DPIA for therapists using an AI note-taking tool: do you need one, and a template

A DPIA (data protection impact assessment, AIPD in French) is the document in which the controller of a processing operation describes it, checks that it is necessary and proportionate, assesses the risks to the people concerned and sets the measures that reduce them. It comes from Article 35 of the GDPR. When a therapist hands session notes to an AI tool, the therapist, not the vendor, is the controller and is therefore responsible for this assessment.

This article builds on our guide to a GDPR-compliant AI scribe for therapists in Europe, which helps you choose a tool, and our page on GDPR obligations in private practice. Here we write the document itself. The examples are French (CNIL) with notes for Belgium, Luxembourg and Ireland.

What Article 35 of the GDPR says

Paragraph 1 sets the rule: where a type of processing, "in particular using new technologies", is likely to result in a high risk to the rights and freedoms of natural persons, the controller carries out, prior to the processing, an assessment of its impact (GDPR, Article 35, CNIL page, in French).

• Before. The assessment comes before you start using the tool, not six months in.
• Large scale. Paragraph 3(b) covers large-scale processing of special categories of data. Session notes are health data, but a single practice is usually not "large scale".
• Minimum content. Paragraph 7 requires at least a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks and the measures envisaged. The template below follows that order.

Article 36 requires prior consultation of the supervisory authority when the assessment shows a high risk; the CNIL explains this applies when the residual risk stays high after your measures. Otherwise the DPIA is not sent anywhere: you keep it and show it if asked.

The CNIL lists, quoted exactly

Processing that requires a DPIA

In 2018 (deliberation 2018-327 of 11 October 2018) the CNIL adopted a list of fourteen types of processing that always require a DPIA. The only health entry covers "Traitements de données de santé mis en œuvre par les établissements de santé ou les établissements médicosociaux pour la prise en charge des personnes", that is, health data processed by health or social care institutions for patient care (CNIL list, DPIA required). A private practice is not an institution, so this entry does not apply directly.

Processing exempt from a DPIA

The CNIL also publishes the reverse list (deliberation 2019-118 of 12 September 2019). It exempts "Traitements de données de santé nécessaires à la prise en charge d'un patient par un professionnel de santé exerçant à titre individuel au sein d'un cabinet médical, d'une officine de pharmacie ou d'un laboratoire de biologie médicale": health data needed for patient care by a health professional working individually in a medical practice, pharmacy or medical laboratory (CNIL list, DPIA not required). Its examples are appointments, medical files and prescriptions, files needed to follow the patient, claim forms, exchanges between identified professionals and accounting.

• It names a "professionnel de santé" in a "cabinet médical". Psychologists are named neither in this entry nor in the list of examples of the CNIL framework for medical and allied health practices, which ends with "etc.". The CNIL does not say whether a psychologist falls within it: relying on the exemption is an interpretation, not a certainty.
• Its examples are conventional processing. Having generative AI produce a note from what is said in session adds processing the list does not describe.

The nine criteria

Outside the lists, the CNIL holds that processing meeting at least two of the nine European criteria needs a DPIA (CNIL, DPIA basics). For an AI note-taking tool, three are in play: sensitive data, vulnerable people (the CNIL cites patients) and innovative use. On the last one, the CNIL says the use of AI systems does not systematically count as innovative use, but places generative AI, whose behaviour cannot be anticipated in every use case, within innovative use (CNIL AI guidance, 8 April 2024).

Solo practice or group practice: who needs one

• Solo, conventional record software. Not on the mandatory list, close to the exemption: in our view a DPIA is generally not needed. Write your reasoning in your processing register.
• Solo, AI note-taking tool. Exemption uncertain, two or three criteria met. We advise a simplified DPIA.
• Group practice, separate records. Each practitioner remains controller. Same advice: one simplified DPIA each, or one shared DPIA if the tool and use are the same (Article 35 allows a single assessment for similar processing).
• Group practice with a shared information system. The CNIL framework states that a DPIA and a data protection officer "devraient être nécessaires" (should be needed) for health professionals in a group practice sharing a common information system, from an annual threshold of 10,000 patients (CNIL framework for medical and allied health practices).
• Centre or institution. If the structure is a health or social care institution, entry 1 of the mandatory list applies.

Belgium, Luxembourg, Ireland

• Belgium. The Data Protection Authority list (decision 01/2019 of 16 January 2019) covers health in specific cases (active implantable medical devices, systematic exchange of sensitive data between several controllers). A solo practice is not listed as such: the European criteria apply.
• Luxembourg. The CNPD list (deliberation 34/2019) has no entry on health data as such, so the European criteria apply.
• Ireland. The DPC list (revised 15 November 2018) requires a DPIA for large-scale processing of special category data and counts new technologies among the risk factors.

In all three countries the template below works as is. The EU AI Act adds to the GDPR without replacing it: see EU AI Act and psychologists.

What the vendor must give you

The CNIL framework says that, under Article 28 of the GDPR, the processor must provide the controller with all information needed for the assessment. Ask any vendor, in writing, for:

• The data processing agreement (Article 28), signed, with the list of sub-processors, including the AI model provider.
• The host and its HDS certificate: in France, hosting health data for a third party requires a certified host (our page on HDS hosting).
• Location of storage and AI processing, and whether any data leaves the EU.
• Pseudonymisation: which identifying data are removed before the model.
• No training: a written commitment that your data are not used to train a model.
• Audio: kept or not, for how long, where.
• Encryption in transit and at rest, access management, logging.
• Breach procedure and how quickly the practice is told.
• Exit: export and deletion of data when the contract ends.

To compare tools on these points, see our guide to psychologist practice software.

