Data Protection Impact Assessment (DPIA) Template
Last Updated: 2026-05-16 Version: 1.0 Document owner: Noxys SAS — Data Protection Officer (dpo@noxys.eu)
Purpose. This template helps a Customer's Data Protection Officer (DPO) conduct a Data Protection Impact Assessment for the deployment of the Noxys AI Firewall, in accordance with Article 35 of the GDPR and the CNIL PIA methodology (Privacy Impact Assessment guides 1 — 3, edition 2018, updated 2024).
Technical sections (data flows, PII categories, retention, sub-processors, residency) are pre-filled with Noxys-specific content. Business-context sections (purpose, lawful basis, governance) must be completed by the Customer's DPO.
Disclaimer. This pre-filled template is a starting point, not a substitute for the judgement of a qualified Data Protection Officer or supervisory authority. The Customer remains the Data Controller (Art. 4(7) GDPR) and is responsible for the final DPIA.
0. Document Control
| Field | Value |
|---|---|
| Processing name | {{processing_name}} |
| Customer / Data Controller | {{customer_name}} |
| Controller representative | {{controller_representative}} |
| DPO (Customer) | {{customer_dpo}} — {{customer_dpo_email}} |
| Processor | Noxys SAS, 75 rue de la Republique, 75011 Paris, France |
| DPO (Noxys) | dpo@noxys.eu |
| DPIA author | {{dpia_author}} |
| DPIA date | {{dpia_date}} |
| Review cycle | Annual, or upon material change to processing |
| Supervisory authority | {{lead_supervisory_authority}} (typically CNIL for French controllers) |
1. Description of the Processing
1.1 Nature of the Processing
The Noxys AI Firewall acts as a security and compliance layer placed between end-user devices and Generative AI services (ChatGPT, Claude, Gemini, Mistral, Copilot, and other LLM platforms). Three deployment methods exist; the Customer has selected:
- Browser Extension (Chrome / Edge / Firefox / Safari) — client-side redaction in the user's browser before transmission
- Endpoint Agent — OS-level interception of AI traffic
- Reverse Proxy — network-level inspection at the corporate egress
The Firewall identifies sensitive data in real time (PII, secrets, intellectual property, regulated data) and applies one of four actions per policy: allow, redact, coach (educate the user), or block.
1.2 Purpose of the Processing
Pre-filled — typical purposes:
- Security — prevent leakage of Personal Data and corporate confidential data to third-party AI providers (GDPR Art. 32, Art. 5(1)(f))
- Compliance — enforce EU AI Act (Art. 10, 14, 26), GDPR, NIS2, DORA, sectoral regulations (HIPAA, PCI-DSS, banking secrecy)
- Governance — provide auditable evidence of AI usage for Article 30 records of processing
The Customer's specific purpose: {{customer_purpose}}
1.3 Lawful Basis (Art. 6 GDPR)
To be selected by the Customer's DPO. Common bases for workplace deployment:
- Legitimate interest (Art. 6(1)(f)) — securing the corporate information system; balancing test required
- Legal obligation (Art. 6(1)(c)) — sectoral obligation to control data exfiltration
- Contract (Art. 6(1)(b)) — necessary for the performance of the employment contract
Where employee monitoring is involved, the Customer must additionally consult employee representatives (in France: CSE, Art. L.2312-38 du Code du travail) and update the internal monitoring notice.
1.4 Scope of the Processing
| Element | Pre-filled Noxys value | Customer override |
|---|---|---|
| Data subjects | Employees, contractors, and authorised third parties using AI tools on Customer-managed devices | {{data_subjects_override}} |
| Categories of personal data | (1) Professional identity (work email, AD/Entra ID, device ID); (2) Metadata of AI usage (timestamp, target service, policy verdict, classifier labels, hashed prompt fingerprint SHA-256); (3) Transient processing of raw prompt content for in-memory classification — never persisted in clear text | {{data_categories_override}} |
| Special categories (Art. 9) | None processed by Noxys. If the Customer's prompts contain Art. 9 data, the Firewall's classifier redacts them before transmission. | {{special_categories_override}} |
| Volume | Estimated {{user_count}} users, {{daily_prompts}} prompts/day | — |
| Geographic scope | Processing in EU (France — Scaleway Paris). No transfer outside the EEA. | — |
| Duration | For the term of the Noxys subscription; metadata retained per Section 1.6 | {{processing_duration_override}} |
1.5 Data Flows
Key property. Raw prompt content never crosses the Noxys API boundary in clear text. Only metadata, classifier verdicts, and SHA-256 fingerprints are transmitted and stored. See Data Handling for full detail.
