DPIA for HR AI: when is it mandatory and how do you combine it with the FRIA?

Short answer: A data protection impact assessment (DPIA) is mandatory under Article 35 GDPR as soon as an HR AI application is likely to result in a high risk to the people concerned — with large-scale or systematic monitoring and with high-risk AI, almost always. For those same applications the AI Act requires a fundamental rights assessment (FRIA) under Article 27. Do not run them separately but as one combined process: they overlap heavily and together produce a single well-founded file.

When is a DPIA mandatory?

Article 35 GDPR requires a DPIA for processing "likely to result in a high risk". In HR that arises quickly, in particular for:

• Systematic and extensive evaluation of personal aspects, including profiling, on which decisions are based.
• Large-scale processing of special categories of data.
• Systematic monitoring of employees.

An AI system that scores performance, predicts behaviour or controls access almost always meets at least one of these criteria.

What must it contain?

The DPIA contains at least: a systematic description of the processing and its purposes; an assessment of necessity and proportionality; an assessment of the risks to the rights and freedoms of data subjects; and the measures envisaged to address those risks. If a high residual risk remains, prior consultation of the supervisory authority follows (Art. 36).

The interplay with the FRIA

For high-risk AI, Article 27 of the AI Act requires certain deployers — including public bodies and providers of essential services — to carry out a fundamental rights impact assessment (FRIA) before putting the system into use. It looks wider than data protection alone: at non-discrimination, human dignity and other fundamental rights. The AI Act expressly states that where a DPIA has already been done, the FRIA builds on it. Read the content of the assessment in the FRIA: fundamental rights assessment under Article 27.

One combined process

Because the DPIA and FRIA describe the same application, the same risks and largely the same measures, it is inefficient and confusing to produce two separate documents. Run one assessment that covers both legal requirements: the GDPR layer (data protection) and the AI Act layer (fundamental rights more broadly). Align this with the other high-risk obligations so the assessment fits the wider compliance picture.

Practical step plan

1. Determine the need: is this large-scale/systematic monitoring or high-risk AI? If so, a DPIA is mandatory and possibly a FRIA too.
2. Describe the processing: data, purposes, AI logic, data subjects, retention periods.
3. Test necessity and proportionality: is there a less intrusive alternative?
4. Assess the risks to privacy and to broader fundamental rights (discrimination, autonomy).
5. Set measures: human oversight, bias checks, transparency, data minimisation.
6. Secure the GDPR basis and transparency towards employees; see GDPR and employee data in AI.
7. Consult the supervisory authority where a residual high risk remains, and repeat the assessment on changes.

One well-combined DPIA/FRIA process is not a paper duty but the place where you get the real risks of HR AI on the table — before the system goes into production.