What Is a DPIA? When Irish GP Practices and Small Businesses Need One Before Adopting AI

DPIA stands for Data Protection Impact Assessment. Ireland's Data Protection Commission describes it as "a process designed to identify risks arising out of the processing of personal data" on its DPIA guidance page. In practice it is a document written before a new system goes live, answering one question: what could this do to the people whose data goes in?

Tuesday, 8.15am, a four-doctor practice in Mullingar. One of the partners is back from a conference with a free trial of an AI scribe. It listens to the consultation through the laptop, then writes the note into the record before the patient has their coat on. She used it on six patients yesterday and finished on time for the first time since March. The practice manager has one question, asked in the tone of someone who has met the Data Protection Commission before: "Did anyone do a DPIA?" Nobody had. Two people asked what it stood for.

The legal duty, in one sentence

Article 35(1) GDPR says that where processing, "in particular using new technologies", is "likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment". Three words in that sentence do most of the work. "Controller" means the practice, not the AI vendor; I explained that split in What is a data processor under GDPR? "Prior" means before the first patient is recorded. And "new technologies" is the regulation more or less pointing at the scribe on the desk.

The DPIA replaced something older. Before 2018, businesses notified the regulator about their processing in general. Recital 89 calls those "indiscriminate general notification obligations" and abolishes them in favour of a sharper duty: assess the processing that is actually risky, keep the assessment, and produce it when asked.

What must a DPIA contain?

Article 35(7) lists four things a DPIA "shall contain at least". The DPC publishes a free sample DPIA template (November 2024) built around them.

Items (b) and (c) are where DPIAs fail. On 12 June 2025 the DPC fined the Department of Social Protection €550,000 over its facial-matching system, and the findings include an infringement of "Articles 35(7)(b) and (c) GDPR by failing to include certain details in the Data Protection Impact Assessment". The department had done a DPIA. It was not complete enough. (The department has appealed the decision.)

DPIA, PIA and FRIA: three acronyms, one family

A PIA (privacy impact assessment) is the older, broader term; under GDPR the formal version is the DPIA. A FRIA (fundamental rights impact assessment) comes from the EU AI Act, and Article 27(4) says it "shall complement" the DPIA rather than replace it. It applies to certain deployers of high-risk AI, such as public bodies. For most small Irish practices, the DPIA is the one that matters today.

A DPIA is required when processing is likely to result in a high risk to people. GDPR names three automatic cases, the DPC adds an Irish list of ten, and European guidelines give nine criteria: meet two and you almost certainly need one. A small practice's routine patient records usually do not qualify. Adding an AI tool often changes that.

The three cases GDPR spells out

Article 35(3) makes a DPIA mandatory for systematic and extensive profiling with legal or similarly significant effects, for "processing on a large scale of special categories of data", which includes health data, and for "systematic monitoring of a publicly accessible area on a large scale". A hospital is plainly in the second case. A four-doctor practice in Mullingar is less obviously so, and that is where the detail matters.

The DPC's own Irish list of processing that needs a DPIA adds ten more types, from large-scale profiling to processing genetic or biometric data alongside other risk factors. It also asks you to record your reasoning either way: your records "should include relevant risk information including reasons why a DPIA needs to be carried out, or not."

The nine criteria, and the two-criteria rule of thumb

The test most regulators use comes from the Article 29 Working Party's DPIA guidelines (WP248 rev.01), endorsed by the European Data Protection Board. They list nine criteria and say that "in most cases, a data controller can consider that a processing meeting two criteria would require a DPIA to be carried out". Here is the same practice scored twice.

Strictly, the left column already meets two criteria. But the guidelines then carve routine clinical records out, which is the next question.

When is a DPIA not required?

Recital 91 says processing "should not be considered to be on a large scale if the processing concerns personal data from patients or clients by an individual physician, other health care professional or lawyer. In such cases, a data protection impact assessment should not be mandatory." The WP248 guidelines use that exact example as a "DPIA likely required: No". Beyond that, you can skip one when the processing is not likely to be high risk, when it is very similar to processing you have already assessed, or when a specific law already covered it.

So the honest answer for a small GP practice keeping ordinary records is that a DPIA is good practice rather than a legal must. The partner's scribe changes the answer. It adds criterion 8, innovative technology, on top of health data and vulnerable patients, which puts the processing past the two-criteria line on its own terms. The DPC's list names "uses of new or novel technologies" first among its high-risk factors, and closes the argument with one line: "Where there is a doubt, conducting a DPIA is advised."

The AI-specific risks the DPIA has to cover

A generic template will not prompt these, so write them in by hand:

• Accuracy. A scribe that writes "no known allergies" when the patient said the opposite has altered a medical record. The DPIA should say who checks every note, and when.
• The recording itself. Consultation audio is health data, and often other people's too: the parent in the room, the interpreter on speaker.
• Vendor reuse. Does the provider keep audio or transcripts, and does it use them to train or improve its models? If it decides that for its own purposes, it is no longer simply your processor.
• Where the data goes. Sub-processors and transfers outside the EU each need their own entry and their own legal basis.
• Retention. Under your policy, or the vendor's terms of service?

