DPIA for HR Recruiting AI: 7-Step Template (2026)

Main article: DPIA Art. 35 GDPR (glossary) — the definition of the data protection impact assessment.

When AI recruiting triggers a DPIA

A DPIA must be carried out in advance where processing — in particular using new technologies — is likely to result in a high risk to the rights and freedoms of natural persons, taking into account its nature, scope, context and purposes (Art. 35(1) GDPR). Art. 35(3) GDPR expressly names as standard cases the systematic and extensive evaluation of personal aspects (profiling) producing legal effects, as well as processing on a large scale of special categories of data under Art. 9 GDPR. That is precisely what scoring and ranking applications amount to.

The EU AI Act (Regulation (EU) 2024/1689) applies in parallel. An AI system is defined there as a machine-based system designed to operate with varying levels of autonomy and that infers, from the input it receives, how to generate outputs such as predictions, recommendations or decisions (Art. 3 no. 1 AI Act). The systems listed in Annex III no. 4 in the area of employment, workforce management and access to self-employment are classified as high-risk under Art. 6(2) AI Act. The derogation in Art. 6(3) AI Act — no significant risk to health, safety or fundamental rights — is excluded where the system performs profiling of natural persons.

On timing: the AI Act has applied generally since 2 August 2026, Chapter V (GPAI models) already since 2 August 2025. The high-risk obligations in Chapter III, Sections 1 to 3, apply to Annex III systems — including HR AI under Annex III no. 4 — from 2 December 2027, and to the product route via Annex I from 2 August 2028 (Art. 113 AI Act as applicable since 27 July 2026 in the version of Regulation (EU) 2026/1744). Separate from this is the fundamental rights impact assessment (FRIA) under Art. 27(1) AI Act: it applies to public bodies, private deployers of public services and deployers under Annex III no. 5(b)/(c) — not to private employers using HR AI under Annex III no. 4. The 7-step structure below is a practice template for carrying out the assessment; the obligations themselves follow from the provisions cited, not from the numbering.

1. Description of the processing

Step 1 records which system processes which data for which purpose — without this description no risk assessment can be verified. Document: the AI tool, the model type (GPAI / not), the input data (CV fields), the output (score, ranking) and the purpose of use (pre-selection, final selection).

The model type determines where your documentation comes from. A general-purpose AI model (GPAI) is a model that displays significant generality, is capable of competently performing a wide range of tasks and can be integrated into a variety of downstream systems (Art. 3 no. 63 AI Act). Providers of such models must draw up technical documentation and make information available to the providers that integrate the model (Art. 53(1)(a) and (b) AI Act, at minimum in accordance with Annex XI and Annex XII respectively). This documentation sits with the provider that integrates the model into your HR tool; what reaches you must be settled contractually and recorded in the DPIA.

Second axis: the roles. Which role you take on must be determined for the specific constellation on the basis of Art. 4 no. 7, Art. 4 no. 8 and Art. 26 GDPR and reasoned in the DPIA. Where processing is carried out on your behalf, you may only work with Data Processors that provide sufficient guarantees, and you need a contract setting out the subject matter, duration, nature and purpose of the processing, the types of data, the categories of data subjects as well as obligations and rights (Art. 28(1) and (3) GDPR). Applicant management is moreover a processing activity of its own in the record of processing activities under Art. 30 GDPR; in supervisory enquiries, the review in practice often follows this order: record of processing activities, processor agreement, technical and organisational measures concept, DPIA (practitioner assessment, not a statutory requirement).

2. Necessity + proportionality

Step 2 explains why the objective cannot be achieved without the AI system, or only far less effectively — and records the alternative that was examined. Key points: examine an alternative without AI. Data Minimisation: only relevant fields. Purpose Limitation: only for the defined use case.

Upstream of this comes the legal basis: processing is lawful only if at least one of the six conditions in Art. 6(1) GDPR is met (consent, contract or pre-contractual steps, legal obligation, vital interests, public interest, legitimate interests). In Germany, § 26 BDSG (German Federal Data Protection Act) is the relevant provision for employee data; the Austrian DSG has no separate employee data protection section — what governs there are Art. 6 and Art. 88 GDPR. Anyone relying on consent must be able to demonstrate it; it can be withdrawn at any time and withdrawal must be as easy as giving consent (Art. 7(1) and (3) GDPR).

