DPIA for a chat assistant: when it is required

The question usually comes late and at the wrong moment: the assistant is built, the knowledge base is in place, the go-live date is set, and someone asks whether a data protection impact assessment should have been carried out. Article 35 GDPR requires one where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons - and it requires it prior to the processing, not afterwards. For a chat assistant the answer is neither automatically yes nor automatically no. It depends on who is writing, what they write about, what the assistant derives from it and what happens to the transcript afterwards. This article walks through the three cases in paragraph 3, through the supervisory authority list, through the situations in which an assistant is covered and through those in which it is not. It closes with the structure of the assessment, the role of the data protection officer and why the result is a document that has to be kept up to date.

Enlarge graphic

Labels in the illustration

• Check the triggers
• Article 9, profiling, the list
• Art. 35(3)
• Seek advice
• Data protection officer
• Art. 35(2)
• Write the assessment
• four components
• Art. 35(7)
• Review
• when the risk changes
• Art. 35(11)
• The three cases in paragraph 3
• (a) Evaluation with legal effects
• systematic and extensive, including profiling
• (b) Special categories, large scale
• Article 9(1) or data under Article 10
• (c) Monitoring of public areas
• systematic and on a large scale
• What paragraph 7 must contain
• (a) Description of the operations and purposes
• (b) Necessity and proportionality
• (c) Assessment of the risks
• (d) Measures envisaged and safeguards
• If a high risk remains despite the measures: prior consultation of the supervisory authority under Article 36(1)

When Article 35 GDPR applies

What Article 35 actually requires

The obligation does not depend on an industry, a headcount or a turnover. It depends on a forecast about the processing itself. The text of the Regulation names four aspects that have to be considered together: the nature, the scope, the context and the purposes of the processing. If that assessment shows a likely high risk to the rights and freedoms of natural persons, the impact assessment is due. If it does not, it is not due - not even where the technology in use is new or looks impressive from the outside.

Two words carry that sentence. Likely means a forecast before the start, not proof after the first damage has occurred. Prior to the processing means before the first real visitor types anything. Together they move the assessment to a place where it rarely ends up in practice - into the planning phase, next to the choice of provider and the definition of retention periods, not after acceptance testing. The second sentence of paragraph 1 expressly allows a single assessment to address a set of similar processing operations that present similar high risks: an assistant running on two domains of the same business with the same knowledge base and the same processing chain does not need a second document.

The three cases in paragraph 3

Paragraph 3 takes part of the forecast off the controller. It names cases in which an assessment is required without the high risk having to be derived separately each time. At the same time, the words in particular show that the list is not exhaustive: an operation that meets none of the three cases may still require an assessment under paragraph 1 - the three cases are a floor, not a ceiling.

• Point (a): a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person
• Point (b): processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10
• Point (c): a systematic monitoring of a publicly accessible area on a large scale

New technology is not a fourth case

The phrase in particular using new technologies appears in paragraph 1 and is regularly read as if it said: anyone using AI needs an assessment. The text does not support that. New technology is a factor that influences the forecast, because less experience about its consequences is available - it is not a condition of its own. An assistant that only explains published content, states opening hours and hands everything else to a person processes conversation content and session data. That is processing, it needs a legal basis, an entry in the record under Article 30 GDPR and reasoned retention periods. A high risk within the meaning of paragraph 1 does not follow from it automatically.

The supervisory authority list

The Regulation does not leave the forecast to the controller alone. Under Article 35(4) GDPR the supervisory authority establishes and makes public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1, and communicates that list to the Board referred to in Article 68. That is the first place to look before weighing anything up yourself. The list is not a recommendation: if your operation is on it, the assessment has to be carried out and your own view steps back.

What counts is the list of the supervisory authority responsible for you. In Germany, supervision of private-sector bodies sits with the federal states, so there is not one list but one per authority - largely aligned in substance, but not identical in wording. Anyone running several establishments therefore settles the question of competence first and reads afterwards. Paragraph 5 additionally allows the supervisory authority to establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. Both lists are an aid to interpretation and a saving of work; they replace your own analysis only where your operation genuinely matches the one described.

When a chat assistant is covered

An assistant is not a single processing operation but a bundle of several. The question is therefore never: does a chat assistant require an assessment? It is: which of the functions this assistant has moves the forecast towards a high risk? Four situations come up regularly.

