DPIA & Model Risk
The DPIA & Model Risk page documents data protection obligations and AI model risk assessments for your Studio — required for GDPR compliance and enterprise governance.
DPIA sections
Data Categories — What categories of personal data may be processed by AI agents (source code containing PII, user stories mentioning customers, etc.).
Purpose & Legal Basis — Why this data is processed and which UK GDPR lawful basis applies (legitimate interest, explicit consent, etc.).
Data Processors — Third-party AI providers that will receive data. Confirm DPA/SCCs are in place for each.
Retention & Deletion — How long AI providers retain prompt and completion data. Most offer zero-retention options for enterprise accounts.
Necessity & Proportionality — Justification that AI processing is necessary and appropriate relative to privacy impact.
Individual Rights — How data subject requests (access, erasure) are handled in the context of AI processing.
Incident Response — How an AI-related data breach would be detected, contained, and reported.
Model Risk Assessment
Each AI model provider is rated on risk dimensions: data sovereignty, model stability, hallucination rate, security posture, and contractual liability. The model risk score is shown on the DPIA page and feeds into the overall Studio risk rating.
Completeness gate
The DPIA completeness indicator must reach 80% before a release can be created. Sections left blank count as incomplete. You can mark sections as Not Applicable (with a written justification) without losing completeness credit.