1.6 Retention
| Data category | Default retention | Configurable? |
|---|---|---|
| Hashed prompt fingerprints | 90 days | Yes — 7 days to 2 years |
| Policy verdict events | 90 days | Yes — 30 days to 2 years |
| Audit logs (security) | 365 days | Yes — minimum 180 days for compliance tiers |
| Aggregated metrics | 24 months | Yes |
| Backups | 30 days, encrypted at rest (AES-256) | No |
| Raw prompt content | Never persisted | N/A |
Customer override (Storage Tier per ADR-019): {{retention_tier}} — {{retention_details}}
1.7 Recipients (Sub-processors)
| Recipient | Role | Country | Safeguards |
|---|---|---|---|
| Scaleway SAS | Cloud infrastructure (compute, storage, backup) | France | DPA signed; ISO 27001, SecNumCloud-aligned |
| Stripe Payments Europe Ltd. | Payment processing (billing only — no end-user data) | Ireland | DPA signed; SCC clauses |
| OVHcloud SAS | DNS, secondary infrastructure | France | DPA signed; ISO 27001 |
| (Self-hosted Customers) | None — full data residency on Customer premises | — | — |
Full list and updates: see Sub-processors. No transfer outside the EEA.
2. Necessity and Proportionality (Art. 5 GDPR)
2.1 Purpose Limitation (Art. 5(1)(b))
The processing is strictly limited to the security and compliance purposes listed in Section 1.2. Noxys SAS contractually undertakes (DPA Section 2) to not process the data for any other purpose — in particular, no training of AI models, no marketing, no profiling for commercial purposes.
2.2 Data Minimisation (Art. 5(1)(c))
- Raw prompt content is processed in memory only and discarded after classification
- Only hashed fingerprints (SHA-256, irreversible) are persisted
- Metadata stored is the minimum necessary to demonstrate a policy verdict and provide audit evidence
- No biometric data, no behavioural profiling beyond the policy verdict counter
2.3 Accuracy (Art. 5(1)(d))
- Classifier verdicts are deterministic given the input — no probabilistic profile is built about individual users
- Users can request rectification of incorrect metadata via the Customer's DPO contact (Art. 16)
- Classifier models are versioned; each verdict is tagged with the model version for auditability
2.4 Storage Limitation (Art. 5(1)(e))
Retention durations (Section 1.6) are aligned with the security purpose. Hashed fingerprints expire automatically; no manual purge is required.
2.5 Integrity and Confidentiality (Art. 5(1)(f), Art. 32)
See the GDPR Art. 32 Pack — Noxys provides encryption in transit (TLS 1.3), at rest (AES-256), per-tenant KMS isolation, RBAC, MFA on console access, and full audit logging.
2.6 Proportionality Assessment
The Customer's DPO must assess whether the processing is proportionate to the legitimate interest pursued. Key considerations:
- The Firewall does not read employee personal communications outside the scope of AI services configured in policy
- The user is informed in real time when content is redacted or blocked (Coach Mode), preserving transparency
- An opt-out mechanism exists for legitimate exceptional cases (DPO override, audit trail preserved)
- The Customer must update the internal monitoring notice and consult employee representatives where required
3. Risks to the Rights and Freedoms of Data Subjects
The CNIL PIA methodology evaluates three feared events. For each, Noxys provides a pre-filled assessment that the Customer's DPO must validate against local context.
3.1 Illegitimate Access to Personal Data
| Threat | Likelihood | Severity | Justification |
|---|---|---|---|
| External attacker compromises Noxys API | Limited | Significant | EU-only hosting, ISO 27001 alignment, encrypted storage, MFA, pentest annually |
| Malicious insider at Noxys accesses raw prompts | Negligible | Significant | Raw prompts never persisted; staff access to metadata gated by per-tenant KMS, audited |
| Compromise of third-party AI provider | Limited | Significant | Mitigated by client-side redaction — redacted content is what is transmitted |
| Foreign government request (CLOUD Act, FISA 702) | Negligible | Significant | No US-based sub-processor in the data path; data resident in France |
3.2 Unwanted Modification of Personal Data
| Threat | Likelihood | Severity | Justification |
|---|---|---|---|
| Tampering with audit logs | Negligible | Significant | Append-only event store, daily hash-chained integrity check, immutable backups |
| Incorrect classification (false positive / false negative) | Limited | Limited | Versioned classifier models, override workflow with audit trail, Coach Mode preserves user agency |
3.3 Disappearance of Personal Data
| Threat | Likelihood | Severity | Justification |
|---|---|---|---|
| Loss of audit metadata (regulatory exposure for Customer) | Negligible | Limited | Daily encrypted backups, 30-day retention, geo-redundant in EU; RPO 24h, RTO 4h |
3.4 Risk Matrix Summary
| Feared event | Residual likelihood | Residual severity | Residual risk level |
|---|---|---|---|
| Illegitimate access | Negligible | Significant | Acceptable |
| Unwanted modification | Negligible | Limited | Acceptable |
| Disappearance | Negligible | Limited | Acceptable |
The Customer's DPO must validate this assessment against the specific Customer context (industry, regulatory framework, data sensitivity).
