Impact assessment · Art. 22 FADP · legal version {version}

Data protection impact assessment

An impact assessment is mandatory where the intended processing is “likely to entail a high risk to the personality or fundamental rights of the data subject”. This tool determines whether that is your case, then walks you through writing the document in the exact structure Art. 22 para. 3 imposes. Everything stays in your browser.

This is not a FRIA. The fundamental rights impact assessment of Art. 27 of the AI Act covers only bodies governed by public law, private entities providing public services, and deployers of credit scoring or life and health insurance pricing. An ordinary private SME is not subject to it; if you are, the classifier tells you: check your use case.

1. Does your processing entail a high risk?

Art. 22 para. 2 sets four open criteria — nature, scope, circumstances and purpose — then names two cases where the risk “exists in particular”. Those two settle the matter on their own; the others merely suggest it.

Processing of sensitive personal data on a large scaleStatutory presumptionHealth, religious or political views, trade union membership, intimate sphere, origin, genetic or biometric data, criminal proceedings, social assistance.FADP art. 22 al. 2 let. a · FADP art. 5 let. cSystematic surveillance of large parts of the public domainStatutory presumptionCameras, sensors or image analysis covering a publicly accessible space, continuously.FADP art. 22 al. 2 let. bHigh-risk profilingAutomated evaluation of personal aspects — work performance, economic situation, health, preferences, behaviour — whose outcome may significantly affect the person.FADP art. 5 let. g · FADP art. 6 al. 7 let. bAutomated individual decisionA decision taken exclusively on an automated basis, producing legal effects for the person or significantly affecting them.FADP art. 21Use of a new technologyThe text names this case expressly: a generative AI model introduced into a process that had none falls within it.FADP art. 22 al. 2Combining several data sourcesBringing together files that did not previously speak to each other, producing a picture of the person that no single source gave.FADP art. 22 al. 2People in a position of dependence or vulnerabilityEmployees, applicants, patients, children, benefit recipients: the imbalance of the relationship weighs on the assessment of risk.FADP art. 22 al. 2

2. Are you exempt?

Two releases exist, and they are rarely known. They do not reduce the risk: they release you from the duty to assess.

The processing is required by a legal obligationThe private controller is released from the assessment where it is required by law to carry out the processing.FADP art. 22 al. 4The system, product or service is certified for the intended useCertification by an accredited and independent body. The release covers only the use covered by the certification.FADP art. 22 al. 5 · FADP art. 13You comply with a code of conduct submitted to the FDPICThe code must rest on an impact assessment, provide protective measures, and have been submitted to the FDPIC. The three conditions are cumulative.FADP art. 22 al. 5 · FADP art. 11

Verdict

Nothing indicates a high risk

No factor was retained on the basis of your answers. This is not a clearance: the judgement remains yours, and it must be made again as soon as the purpose, scope or circumstances of the processing change.

Structure imposed by Art. 22 para. 3 FADP. Legal version 2026-08-27. Informational markers, not legal advice.