The question 'does the tool have to rank, or is a completeness check enough?' also determines the catalogue of AI-law obligations (see the exclusion from the derogation above). Practice recommendation: set retention periods in the same step — six months for applicant data is customary; the reference points are the two-month period in § 15(4) AGG in Germany and the six-month court deadline in § 15 and § 29 GlBG in Austria.

3. Risk identification

Step 3 collects the risks from the applicants' perspective, not the company's. Applicant risks: discrimination (reversal of the burden of proof under § 22 AGG), profiling (Art. 22 GDPR), opaque automated decisions, incorrect classification.

The legally decisive mechanism is indirect discrimination (mittelbare Benachteiligung): it exists where apparently neutral provisions, criteria or practices are capable of putting persons at a particular disadvantage, unless they are objectively justified (§ 3(2) AGG). This is exactly the pattern a model can produce when it optimises on a correlated feature instead of the protected characteristic itself — the justification test then belongs in the DPIA. The grounds are listed in § 1 of the German General Equal Treatment Act (AGG): race or ethnic origin, gender, religion or belief, disability, age, sexual identity. Employees must not be discriminated against on these grounds; this also applies where the ground is merely assumed, and deviating agreements are void (§ 7(1) and (2) AGG).

The consequences belong in the risk assessment: in the event of an infringement the employer is liable for the damage, provided it is responsible for the breach of duty, and owes monetary compensation for non-material damage (§ 15(1) and (2) AGG; in Austria § 12 and § 26 GlBG) — the caps and minimum amounts differ, see the DE/AT table below. On the data protection side, infringements of the data subject rights in Art. 12 to 22 GDPR fall within the higher fining range of Art. 83(5) GDPR.

4. Bias testing

Step 4 measures whether the system treats applicant groups differently — per characteristic, with a documented method and a documented result. Statistical tests per AGG characteristic (age, gender, ethnicity). What is compared per characteristic are the selection rates of the groups, that is the share of applications recommended for the next stage among all applications from a group; a deviation is notable where it can no longer be explained by chance given the sample size — the sample must therefore be large enough per characteristic to remain statistically meaningful. Working with a significance level of 5 % sets a convention for your own statistical analysis — it is not an evidentiary threshold laid down by the Federal Labour Court (BAG) or by statute: § 22 AGG requires indicia that give reason to presume discrimination on a ground named in § 1 AGG — the other party then bears the burden of proof. Practice recommendation: record for each test the characteristic, the data basis and sample size, the analysis method, the result and the measure derived from it — that is the evidence that Accountability under Art. 5(2) GDPR requires.

What is being looked for is indirect discrimination (§ 3(2) AGG): the group particularly affected by a neutrally worded criterion. In Austria the characteristics to be tested are spread over two provisions — § 3 GlBG covers gender, § 17 GlBG covers ethnic affiliation, religion or belief, age and sexual orientation.

The practical hurdle is one of data protection law: data revealing racial and ethnic origin or religious or philosophical beliefs are special categories; their processing is prohibited under Art. 9(1) GDPR, with exceptions only under Art. 9(2) GDPR (for instance explicit consent). A test based on these characteristics cannot be founded on individual applicant data without a sound exception — this limit belongs expressly in the DPIA. Documenting the test design, data basis and result also serves Accountability under Art. 5(2) GDPR.

5. Safeguards

Step 5 lists the measures that reduce the identified risk — each with its expected effect and evidence. Base set: anonymised first-stage selection, human final decision (Art. 22(3)), transparency in the application process, right to object. The following can additionally be substantiated:

• Exclude prohibited functions: emotion recognition in the workplace and in education institutions, as well as biometric categorisation to infer sensitive characteristics, are prohibited under Art. 5(1)(f) and (g) AI Act.
• Interaction notice: providers must ensure that systems intended to interact directly with natural persons inform them that they are interacting with an AI system (Art. 50(1) AI Act) — check this for chat or dialogue-based pre-selection in the application process and document in the DPIA who delivers the notice (careers page, chatbot interface, invitation email).
• Training: the employer must take the necessary measures, including preventive ones, to protect against discrimination; appropriate training of employees counts as fulfilment of this duty (§ 12(1) to (3) AGG).
• Complaints channel: employees may complain to the competent body, the complaint must be examined and the result communicated (§ 13(1) AGG); the Act and the competent body must be made known within the establishment (§ 12(5) AGG). Anyone asserting rights or giving evidence as a witness must not be disadvantaged for doing so (§ 16(1) AGG; in Austria § 13 and § 27 GlBG).
• Access request process: requests under Art. 15 to 22 GDPR must be answered without undue delay and at the latest within one month; the period may be extended by two months where matters are complex, which must be notified within the first month (Art. 12(3) GDPR).

