What Is a DPIA for AI Training Data?

Legal teams reviewing a footage dataset may ask whether a DPIA is needed, and the answer can hold up approval after the data already fits the task. The assessment sits with the controller, but a vendor’s records feed it. Knowing what Article 35 asks for lets a team request the right documents at spec stage instead of during contract review.

The site does not state that Firsthand has completed a DPIA for any dataset, and it states no DPIA template. What it does state can feed one. The /dpa draft says roles are confirmed in the order form, personal data is processed only to collect, de-identify, quality-check and deliver the datasets, and security measures include access controls, encryption in transit and at rest, and the de-identification pipeline. Faces and license plates are blurred, audio is scrubbed, and clips that cannot be reliably de-identified are discarded. The video anonymization service is stated to ship a data-processing record suitable for a DPIA. The /dpa page is a draft not yet reviewed by counsel.

A data protection impact assessment is the document GDPR Article 35(1) requires where a type of processing, taking into account its nature, scope, context and purposes, is likely to result in a high risk to the rights and freedoms of natural persons. The controller shall carry it out prior to the processing. The text adds that a single assessment may address a set of similar processing operations that present similar high risks. The EDPB’s guide for small organisations describes it as a written assessment of a planned processing operation that helps identify safeguards to mitigate the risks and to demonstrate compliance.

It is a planning tool, not an audit after the fact. Article 35(11) asks the controller to review it when the risk represented by the processing changes. This page is general information, not legal advice; your counsel decides whether a DPIA applies to your use.

Article 35(3) says an assessment shall in particular be required in three cases: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal or similarly significant effects; processing on a large scale of special categories of data under Article 9(1), or of criminal-conviction data under Article 10; and a systematic monitoring of a publicly accessible area on a large scale. Article 35(1) is the general test, and Article 35(4) has each supervisory authority publish a list of processing operations that require an assessment.

The EDPB guide adds that in most cases processing meeting two of nine listed criteria should be assessed through a DPIA. The criteria include systematic monitoring, sensitive data, large-scale processing, matching or combining datasets, and innovative use of new technological solutions. It also advises checking whether your national data protection authority has published its own list. Whether footage of people, or a model trained on it, meets those tests turns on facts such as who appears and how the data is used. That is a question for counsel, and the first table sets out questions to put to them.

Article 35(7) sets out the minimum. It is a systematic description of the envisaged processing operations and their purposes; an assessment of necessity and proportionality in relation to the purposes; an assessment of the risks to the rights and freedoms of data subjects; and the measures envisaged to address the risks, including safeguards, security measures and mechanisms to protect personal data and demonstrate compliance. Article 35(2) requires the controller to seek the advice of the data protection officer, where designated. Article 35(9) says that, where appropriate, the controller seeks the views of data subjects or their representatives.

The second table sets those four elements against what the Firsthand site states. It is a map of possible inputs, not a completed assessment.

Article 35(1) puts the duty on the controller. Article 28(3)(f) says the processor contract shall stipulate that the processor assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36, taking into account the nature of processing and the information available to the processor. Article 35 falls inside that range. A vendor’s job is therefore to supply accurate information, and the controller decides what the assessment concludes.

Which party is the controller is settled by the contract. The /dpa draft says the order form confirms whether Firsthand acts as an independent controller or as your processor for participant footage collected to your specification, so who assesses what can differ by deal. Settle roles with counsel before the DPIA starts.

A DPIA does not replace them. It assesses risk, while consent records show participants agreed before capture, a DPA governs how a processor handles personal data, and a license governs what you may do with the dataset. The site’s consent guide states that de-identification does not remove the need for consent and that consent is separate from the license. All of them can serve as evidence of the measures a DPIA describes.

The consent chain the site states runs as follows. A written release is signed before capture, and site permission is on file at capture. Automated face, plate and screen detection runs at ingest, then a human reviews the footage. Consent artefact IDs are listed per episode in the batch data card at delivery, and withdrawal requests are honoured for undelivered footage. Delivered footage cannot be recalled, and the release states that limit. That limit is relevant to a risk assessment of a delivered dataset.

The third table separates the two. The site does not state that Firsthand has completed a DPIA for a dataset, that it supplies a DPIA template, or that a DPIA is or is not needed for your use. The video anonymization service is stated to deliver a data-processing record suitable for a DPIA, listing what was redacted, how, and the source-handling decision. Whether a dataset delivery includes the same record is not stated.

The /dpa page says a SOC 2 Type II audit is in progress, so no completed certification is stated. Necessity and proportionality, data residency, retention, deletion or return, audit rights and breach notification terms are also not stated. The signed agreement controls over any summary on the site.

Start the DPIA input at spec stage, not at delivery. Article 35(1) says the assessment comes prior to the processing, and for a custom collection the brief is the point to settle roles, purposes, de-identification steps and the documents you want from the vendor. Where coverage is deep, a first validated batch lands in a median of 48 hours from signed spec; thinner environments typically take three to four weeks. A DPIA that starts after the first batch can end up setting your schedule, so ask legal to read /dpa, /provenance and the license terms while the skill spec is written.

What is a DPIA?

A data protection impact assessment: a written assessment of a planned processing operation that GDPR Article 35 requires a controller to carry out beforehand when the processing is likely to result in a high risk to rights and freedoms. This is not legal advice.

Is a DPIA required for AI training data?

Not automatically. Article 35(1) requires one where processing is likely to result in a high risk, and Article 35(3) names three cases in particular. Whether a footage dataset meets the test depends on the facts, so ask your counsel.

Who does the DPIA, the buyer or the vendor?

Article 35(1) puts the duty on the controller. Under Article 28(3)(f) a processor contract provides that the processor assists the controller with obligations under Articles 32 to 36. On this site, the order form confirms whether Firsthand acts as an independent controller or as your processor.

What must a DPIA contain?

At least a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to data subjects, and the measures envisaged to address those risks (Article 35(7)).

Does Firsthand provide a DPIA?

The site does not state that Firsthand has completed a DPIA for a dataset or supplies a template. It states that its video anonymization service ships a data-processing record suitable for a DPIA, and its stated consent, de-identification and security terms can inform one. The /dpa page is a draft.

Does de-identification remove the need for a DPIA?

Not by itself. The site’s anonymization guide says only irreversible anonymization takes data out of scope, and /dpa says personal data is processed to collect and de-identify the datasets first. Whether a DPIA applies is for your counsel.