Running a data privacy impact assessment on a new matter system
A mid-size litigation firm signs a contract with an AI-assisted contract review vendor on a Friday. By Monday, an associate has uploaded 400 client NDAs into the tool to test it, none of the clients were told, and the vendor's terms of service say uploaded documents may be used to "improve model performance." No one ran a DPIA first. This is how firms end up in breach notification letters, not headlines about efficiency gains.
A DPIA (Data Protection Impact Assessment) is a structured, documented process that identifies and reduces privacy risk before a new system touches personal data. Under the EU/UK General Data Protection Regulation (GDPR), a DPIA is legally required whenever processing is "likely to result in high risk" to individuals, Article 35. US firms don't have one federal equivalent, but state laws like the California Consumer Privacy Act (CCPA, enforced by the California Privacy Protection Agency) and sector expectations from the ABA Model Rules of Professional Conduct (Rule 1.6 on confidentiality) create the same practical obligation: know what the tool does with client data before you deploy it.
Why This Matters Specifically for Law Firms
Law firm data is not ordinary corporate data. Client documents routinely contain:
- Personal data of third parties (employees named in HR disputes, patients in medical malpractice files)
- Privileged and confidential material protected by attorney-client privilege
- Special category data under GDPR Article 9 (health records, criminal history, union membership)
A contract review AI tool that ingests these documents is a data processor, and the firm remains the data controller responsible for what happens to that data, even if the vendor mishandles it. GDPR Article 28 requires a written contract (a Data Processing Agreement, DPA) governing exactly this relationship.
The DPIA Walkthrough: Six Steps
Step 1: Describe the processing
MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → what actually happens: which documents go in, where they're stored, whether the vendor's model is hosted in the EU, US, or elsewhere, and whether any human reviewer at the vendor ever sees raw client text. Ask the vendor directly: does this touch a large language modellarge language modelA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.View full definition → (LLMLLMA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.View full definition →) that logs prompts, and are those logs used for model training?
Step 2: Assess necessity and proportionality
Could the same contract review task be done with less data exposure, redacted documents, a sandboxed pilot, anonymized samples? If the vendor demands full document sets for a free trial, that's a flag, not a convenience.
Step 3: Identify risks to individuals, not just the firm
This is where DPIAs differ from ordinary IT security reviews. The question isn't "could we get hacked" but "what happens to the named individuals in these documents if something goes wrong." A leaked severance agreement exposes an ex-employee's settlement terms, not just the firm's reputation.
Step 4: Consult stakeholders
Best practice, and often required, is to loop in the firm's Data Protection Officer (DPO) if one exists, IT security, and general counsel before signing. The UK Information Commissioner's Office (ICO) publishes a practical DPIA template and guidance that firms can adapt directly.
Step 5: Identify mitigations
Common mitigations for AI contract review tools:
- Contractual clause prohibiting use of client data for model training
- Data residency guarantee (EU data stays in EU servers, relevant under GDPR Chapter V restrictions on international transfers)
- Retention limits (documents auto-deleted after 30 or 90 days)
- Role-based access controls limiting which associates can upload
Step 6: Sign-off and residual risk
Document the residual risk and who accepted it. If risk remains high after mitigation, GDPR Article 36 requires prior consultation with the supervisory authority before processing begins.
Risk Triggers That Should Stop Procurement Cold
These are the signals that should halt a deal before it reaches general counsel's desk, because by the time GC is reviewing a signed contract, leverage is gone.
| Trigger | Why it matters |
|---|---|
| Vendor's terms allow use of uploaded data to "improve" or "train" models | Client documents could end up shaping outputs seen by other customers, a confidentiality breach |
| No clear answer on data residency or subprocessors | You can't assess GDPR transfer risk if you don't know where data lives |
| No Data Processing Agreement offered as standard | Signals immature compliance infrastructure |
| Vendor cannot confirm encryption at rest and in transit | Baseline security hygiene missing |
| No audit logging of who accessed which document | Fails basic accountability principle (GDPR Article 5(2)) |
| Trial period requires uploading real client files with no redaction option | Turns a "test" into live processing without consent |
A useful gut check: if the vendor's sales rep can't answer "where does this data go and who can see it" in one sentence, escalate before you pilot, not after.
A Practical Technical Check
Before rollout, ask IT or the vendor to confirm, in writing, answers to a short checklist. Even non-technical reviewers can run this:
DPIA Technical Intake Checklist:
[ ] Data residency confirmed (country/region)
[ ] Subprocessors listed (e.g., cloud host, model provider)
[ ] Training data exclusion clause in contract (Y/N)
[ ] Retention period specified (days)
[ ] Encryption: at rest (Y/N), in transit (Y/N)
[ ] Access logs available for audit (Y/N)
[ ] Deletion/export process on contract terminationIf more than two boxes are unchecked, the DPIA should flag "high risk, do not proceed" status.
Knowledge check
1. In the scenario where an associate uploaded 400 client NDAs to a new AI contract review tool without a DPIA, what was the most fundamental process failure?
2. Under GDPR, when is a firm legally required to conduct a DPIA before deploying a new system?
3. Why does a law firm remain responsible for client data even after handing it to a third-party AI vendor for processing?
4. Select ALL correct answers about why law firm data poses distinctive privacy risks compared to ordinary corporate data.
Select all the correct answers.
5. Select ALL correct answers about the practical obligations firms in the US face regarding new data-processing tools, even without a single federal DPIA mandate.
Select all the correct answers.
Where This Fits in Ongoing Governance
A DPIA isn't a one-time gate. It should be revisited when:
- The vendor changes its subprocessors or hosting (common with AI vendors switching underlying LLMLLMA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.View full definition → providers, e.g., moving from one foundation model provider to another)
- The firm expands use from one practice group to firm-wide
- A new jurisdiction's clients start having their documents processed (triggering new regulatory regimes, like Brazil's LGPD or China's PIPL)
Firms that treat the DPIA as a living document, reviewed annually or at contract renewal, catch drift before regulators or clients do. The US National Institute of Standards and Technology (NIST) AI Risk Management Framework offers a complementary, non-EU-specific structure for ongoing AI system risk review, useful for US firms without a formal GDPR obligation but wanting the same discipline: NIST AI RMF.
🎬 [VIDEO: "What is a DPIA? Data Protection Impact Assessment Explained" — youtube.com — a short explainer walking through the GDPR DPIA process step by step, useful as a visual companion to this lesson]
Key Takeaways
- A DPIA must happen before deployment, not after signing; running it post-contract means losing negotiating leverage on data terms.
- The core question is risk to individuals named in documents, not just firm security, this is the mindset shift from IT review to privacy review.
- Six red flags (training-data reuse, unclear residency, no DPA, weak encryption, no audit logs, unredacted trial uploads) should stop procurement before general counsel even reviews the contract.
- Treat the DPIA as living documentation: revisit on vendor subprocessor changes, jurisdiction expansion, or annual renewal.
- Free regulator resources (ICO's DPIA template, NIST's AI RMF) give non-specialist reviewers a structured, defensible process without needing outside counsel for every pilot.