DPIA template for an AI note taker in interviews, filled in section by section

Yes, you will usually need a data protection impact assessment (DPIA) before using an AI note taker in interviews with UK or EU candidates. Article 35 of the GDPR requires one before processing that is likely to result in a high risk, the ICO lists AI combined with evaluation or scoring among its triggers, and its 2024 report on AI recruitment tools says DPIAs "are likely to be required by law for AI tools". Below is a filled template for recording, transcribing and summarizing interviews, organized by the ICO's seven DPIA steps and the four things Article 35(7) requires. Sources are as of October 2026; this is not legal advice.

Recording interviews under UK GDPR explains when a DPIA is needed for different setups. This page is the DPIA itself. Replace every bracketed item and every example with your own facts.

Do you need a DPIA for an AI note taker?

Article 35 (identical in substance in the EU GDPR) requires an assessment before processing "likely to result in a high risk" to people. The ICO's list of processing that needs one includes "innovative technology", with artificial intelligence as an example, where combined with one of the European criteria such as evaluation or scoring or sensitive data; it also says that if in doubt, do one (ICO, when do we need a DPIA). An AI note taker that summarizes or scores candidates meets the AI-plus-evaluation combination; one that only transcribes still captures health, family and other sensitive details candidates mention in passing. In its November 2024 key questions for recruiters, the ICO put "Have you completed a DPIA?" first and advised doing it before using an AI tool, ideally at procurement (ICO, 6 November 2024).

In the EU, each supervisory authority also publishes its own list of processing that requires a DPIA under Article 35(4); check the list of the authority where you are established.

What did the ICO's audits find missing from real DPIAs?

The ICO audited developers and providers of AI sourcing, screening and selection tools between August 2023 and May 2024, including tools that score candidates from "text transcriptions of in-person or video interviews"; generative AI tools were outside that work. Most providers had a DPIA, but the outcomes report found many were not detailed enough. The gaps it lists, and which section below covers each:

Section 1: Project and need for a DPIA

Project:        AI note taker for candidate interviews, [tool name]
Owner:          [name, role]          DPIA started: [date, before any live use]
Controller(s):  [agency / employer]; client role if agency: [controller / joint controller]
Processor(s):   [vendor], and its subprocessors listed in Annex A
Why a DPIA:     AI used to summarize [and score] interviews (innovative technology
                + evaluation); incidental special category data; candidates in an
                unequal position to object. Screening done [date] by [name].

Section 2: Describe the processing

The ICO's step 2 asks for the nature, scope, context and purposes (ICO, how do we do a DPIA). Start with the data flow, because everything else depends on it. Example entries:

• Scope: [number] interviews a month; candidates in [countries]; data categories: identity, voice [and image], career history, opinions about the candidate; special category data only when a candidate volunteers it.
• Context: candidates are not customers or employees, cannot easily refuse, and may not expect AI to process what they say. [Describe any vulnerable groups, such as school leavers.]
• Purposes: accurate notes of what the candidate said; consistent scorecards; [client submittals]. Not: training staff, training any model, or automated decisions.

Section 3: Consultation

• Data protection officer: Article 35(2) requires you to seek the DPO's advice where one is designated. Record the advice and date.
• Candidates: Article 35(9) requires you, where appropriate, to seek the views of the people affected. Example: ask the next 20 candidates a two-question survey about the notice and whether they would object; review any complaints about recording.
• Internal: recruiters and hiring managers who will use it, IT security, HR or employment counsel.
• Vendor: its own DPIA, its answers to your security questionnaire, and its DPA.

Section 4: Necessity and proportionality

Section 5: Risks to candidates

Assess likelihood and severity for each risk, as the ICO's step 5 describes. The ratings below are examples, not a judgment on any product.

Section 6: Measures and residual risk

If any residual risk stays high, Article 36 requires you to consult the regulator before processing starts; in the UK, that is the ICO.

Section 7: Sign-off

Measures approved by:            [name, role]           Date: [ ]
Residual risks approved by:      [senior manager]       Date: [ ]
DPO advice given:                [name]                 Date: [ ]
Summary of DPO advice:           [ ]
DPO advice followed?             [yes / no; if no, reasons]
Consultation responses reviewed: [name]                 Date: [ ]
Next review due:                 [date]   Owner: [name]

Section 8: When to review it

Article 35(11) requires a review at least when the risk changes. For an AI note taker, review when:

• the vendor adds features such as scoring, ranking or video analysis, or you switch them on;
• the subprocessor list or hosting region changes;
• you start interviewing in a new country, or agency clients start receiving transcripts;
• an incident, complaint or access request shows something the DPIA missed;
• and in any case once a year, with the date recorded.

Keep the DPIA with the rest of your evidence; the GDPR checklist for recruiters lists what else to hold.

Not legal advice. Have the completed DPIA reviewed by your DPO or data protection counsel.