Aller au contenu principal

DPIA for Noxys deployments

The Noxys DPIA template is a pre-filled starting point that DPOs can adapt to their organisation. It satisfies the structural requirements of Article 35 GDPR and the CNIL PIA methodology (edition 2018, updated 2024). Technical sections (data flows, PII categories, retention, sub-processors, EU residency) are pre-filled with Noxys-specific content; business-context sections (purpose, lawful basis, employee consultation) must be completed by the Customer's DPO.

Disclaimer. This template does not replace the judgement of a qualified DPO or supervisory authority. The Customer remains the Data Controller (Art. 4(7) GDPR) and is responsible for the final DPIA.

Quick start​

1. Read the source templates​

2. Generate a customer copy​

From the root of the noxys-doc repository:

# English Markdown
scripts/generate-dpia.sh \
  --customer "Acme Corp" \
  --processing-name "Acme Noxys deployment" \
  --locale en \
  --output-format md

# French PDF
scripts/generate-dpia.sh \
  --customer "Acme SA" \
  --processing-name "Déploiement Acme" \
  --locale fr \
  --output-format pdf

3. Add customer-specific fields​

Override any placeholder with --field key=value:

scripts/generate-dpia.sh \
  --customer "Acme Corp" \
  --processing-name "Acme rollout" \
  --locale en \
  --output-format md \
  --field customer_dpo="Marie Dupont" \
  --field customer_dpo_email="dpo@acme.example" \
  --field controller_representative="Pierre Martin (CTO)" \
  --field customer_purpose="Protect PII and source code from leakage to ChatGPT/Claude." \
  --field user_count="450" \
  --field daily_prompts="~12000"

The full list of placeholders is in docs/legal/noxys-prefilled-sections.

4. Review and sign​

A DPIA must be reviewed by the Customer's DPO, signed by the Data Controller's representative, and registered in the Customer's internal DPIA registry. See the validation checklist in noxys-prefilled-sections.

Pre-requisites for PDF generation​

PDF output uses pandoc with xelatex. Install before running with --output-format pdf:

OSCommand
Debian / Ubuntusudo apt-get install -y pandoc texlive-xetex
Fedorasudo dnf install -y pandoc texlive-xetex
macOS (Homebrew)brew install pandoc basictex

Without pandoc, the script falls back to Markdown and prints install instructions.

Sample output​

A worked example is published at examples/dpia-acme-sample.md in the repository. Use it as a reference for the level of detail expected in a finalised DPIA.

When is a DPIA mandatory?​

Per Art. 35(3) GDPR and the CNIL list (Décision n° 2018-327), a DPIA is mandatory when processing involves at least two of the criteria listed by the EDPB Guidelines WP248. A deployment of the Noxys AI Firewall typically triggers:

  • Systematic monitoring of employees' AI usage (criterion 4)
  • Innovative use of technology — application of an LLM-output classifier to a security purpose (criterion 8)
  • Processing of data on a large scale, depending on workforce size (criterion 6)

In doubt, the safe default is to conduct a DPIA. The Noxys pre-filled template makes that affordable.

Change management​

When Noxys publishes a change that affects pre-filled content (new sub-processor, updated retention default, new ADR), both templates are updated together with their Last Updated date. Customers with active deployments are notified per their DPA. See Change Management.

External references​