6. Consultation of the supervisory authority

Step 6 applies only where a high residual risk remains after all measures; the competent supervisory authority must then be consulted prior to the start of processing (Art. 36 GDPR). Processing time: 8 weeks, extendable to 14 weeks; experience suggests 12 to 20 weeks for the overall procedure in Germany — plan the go-live accordingly.

Which authority is competent depends on the type of body. In Germany the authorities competent under Land law supervise non-public bodies (§ 40(1) BDSG) — private employers therefore turn to their Land data protection authority. The Federal Commissioner for Data Protection (BfDI) is competent for federal public bodies and for certain providers of telecommunications services (§ 9(1) BDSG). In Austria it is throughout the Austrian Data Protection Authority (Datenschutzbehörde), established under § 18(1) DSG as the national supervisory authority pursuant to Art. 51 GDPR.

The sanctions range makes clear why this step is not skipped: infringements of the obligations in Art. 25 to 39 GDPR — which include the DPIA and the consultation — are subject to administrative fines of up to EUR 10 million or, in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(4) GDPR).

7. Re-evaluation

Step 7 keeps the DPIA current: where there are substantial changes to the model it is carried out anew, and in between a fixed review rhythm runs. Quarterly bias re-test (practice recommendation). On substantial changes to the model: a new DPIA.

Occasions outside the schedule arise from the contracts and from the supply chain. A change of provider or model affects the processor agreement, which sets out the subject matter, duration, nature and purpose of the processing as well as the types of data (Art. 28(3) GDPR) — it must be reviewed again when the change occurs. If the tool builds on a general-purpose AI model with systemic risk — presumed where the cumulative compute used for training exceeds 10^25 floating point operations (Art. 51(2) AI Act) — its provider must record and document serious incidents and report them without undue delay to the EU AI Office and, where appropriate, to the competent national authorities (Art. 55(1)(c) AI Act). Such reports are an occasion to update your own assessment.

Practice recommendation: tie the re-evaluation date to the review cycle of the record of processing activities — annually plus event-driven is customary there, quarterly for continuously growing companies; Art. 35(1) and (3) GDPR do not name a fixed cycle — the reassessment is triggered by substantial changes. Document every update with a date, otherwise the current status cannot be evidenced when the supervisory authority asks.

Obligations and sources at a glance

The following table names statutory obligations and legal consequences only; the column 'Trigger' reproduces the conditions of the provision named in each case and is not a practice recommendation.

Sanctions ranges: GDPR and the AI Act side by side

Both regulations impose sanctions independently; the caps apply as an alternative to the percentage in each case, with the higher amount being decisive.

Germany and Austria: what differs

The GDPR articles apply identically in both countries; what differs is anti-discrimination law and the national framework on data protection. All entries in the table are statutory rules of the provision named in each case.

Note on Austria: The GDPR articles apply word for word (Art. 35 DPIA, Art. 36 consultation), but supervision and national law differ: the competent body is the Austrian Data Protection Authority (Datenschutzbehörde, DSB) — not the BfDI or a Land data protection authority — and the supplementary national law is the Austrian Data Protection Act (DSG) rather than the BDSG. The prohibition of discrimination, including the standard of proof, follows not the AGG but the Austrian Equal Treatment Act (GlBG): § 3 (gender) and § 17 (the remaining grounds); the person concerned must establish the facts of discrimination to a prima facie standard, after which the burden of proof lies with the defendant (§ 12(12) and § 26(12) GlBG). The points of contact are the Ombud for Equal Treatment (GAW) and the Equal Treatment Commission; case law of the Federal Labour Court (BAG) is not applicable in Austria.