GDPR
A data protection impact assessment (DPIA) is required under GDPR Article 35 where processing is likely to result in a high risk to people. Many AI uses qualify: systematic profiling with significant effects, large-scale special-category data, or large-scale monitoring. The AI Act links to it: deployers of high-risk systems use the provider's Article 13 information for their DPIA. Use the checklist below, and copy it into your own record.
Under GDPR Article 35 a DPIA is required before processing that is likely to result in a high risk to the rights and freedoms of natural persons. The Regulation names three cases in particular.
Many AI deployments touch at least one: automated screening of applicants, scoring customers, monitoring employees, or an agent with broad access to personal data. Supervisory authorities also publish national lists of processing that needs a DPIA, so check your own. If you decide a DPIA is not required, write down why. Where a DPIA shows high residual risk you cannot mitigate, Article 36 requires prior consultation with the supervisory authority.
One DPIA can serve both purposes if it is written once, structured around the Article 35(7) elements, and has an AI-specific annex that covers the items below.
Copy this into your own document. It is a structure, not a finished assessment or legal advice.
0 of 29 ticked
Ticks stay in your browser and are not sent to Swfte. This is a structure to complete, not legal advice.
Each row maps a requirement to a platform control, the evidence artifact it produces, and the Trust & Governance Fabric facets involved. Swfte provides the controls and the evidence. You remain responsible for the decisions.
| Requirement | Platform control | Evidence artifact | Fabric facets |
|---|---|---|---|
| Describe the processing and data flows (Art. 35(7)(a)) | Trust Profile: owner, approved models, data classification, data residency, permitted systems, allowed and restricted actions. | Trust Profile export to attach to the DPIA. | Identity, Data controls, Compliance |
| Show necessity and minimisation (Art. 35(7)(b)) | Data controls and masking on what an agent can read and write. | Classification map and masking policy decisions. | Data controls, Privacy, Policy |
| Show risk measures in operation (Art. 35(7)(d)) | Policy verbs Allow, Deny, Warn, Filter, Escalate and Require human approval, enforced at runtime. | Decision log by policy. | Policy, Human oversight, Security |
| Review the DPIA when something changes | Monitoring of model, data-source and policy changes with a change history. | Change history and monitoring records. | Monitoring, Traceability, Evidence |
Compliance-by-design. Swfte provides the technical controls, governance mechanisms and evidence to support deployment within applicable requirements. The exact posture depends on your use case, jurisdiction, deployment and configuration. This is not legal advice.
Hosting today: customer data is stored in AWS eu-west-1 (Ireland), as stated on the trust page. EU region, in-country, dedicated and on-prem options are the platform position: what it is designed to let you do, scoped with you through a dedicated deployment engagement, not self-serve.
Not always. A DPIA is required where processing is likely to result in a high risk. A chatbot that handles special-category data at scale, profiles people, or supports significant decisions often will need one. Record your reasoning either way.
A description of the processing and purposes, an assessment of necessity and proportionality, an assessment of risks to data subjects, and the measures to address those risks (Article 35(7)).
Under Article 26(9), deployers of high-risk systems use the provider's Article 13 information for their DPIA. Under Article 27, a fundamental rights impact assessment complements the DPIA where it applies.
The checklist above is built into the page, and a copy button saves it as a text file. It is a structure to complete, not legal advice.
The controller. Seek the advice of your data protection officer, record residual risk, and consult the supervisory authority under Article 36 if high residual risk remains.
Last verified 2026-10-06. Primary sources are EUR-Lex and European Commission pages. Items marked as secondary are commentary or trackers; check the primary text before relying on them.
The controls on this page are part of the Trust & Governance Fabric that runs through every layer of the Sovereign Intelligence Platform.
Governance that runs inside AI, not beside it.
Seven kinds of control over your AI estate.
The record of what each AI system is and may do.
What Swfte can show today, and what it does not claim.
Start with one entry point. Add governance, in-region options and evidence as your requirements grow.
One platform for the agents, models and workflows your team ships. Free to start, no card required.