Skip to content

Knowledge base · AI in HR

Do we have to carry out a DPIA before we use AI in recruitment or personnel management?

A DPIA is mandatory when the processing is likely to result in a high risk. That is the case, among other things, for systematic and extensive automated evaluation of persons, or for large-scale processing or systematic monitoring of employees as described in the Dutch Data Protection Authority's list. Carry out the DPIA before the processing.

In force now (since 25 May 2018)Trusq editorial · checked against the official textLast verified:

Next step: Map your AI tool

The main rule

If a processing operation, especially one using new technologies, is likely to result in a high risk, the controller carries out a DPIA before the processing [1]. It is required in any case for a systematic and extensive evaluation of personal aspects on which decisions are based that produce legal effects or similarly significantly affect the person [2].

The Dutch Data Protection Authority's list

The supervisory authority draws up a public list of processing operations for which a DPIA is mandatory [3]; the Dutch Data Protection Authority did so on the basis of that provision [4]. The list includes, among others, large-scale processing or systematic monitoring of employees' activities [5] and profiling: a systematic and extensive evaluation of personal aspects based on automated processing, such as assessment of performance at work [6]. The list is not exhaustive [7].

What it contains

A DPIA contains at least a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks and the measures to address them [8].

Link with the AI Act

From 2 December 2027, for a high-risk system you use the information the provider supplies in the instructions for use for the DPIA [9] [10]. If you also have to carry out a fundamental rights impact assessment, you may refer to the DPIA or include parts of it [11]; a private employer that provides no public service and uses only HR AI does not have to carry out that assessment [12].

What Trusq bases this on

These released rules are in Trusq and are read again with every publication; if a rule changes, this page changes with it.

  • DPIA for high risk
  • DPIA using the provider's information AI Act 13, AI Act 26
  • Fundamental-rights impact assessment AI Act 27

