Question 1

What is the main difference in focus between DPIA and FRIA?

Accepted Answer

DPIA (Data Protection Impact Assessment) concentrates on privacy and data protection according to GDPR. FRIA (Fundamental Rights Impact Assessment) looks at the full spectrum of fundamental rights such as non-discrimination, human dignity, freedom of expression, etc.

Question 2

When is a DPIA mandatory?

Accepted Answer

DPIA is mandatory under GDPR Article 35 when processing is likely to result in a high risk to rights and freedoms. This particularly applies to systematic evaluation of personal aspects, large-scale processing of special category data, or large-scale monitoring of publicly accessible areas.

Question 3

Who must conduct a FRIA according to the EU AI Act?

Accepted Answer

Article 27 of the EU AI Act requires users (deployers) of high-risk AI systems to conduct a FRIA, not the developers. This is because the deployer knows the context and concrete application best.

Question 4

Which organizations MUST conduct a FRIA?

Accepted Answer

FRIA is mandatory for: (1) public bodies and entities providing services of public interest, and (2) any organization (public or private) using high-risk AI for creditworthiness assessments or risk assessment in insurance.

Question 5

What is an important EXCEPTION to the FRIA obligation?

Accepted Answer

AI systems used as safety components for the management and operation of critical infrastructure (such as digital infrastructure, transport, utilities like water, gas, electricity) are exempt from FRIA obligations. Also, AI for fraud detection only is exempt.

Question 6

What is the main OVERLAP between DPIA and FRIA?

Accepted Answer

Both assessments evaluate risks to fundamental rights. Privacy is a fundamental right that is central to both assessments. Technical safeguards, transparency, and human oversight are also relevant overlapping elements.

Question 7

When must you conduct BOTH assessments (DPIA + FRIA)?

Accepted Answer

You must conduct both when your AI system is both high-risk according to the EU AI Act (FRIA obligation) and processes personal data under high-risk circumstances according to GDPR (DPIA obligation). Good news: there's much overlap and you can work efficiently.

Question 8

What is a practical difference in executing DPIA vs FRIA?

Accepted Answer

An important difference: with DPIA you primarily consult your Data Protection Officer (DPO) and possibly the DPA. With FRIA you must do broader stakeholder consultation (users, experts, civil society organizations) - unless you're exempt as an SME from this consultation requirement.

DPIA vs FRIA Quiz