These are not hypothetical worries. Dr Conor O'Shea, national coordinator of the GPIT group, told the Medical Independent in May 2025 that "there aren't any local Irish regulations for companies supplying digital scribes", and that GPs must "verify the output". Adoption is moving anyway. An EY and RCPI survey of 516 Irish physicians, published in April 2026, found 58% had used AI in clinical practice in the past year. It also found 65% believe AI increases the risk of data breaches. The DPIA is where a practice turns that worry into a decision on paper. I set out where health data sits among the special categories in What is personal data?

Most of the risk section in an AI DPIA is about the journey the data takes: out of the building, to a vendor, through its sub-processors, possibly out of the EU, into someone else's retention schedule. Move the model and most of that section has nothing left to describe. That is the whole design idea behind our Local AI service.

Local AI is a dedicated machine installed at your premises, running open-weight models, with private chat, document search and custom assistants on it. The model reading a consultation transcript sits in the practice's own back office, behind the practice's own sign-in. Nothing is sent to us or to anyone else to produce the answer.

The same DPIA risk register, two architectures

Read the bottom three rows carefully, because this is where I will not oversell it. Local AI does not abolish the DPIA. The machine still needs securing, every note still needs a clinician's eye, patients still need to be told, and someone still decides how long transcripts are kept. What it removes is the part of the assessment you could never fully control anyway: the vendor's servers, the vendor's sub-processors and the vendor's change of terms next spring.

What it looks like in a GP practice

• Private chat for drafting referral letters, summarising a long hospital discharge and rewording a results letter in plain English.
• Document spaces for the practice's protocols, HSE circulars and your own policies, searchable with citations back to the page.
• Custom assistants for jobs that repeat: the repeat-prescription query, the insurance report template, the new-patient registration checklist.
• Your existing access control, so who can see which patient's data stays a decision the practice already made.

We launched the service in September, so I will not claim a year of clinic results. What I can be precise about is the shape of the paperwork: with the model in your back office, section (a) of the DPIA gets shorter, and section (c) loses its longest rows. AgentHub acts as a processor only for any support access you choose to grant, under an agreement scoped to exactly that.

And where the cloud is the better tool, we say so. Answering the 8am phone queue is a job for our cloud AI Receptionist, which books appointments without reading a single consultation note. Local AI earns its place on the data that should never have needed a vendor in the first place.

What does DPIA stand for?

DPIA stands for Data Protection Impact Assessment. It is the written risk assessment GDPR Article 35 requires before processing personal data in a way that is likely to result in a high risk to people, such as using new technology on health data.

When is a DPIA required?

When processing is likely to result in a high risk to people's rights and freedoms. That includes the three cases in Article 35(3), the ten types on the DPC's Irish list, and, as a rule of thumb, any processing that meets two of the nine EDPB criteria, such as health data combined with new technology.

When is a DPIA not required?

When the processing is not likely to be high risk, is very similar to processing you have already assessed, or was covered when a specific law was made. Recital 91 says an individual doctor's or lawyer's routine client records are not large scale, so a DPIA should not be mandatory for those alone.

Who is responsible for carrying out a DPIA?

The controller: the business or practice that decides why and how the data is processed. If you have a data protection officer, you must seek their advice, and a processor such as an AI vendor must help with information. The responsibility does not pass to the vendor.

Do you have to send your DPIA to the Data Protection Commission?

No. You keep it and produce it if asked. You consult the DPC beforehand only if the DPIA shows a high risk you cannot reduce. The DPC then has up to eight weeks to advise, which it can extend by six weeks for complex processing.

What happens if you don't do a DPIA?

Failing to carry out a required DPIA, or carrying out an inadequate one, can bring a fine of up to €10 million or 2% of worldwide annual turnover under Article 83(4). In 2025 the findings behind the DPC's €550,000 fine on the Department of Social Protection included gaps in its DPIA.

Does a GP practice need a DPIA for an AI scribe?

In most cases, yes. Routine records for a small practice may not need one, but an AI scribe adds new technology to health data about patients, which meets three of the nine EDPB criteria. The DPC advises doing a DPIA wherever there is doubt, and it must be finished before the first recording.

How to do one before the trial goes any further

1. Screen it and write the answer down. Score the tool against the nine criteria and record your reasoning, whether or not you go on to a full DPIA.
2. Use the DPC's template rather than inventing one; it follows the four parts of Article 35(7).
3. Get answers from the vendor in writing: where audio and transcripts are stored, for how long, who else processes them, and whether they are used for training.
4. Seek advice and views. Ask your data protection officer if you have one, and consider the views of patients where appropriate, as Article 35(9) suggests.
5. Sign it off before go-live, then review it whenever the tool, the vendor's terms or the risk changes, as Article 35(11) requires.

None of this is legal advice, and on a real deployment a solicitor or your data protection officer should make the final call. If the screening leaves a high risk you cannot reduce, that is the point to talk to the DPC under Article 36, before the go-live date, not after it.

Back in Mullingar, the partner paused the trial for a fortnight while the practice manager filled in the template. Most of the time went on section (c), working out where the recordings went. Whichever tool the practice settles on, the next six patients will be recorded under a document that says what happens to their words, which is a better place to start than yesterday's six.

If you would like to see how short that section can get with the model in your own building, book a Local AI consultation; I read every enquiry myself. Or open the chat on this page and ask it what it does with what you type. It is a cloud agent, and it will tell you.