Data Protection Impact Assessment (DPIA)
Required for high-risk processing (Article 35):DPIA Template
# Data Protection Impact Assessment (DPIA)
## 1. Description of Processing Operation
**Processing Activity**: AI Agent Query Processing
**Purpose**: Provide AI-powered responses to user queries
**Data Controller**: [Your Organization]
**Data Processor**: MCP Server with LangGraph
**Personal Data Processed**:
- User queries (may contain personal information)
- User preferences
- Conversation history
- Usage analytics
## 2. Necessity and Proportionality Assessment
**Is processing necessary?** Yes
**Justification**: Required to provide core service functionality
**Is data collection proportionate?** Yes
**Data Minimization**: Only collect query text and minimal session data
## 3. Risk Assessment
| Risk | Likelihood | Impact | Mitigation |
|------|------------|--------|------------|
| Unauthorized access to queries | Low | High | End-to-end encryption, access controls |
| Data breach | Low | High | Encryption at rest, security monitoring |
| Profiling without consent | Medium | Medium | Explicit opt-in required, transparency |
| Third-party data sharing | Low | High | DPAs required, user consent |
## 4. Measures to Address Risks
**Technical Measures:**
- Encryption in transit (TLS 1.3)
- Encryption at rest (AES-256)
- Pseudonymization of user identifiers
- Access controls (OpenFGA)
- Audit logging (7-year retention)
**Organizational Measures:**
- Privacy training for staff
- Data protection policies
- Breach notification procedures
- Regular security audits
## 5. Consultation with DPO
**DPO Consulted**: [Name], [Date]
**DPO Opinion**: Risks adequately mitigated with proposed measures
**DPO Signature**: __________________
## 6. Approval
**Approved By**: [Data Controller]
**Date**: [Date]
**Review Date**: [Annual review]
Next Steps
DPA Template
Review Data Processing Agreement
Privacy by Design
Implement privacy controls
Back to Overview
Return to GDPR overview