1. Summary
| Field | Entry |
|---|---|
| System ID (T01) | |
| Assessor | |
| Date | |
| Trigger | New / change / periodic |
| DPIA required? FRIA required? |
2. Description
- Purpose and context of use:
- Period and frequency of use:
- Categories of persons affected:
- Data categories, special categories, children:
- Data flow with countries (attach):
- Recipients, suppliers, sub-processors:
- Retention:
- Model, provider, version:
- Human oversight design:
3. Lawful basis, necessity, proportionality
| Question | Answer | Evidence |
|---|---|---|
| Lawful basis for each purpose (including training) | ||
| Special category condition, if such data is used | ||
| Necessity: could the aim be met with less data? | ||
| Automated decision rules (Art. 22) satisfied? | ||
| Legitimate interest balancing test (if used) |
4. Rights and transparency
| Right or duty | How supported | Gap |
|---|---|---|
| Information notice (T06) | ||
| Access, correction, deletion | ||
| Objection | ||
| Human review of an automated decision | ||
| Explanation of an individual decision | ||
| Complaint route |
5. Fundamental rights analysis
| Right | Possible impact | Affected groups | Likelihood | Severity | Mitigation | Residual |
|---|---|---|---|---|---|---|
| Non-discrimination | ||||||
| Privacy and data protection | ||||||
| Human dignity | ||||||
| Freedom of expression and information | ||||||
| Access to essential services (credit, insurance, education, work) | ||||||
| Effective remedy | ||||||
| Rights of the child | ||||||
| Other |
6. Technical and organisational measures
| Measure | Entry |
|---|---|
| Bias test (AI-CTRL-041) | |
| Oversight and stop | |
| Security | |
| Logging | |
| Incident route (T05) | |
| Monitoring |
7. Transfers
Attach T04. Record the transfer mechanism and the transfer impact view.
8. Consultation
- DPO advice: record it verbatim, and record how it was handled.
- Security and legal.
- Affected persons or their representatives.
- Workers' representatives, if this is a workplace system.
- Is prior consultation with the data protection authority needed?
- Is notification to the market surveillance authority needed (FRIA)?
Record the decision on each.
9. Decision
Approve / Approve with conditions / Reject. Record the conditions, the approver, the date and the next review.