Simplified DPIA template for an AI note-taking tool

Copy this template into a dated document. It follows Article 35(7). For a deeper analysis, the CNIL PIA tool, free open-source software for Windows, macOS and Linux available in about twenty languages, walks through the same method.

1. Description of the processing

• Controller: name, practice address, professional registration number.
• Tool and vendor: name, plan, date of the processing agreement.
• Sub-processors: host (HDS certificate), AI model provider, country.
• People concerned: adult clients, minors, couples, families, third parties mentioned in session.
• Data: audio during the session, transcript, dictation, generated note, patient record.
• Data flow: from microphone to report, step by step, with what is kept and where.
• Retention: audio, transcript, note, record.
• Access: who sees what (you, a colleague, a secretary, vendor support).

2. Purposes and legal basis

• Purposes: writing session notes and reports, keeping the record, following the client.
• Excluded purposes: model training, commercial statistics, any other reuse.
• Lawful basis (Article 6) and the Article 9 condition relied on for health data.
• Client information: how and when clients are told, and how they can say no.

3. Necessity and proportionality

• Why AI: the precise need the tool meets.
• Minimisation: only useful data, pseudonymisation, no unnecessary fields.
• Less intrusive option: dictation after the session instead of live transcription, when the client declines or the session does not suit it.
• Accuracy: the therapist reviews and validates every note.
• Client rights: access, rectification, objection, and how you respond.

4. Risks

For each risk, rate severity and likelihood (negligible, limited, significant, maximum) before and after the measures.

• Unauthorised access to notes or audio (hacking, shared account, unlocked computer).
• Uncontrolled transfer or processing outside the EU.
• Reuse of session content to train a model.
• Audio kept longer than needed.
• Errors or invented content in the note, filed without review.
• Third parties mentioned in session who are not informed.
• Loss or unavailability of notes (end of contract, outage, vendor failure).
• Client not informed, or not comfortable saying no.

5. Measures

• Contractual: Article 28 agreement, no-training commitment, sub-processor list.
• Technical: HDS hosting, encryption, pseudonymisation before AI, no audio kept, two-factor authentication.
• Organisational: written client information, right to decline with no effect on care, review of every note, passwords, locked screens, breach procedure.

6. Decision

• Residual risk: acceptable or high.
• Decision: go live, go live with conditions, or reject. If the risk stays high, consult the supervisory authority (Article 36).
• Date, signature, DPO opinion if any.
• Review date: at every change of tool, sub-processor or use, and at least once a year. The CNIL notes that the DPIA of an AI system is updated iteratively.

Filled-in example (fictional)

Fictional Linden Practice: three private psychologists, Claire, Hugo and Ines (fictional names), share premises but each keeps their own records. They want to adopt the same AI note-taking tool, called "Tool A" here. They write one shared DPIA, and each signs it for their own processing.

• Description: Tool A transcribes what is said in session or takes a dictation after the session, then drafts a note the psychologist reviews. HDS-certified host in France, AI processed in France according to the contract. Adults and adolescents, couples sessions for Hugo. Audio used during the session and not kept according to the contract. Notes kept in the record for the retention period each practitioner has set.
• Purposes: writing session notes and keeping the record. No other reuse, training excluded in writing. Clients informed by a leaflet at the first appointment and orally, with the right to decline.
• Necessity: more complete and more regular notes. Names and identifying details pseudonymised before AI. For clients who decline, dictation after the session without identifying details, or handwritten notes.
• Risks: unauthorised access (significant severity, limited likelihood after measures); wrong content in a note (significant severity, limited likelihood thanks to systematic review); third parties (limited severity, nothing added about them beyond what is needed); client not comfortable declining (neutral wording, no reason required).
• Measures: processing agreement signed on 2 November, host's HDS certificate attached, two-factor authentication on, screens locked, no note validated without review, breach procedure posted at reception.
• Decision: residual risk acceptable, go live on 15 November. No consultation of the authority. Review in a year or at any change of sub-processor.

For the client leaflet, start from our AI note-taking consent template.

Checklist before going live

• I checked whether my processing is on the mandatory list.
• I wrote down why I do, or do not, carry out a DPIA.
• I have the signed Article 28 agreement.
• I have the host's name and HDS certificate.
• I know where data are stored and where the AI processes them.
• I have a written no-training commitment.
• I know whether audio is kept, and for how long.
• I know which data are pseudonymised before AI.
• My clients are informed and can decline.
• I review every note before filing it.
• My DPIA is dated, signed and has a review date.

Common mistakes

• Doing the DPIA after deployment. Article 35 says prior to the processing.
• Treating the vendor's security page as the DPIA. It helps, but the assessment is yours.
• Forgetting third parties. Relatives mentioned in session are people concerned too.
• Never reviewing it. A new sub-processor or feature calls for an update.

Why Delta fits this case

Delta is the clinical assistant for mental health and allied health professionals, more than a scribe: it keeps the memory of each patient. During the session it transcribes what is said; afterwards you can dictate your observations. For the Measures section of your DPIA, the answers are straightforward: data hosted in France with an HDS-certified host, AI processing in France, names and identifying details pseudonymised before AI, no audio file kept, data never used to train a model, encryption in transit and at rest. As with any vendor, ask for the contractual documents you need. See what is Delta and our clinical document templates.

Sources

• CNIL, list of processing for which a DPIA is not required (French)
• CNIL, framework for the management of medical and allied health practices, 2020 (French)
• CNIL, AI: carry out an impact assessment if necessary, 8 April 2024
• GDPR, Chapter IV, Articles 35 and 36 (cnil.fr, French)
• Data Protection Commission (Ireland), list of processing operations requiring a DPIA, revised 15 November 2018