Sources

  1. [1] GDPR Art. 35(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). For processing that is likely to result in a high risk, especially with new technologies, the controller carries out a DPIA before the processing.
    Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
    Source, retrieved on 2 October 2026.
  2. [2] GDPR Art. 35(3)(a) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). A DPIA is required in any case for a systematic and extensive evaluation of personal aspects on which decisions are based that produce legal effects or similarly significantly affect the person.
    a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;
    Source, retrieved on 2 October 2026.
  3. [3] GDPR Art. 35(4) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). The supervisory authority draws up a public list of processing operations for which a DPIA is mandatory.
    The supervisory authority shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
    Source, retrieved on 2 October 2026.
  4. [4] AP DPIA list (Stcrt. 2019, 64418), preamble (Decision on the list of processing operations for which a DPIA is mandatory (Stcrt. 2019, 64418); Dutch law, unofficial translation). The Dutch Data Protection Authority established the list on the basis of Article 35(4) GDPR. Original Dutch text:
    gelet op artikel 35, vierde lid, in samenhang bezien met artikel 57, eerste lid, onder k, van de Algemene verordening gegevensbescherming;
    Source, retrieved on 2 October 2026.
  5. [5] AP DPIA list (Stcrt. 2019, 64418), list, point 11 (Monitoring of employees) (Decision on the list of processing operations for which a DPIA is mandatory (Stcrt. 2019, 64418); Dutch law, unofficial translation). Large-scale processing or systematic monitoring of employees' activities is on the list of mandatory DPIAs. Original Dutch text:
    11. Controle werknemers Grootschalige verwerking van persoonsgegevens en-of stelselmatig monitoring van activiteiten van werknemers (bijvoorbeeld controle van e-mail en internetgebruik, GPS-systemen in (vracht)auto’s van werknemers of cameratoezicht ten behoeve van diefstal- en fraudebestrijding).
    Source, retrieved on 2 October 2026.
  6. [6] AP DPIA list (Stcrt. 2019, 64418), list, point 15 (Profiling) (Decision on the list of processing operations for which a DPIA is mandatory (Stcrt. 2019, 64418); Dutch law, unofficial translation). Systematic and extensive automated evaluation of personal aspects (profiling), such as assessment of performance at work, is on the list of mandatory DPIAs. Original Dutch text:
    15. Profilering Systematische en uitgebreide beoordeling van persoonlijke aspecten van natuurlijke personen gebaseerd op geautomatiseerde verwerking (profilering), zoals bijvoorbeeld beoordeling van beroepsprestaties, prestaties van leerlingen, economische situatie, gezondheid, persoonlijke voorkeuren of interesses, betrouwbaarheid of gedrag.
    Source, retrieved on 2 October 2026.
  7. [7] AP DPIA list (Stcrt. 2019, 64418), considerations (Decision on the list of processing operations for which a DPIA is mandatory (Stcrt. 2019, 64418); Dutch law, unofficial translation). The list is not exhaustive: a processing operation that is not on it may also require a DPIA. Original Dutch text:
    dat de lijst niet uitputtend is en dat het kan zijn dat een verwerking van persoonsgegevens niet op de lijst staat, maar gelet op de aard, de omvang, de context en de doeleinden een hoog risico inhoudt voor de rechten en vrijheden van natuurlijke personen en aldus een gegevensbeschermingseffectbeoordeling (DPIA) moet worden gedaan;
    Source, retrieved on 2 October 2026.
  8. [8] GDPR Art. 35(7) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). A DPIA contains at least a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks and the measures to address them.
    The assessment shall contain at least: (a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller; (b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes; (c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and (d) the measures envisaged to address the risks,
    Source, retrieved on 2 October 2026.
  9. [9] AI Act Art. 26(9) (AI Act, Regulation (EU) 2024/1689). Where a DPIA is needed, the deployer uses for it the information the provider supplies under Article 13.
    Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of this Regulation to comply with their obligation to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680.
    Source, retrieved on 2 October 2026.
  10. [10] Regulation (EU) 2026/1744 Art. 1(40)(b) (replaces AI Act Art. 113, third paragraph, point (c)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). The high-risk rules (Chapter III, Sections 1 to 3) apply to Annex III systems from 2 December 2027.
    Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and
    Source, retrieved on 2 October 2026.
  11. [11] Regulation (EU) 2026/1744 Art. 1(13)(a) (replaces AI Act Art. 27(4)) (Regulation (EU) 2026/1744 (Digital Omnibus on AI)). Anyone who has to carry out a FRIA may refer to the relevant parts of the DPIA or include them.
    If any of the obligations laid down in this Article is already met through the data protection impact assessment conducted pursuant to Article 35 of Regulation (EU) 2016/679 or Article 27 of Directive (EU) 2016/680, the deployer may, when conducting the fundamental rights impact assessment referred to in paragraph 1 of this Article, include cross-references to the relevant sections of that data protection impact assessment or include relevant parts thereof in the fundamental rights impact assessment.
    Source, retrieved on 2 October 2026.
  12. [12] AI Act Art. 27(1), introductory wording (AI Act, Regulation (EU) 2024/1689). A fundamental rights impact assessment (FRIA) is required for deployers that are bodies governed by public law or private entities providing public services, and for deployers of the systems in Annex III, point 5(b) and (c); systems in Annex III, point 2, are excluded.
    Prior to deploying a high-risk AI system referred to in Article 6(2), with the exception of high-risk AI systems intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III, shall perform an assessment of the impact on fundamental rights that the use of such system may produce.
    Source, retrieved on 2 October 2026.

Related questions

As a private employer, do we have to carry out a fundamental rights impact assessment (FRIA) for our HR AI?May we use AI to track employees' productivity or behaviour?May software automatically reject applicants without a person looking at it?What do we agree with the supplier of an AI tool for HR?

Next step

Describe one AI tool, for example your recruitment or planning software, in four questions. You see at once which rules may apply, with the source, before you enter any data.

Map your AI tool

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.