• Special categories under Article 9(1) GDPR occur regularly, not only in isolated exceptions
• The assistant derives attributes from the conversation that the person did not supply
• Conversations are attributed to a person beyond the session and permanently brought together
• An automatic classification decides how an enquiry is handled from there
• The people concerned are in a weaker position, such as employees, patients or minors
• Data flow to a third country or to recipients the visitor does not expect

When it is not

The most common setup in small and medium-sized businesses is the plain one: the assistant answers questions from a maintained knowledge base, states opening hours, shipping routes and responsibilities, takes a name and an email address where needed and hands everything else to a person. Here none of the three cases in paragraph 3 applies, and the forecast under paragraph 1 usually shows no high risk either. That is not a free pass but the result of an analysis - and it belongs on paper as exactly that.

• Point (a) presupposes a systematic and extensive evaluation of personal aspects that serves as the basis for decisions with legal effects. An assistant that reproduces knowledge and hands over evaluates nobody.
• Point (b) presupposes processing of special categories on a large scale. An occasional detail a visitor supplies unprompted and that is deleted after a short period is not large-scale processing of that category.
• Point (c) concerns systematic monitoring of a publicly accessible area on a large scale. What is meant are areas open to the general public; a chat window on your own website is not addressed by it.

The structure of the assessment

If the obligation applies, you need neither a form nor dedicated software. Paragraph 7 names four components as the minimum content; everything beyond that is a question of presentation. The length follows the operation, not a page count: for an assistant with a clear setup, an assessment of a few pages carries more weight than thirty pages of generalities that would fit any business at all.

• Point (b): an assessment of the necessity and proportionality of the processing operations in relation to the purposes
• Point (c): an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1
• Point (d): the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation
• Paragraph 9: where appropriate, the views of data subjects or their representatives on the intended processing

The data protection officer in the procedure

Involving the data protection officer is not a courtesy towards an internal function but a requirement with a clear addressee and a clear point in time.

Two things follow from this. First, the advice has to be sought while the assessment is being carried out, not by presenting a finished draft for information - advising on the data protection impact assessment and monitoring its performance are expressly among the officer tasks under Article 39(1)(c) GDPR. Second, responsibility stays with the controller: the data protection officer advises and monitors, they do not decide in your place. For private-sector bodies in Germany there is an additional interaction that is often overlooked. Under Section 38(1) BDSG, controllers and processors designate a data protection officer if they constantly employ as a rule at least twenty persons dealing with the automated processing of personal data; if they conduct processing which is subject to a data protection impact assessment under Article 35 GDPR, they have to designate a data protection officer regardless of the number of persons employed in the processing. Anyone concluding that their assistant requires an assessment has therefore triggered a designation duty at the same time.

If the risk remains: prior consultation

The assessment can lead to an uncomfortable result: the risk remains high even once all the measures envisaged have been taken into account. The procedure then does not end in your own house, and the processing must not start in that form until the authority has responded.

The result: a document that keeps going

What stands at the end is not a tick but a document. It is the evidence that the forecast was made, how it is reasoned and which measures follow from it. The accountability principle in Article 5(2) GDPR requires being able to demonstrate compliance; without that document, a careful weighing-up cannot be distinguished from one that never happened. Which details about recipients and sub-processors belong in it follows from the same chain described in the article on processing on behalf of a controller.

Nor is the assessment finished once it is signed. Article 35(11) GDPR requires a review to be carried out where necessary in order to assess whether the processing is performed in accordance with the data protection impact assessment, at least where there is a change of the risk represented by the processing operations. With an assistant, exactly that changes more often than with a form: a new tool, an additional data source, another processor or a new language shifts the risk position without anyone opening the document.

• The assistant gains access to another specialist system or a new tool
• It starts recording new kinds of details, such as attachments, images or voice input
• The knowledge base is extended with content that contains personal data
• A provider involved, a place of processing or a sub-processing arrangement changes
• Attributes are derived from conversations for the first time, or conversations are scored for the first time
• An incident, a complaint or a query from the authority reveals a risk that is not in the document

To describe the processing operation you need the provider’s details: processing location, sub-processors, retention periods and technical measures. For XICBOT they are on the privacy and hosting page; how the related contract is structured is explained in the article on the data processing agreement. How an assistant in a medical practice handles appointment questions and health details is described on the page about the assistant for practices.

Frequent questions