4. Measures Envisaged to Address the Risks
4.1 Technical Measures (pre-filled)
| Measure | Implementation | Reference |
|---|---|---|
| Local redaction (privacy by design) | Raw prompts classified in-process on the user's device; never transmitted in clear | Data Handling |
| Cryptographic hashing | SHA-256 fingerprints — irreversible | ADR-007 |
| Encryption in transit | TLS 1.3, HSTS, certificate pinning for native agents | Art. 32 Pack |
| Encryption at rest | AES-256-GCM with per-tenant KMS | ADR-019 |
| Access control | RBAC, mandatory MFA, SSO via SAML/OIDC, short-lived tokens | SAML Hardening |
| Audit logging | Append-only, hash-chained, exported to Customer SIEM | Audit Reference |
| Vulnerability management | Annual pentest, continuous SAST/DAST, monthly dependency scans | Trust Center |
| EU residency | Scaleway Paris; no extra-EEA transfer | Sub-processors |
4.2 Organisational Measures (pre-filled)
| Measure | Implementation | Reference |
|---|---|---|
| Data Processing Addendum (DPA) | Signed at contract start; covers GDPR Art. 28 | DPA Template |
| Article 30 records | Pre-filled skeleton provided to Customer | Art. 30 Skeleton |
| Breach notification | Noxys notifies Customer within 24 hours of detection | DPA Section 6 |
| Sub-processor governance | 30-day prior notice before adding any sub-processor; right to object | DPA Section 4 |
| Employee training (Noxys staff) | Annual privacy and security training, attestation logged | Trust Center |
| Independent audits | Annual SOC 2 Type II (planned 2026 Q4), ISO 27001 alignment | Compliance |
4.3 Customer-Side Measures (to be completed by the Customer)
- Update internal monitoring notice and inform users (Art. 13 GDPR)
- Consult employee representatives where required (FR: CSE; DE: Betriebsrat; etc.)
- Define policies for Coach Mode, redaction thresholds, and exception handling
- Define and document the DPO override workflow
- Schedule annual review of this DPIA
- Integrate Noxys events into Customer SIEM and incident response runbooks
5. Residual Risk and Validation
5.1 Residual Risk Assessment
After implementation of the measures in Section 4, the residual risk to the rights and freedoms of data subjects is assessed as:
{{residual_risk_level}} — recommended pre-filled value: Acceptable / Low
Justification: the combination of client-side redaction, cryptographic hashing, EU residency, minimal retention, and audit-grade governance reduces both the likelihood and severity of feared events to a level proportionate to the legitimate interest of securing the Customer's information system against AI-related data leakage.
5.2 Need for Prior Consultation with the Supervisory Authority (Art. 36)
A prior consultation with the supervisory authority is not required if the residual risk is low. The Customer's DPO must confirm this position:
- No prior consultation needed (residual risk is low)
- Prior consultation initiated with
{{lead_supervisory_authority}}on{{consultation_date}}
6. Approval and Signatures
| Role | Name | Date | Signature |
|---|---|---|---|
| Data Controller representative | {{controller_representative}} | {{date_controller}} | ____________ |
| Data Protection Officer (Customer) | {{customer_dpo}} | {{date_dpo}} | ____________ |
| IT / Security lead (Customer) | {{customer_security_lead}} | {{date_security}} | ____________ |
| Noxys DPO (acknowledgement) | Noxys SAS — dpo@noxys.eu | {{date_noxys}} | ____________ |
References
- GDPR: Articles 5, 6, 25, 28, 30, 32, 35, 36
- CNIL: PIA Guides — Methodology, Templates, Knowledge Bases (edition 2018, updated 2024)
- EDPB: Guidelines 4/2019 on Article 25 — Data Protection by Design and by Default
- EU AI Act: Regulation (EU) 2024/1689, Articles 10, 14, 26
- Noxys references: Art. 32 Pack, Art. 30 Skeleton, DPA Template, Sub-processors, Data Handling, Compliance
How to generate a customer-specific copy. Run
scripts/generate-dpia.sh --customer "Acme Corp" --processing-name "Acme Noxys deployment" --locale en --output-format mdfrom the noxys-doc repository root. Seedocs/legal/noxys-prefilled-sections.mdfor the data sources used to pre-fill each placeholder.