Phase 4: Privacy-Preserving AI · 35 min · Python
Privacy Impact Assessment — GDPR, EU AI Act, and Your Model
A privacy impact assessment is not paperwork. It's a threat model for personal data.
Hiring signal: Being able to conduct a structured privacy impact assessment (GDPR Art. 35 / EU AI Act Art. 10) and produce a documented assessment is a concrete deliverable in RAI roles, especially in healthcare and finance.
What you will learn
- Describe the GDPR Article 35 DPIA requirements
- Describe the EU AI Act Article 10 data governance requirements
- Build a privacy impact assessment tool that evaluates an AI system against both frameworks
- Produce a structured PIA document as a compliance artifact
The Problem
GDPR Article 35 requires a Data Protection Impact Assessment (DPIA) for any processing "likely to result in a high risk to the rights and freedoms of natural persons." The EU AI Act Article 10 adds specific data governance requirements for high-risk AI systems. If you're deploying an AI system that processes personal data — and almost all do — you need a structured assessment that identifies privacy risks and documents mitigations.
This is not a checkbox exercise. A PIA is a threat model: what data flows through your system, what could go wrong, and what you're doing about it.
GDPR Article 35 DPIA Requirements
| Requirement | What It Means for AI |
|---|
| Systematic description of processing | What data does the model use? How is it collected, stored, processed? |
| Assessment of necessity and proportionality | Is collecting this data necessary for the model's purpose? Could you achieve the same with less data? |
| Assessment of risks to data subjects | What happens if the model leaks training data? Could membership inference reveal sensitive information? |
| Measures to address risks | Differential privacy, federated learning, data minimization, encryption, access controls |
| Residual risk assessment | After mitigations, what risk remains? Is it acceptable? |
Unlock the full lesson
You've read the first 2 sections. The rest of this lesson covers EU AI Act Article 10 Data Governance, Building the PIA Tool, What's Next — plus a hands-on lab, quiz, and project artifact.
Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.
Browse all courses · View pricing · DeVenture Academy