Bewertung starten - jurar LIA

Basic details

Details of the controller and of the person carrying out the assessment.

Controller (legal entity) *

The name of the natural or legal person that determines the purposes and means of the processing.

Person carrying out the assessment, and their role *

Who is completing this record? Ideally the data protection officer, otherwise a named person from IT, compliance or the business unit.

Internal reference (RoPA ID)

If available: the identifier of this processing activity in your record of processing activities under Art. 30 GDPR. Makes the document easier to find later.

Billing details

We need the following details to issue your invoice.

Company name *

The full legal name of the company the invoice is addressed to.

Address *

Full billing address: street, number, postal code and city.

Contact person *

Name of the person we can contact with questions about the invoice.

Billing email address *

We send the invoice to this address. It may differ from the address used for the download link, for example an accounts payable inbox.

Description of the processing

What the voice AI product processes and the context you deploy it in.

Categories of data processed *

Which types of data the product processes technically, for example raw call audio, machine-generated transcripts, call metadata (duration, phone number, timestamp), user input or IP addresses. With a vendor template this field is pre-filled.

Biometric identification by voice *

Is the voice used to uniquely identify a person? If yes, Art. 9 GDPR applies and a legitimate interest assessment alone is not a sufficient legal basis.

No biometric identification++Yes, but only with explicit consent+Yes, without separate consentBlocker

External language models and processing region *

Provider, model and data centre region of the LLM in use. A third country transfer triggers an additional section.

EU/EEA only++Third country with an adequacy decision+Third country with SCCs and a transfer impact assessment-Third country without appropriate safeguardsBlocker

Use of your data for model training *

Is your processed content used to train the AI model? Training on customer data by default constitutes a purpose of its own.

No, contractually excluded++Only after opt-in+On by default, opt-out available-On by default, no opt-outBlocker

Storage locations and data centre regions *

Physical locations of the processing, including backup regions.

Specific business purpose of the deployment *

Describe in a few sentences what you use the voice AI product for. Be concrete, not promotional.

Categories of data subjects *

Multiple selection possible. Employees and minors each trigger an additional assessment section.

Existing customers+Prospects~Employees-Minors-Vulnerable groups-Unknown third parties-

Volume of processing *

Estimated number of operations per month and distinct data subjects per year.

Direction of communication *

Inbound means calls to you, outbound means calls from you to data subjects. Outbound triggers an additional check under national direct marketing rules.

Inbound (the data subject calls you)+Outbound (you call the data subject)-Both~

Purpose test

The specific legitimate interest you pursue with the processing.

The specific legitimate interest pursued *

Specific, present and real. Not "improvement" or "innovation", but the actual business concern.

Recognition in the GDPR or sector-specific law *

Recitals 47 to 49 GDPR name explicit examples: direct marketing, fraud prevention, network and information security, intra-group administration.

IT and network security (Recital 49)++Fraud prevention (Recital 47)++Direct marketing to existing customers (Recital 47)+Intra-group administration (Recital 48)+Research, statistics+None of the above-

Beneficiaries of the processing *

Who benefits directly: the controller, the data subject, third parties, the public. A benefit for the data subject themselves strengthens the balancing test.

The data subject as well++The public+The controller and third parties~The controller only-

Additional legal framework

For example anti-money-laundering, financial supervision or IT security obligations. Such duties support the legitimate interest.

Temporal and geographic dimension *

One-off, recurring or permanent processing. Regional limitations.

Weight of the expected benefit *

How significant is the benefit of the processing? Choose a rating and support it, for example with metrics, studies or documented experience. A slight benefit tends to shift the balance towards the interests of the data subjects.

Substantial, with metrics or evidence++Moderate~Slight-

Consequences of not processing *

What would actually happen if the processing could not be carried out? Consider the effects on the controller, on data subjects and on third parties separately.

Ethical acceptability *

Beyond mere lawfulness, are there ethical concerns, for example regarding discrimination, manipulation or asymmetry of power? Describe the countermeasures.

Necessity test

Why the processing is necessary to achieve the purpose, not merely useful.

Justification of necessity *

Why is the deployment necessary to achieve the purpose rather than merely useful? "Convenient is not necessary."

Less intrusive alternatives considered *

Name concrete alternatives: a human service agent, a classic IVR without AI, a web form, a chatbot without speech processing.

Why the alternatives are not sufficient *

Show why the alternatives do not achieve the purpose to a comparable standard.

Features enabled and disabled *

Data minimisation under Art. 5(1)(c) GDPR. Only enable features that the purpose requires.

Only the minimum the purpose requires++The vendor default configuration~All optional features enabled-

Retention of the audio recordings *

How long does the original audio recording of the call remain stored? This covers the raw audio only - transcripts and metadata are not in scope here. The shorter the retention, the less intrusive the processing.

No storage - audio is processed transiently for transcription and discarded afterwards++Short term (up to 30 days)+Medium term (up to 6 months)~Long term (up to 24 months)-Indefinite or longer than 24 months-

Optional: Pseudonymisation and anonymisation

Is data pseudonymised or fully anonymised once the purpose is fulfilled? Rarely implemented in practice - if you do it, it counts in your favour in the balancing test.

Yes, once the purpose is fulfilled++Partially (certain fields)+No~

Fairness of the approach *

Is the way you achieve the purpose fair towards the data subjects? Is your benefit proportionate to the restriction imposed on them?

Fair and balanced++Partly fair~Not fairBlocker

Balancing test

How your interest relates to the rights and interests of the data subjects.

Nature and sensitivity of the data *

Flag special categories (Art. 9), criminal conviction data (Art. 10) or data relating to vulnerable individuals.

Not sensitive, no Art. 9 or 10 data++Personal data, no special category~Special categories (Art. 9)-Criminal conviction data (Art. 10)-

Sensitive inferences drawn from the voice *

Voice and manner of speaking can support inferences about health, origin, emotional state or age. This increases the intrusiveness of the processing.

Vulnerable individuals affected *

Minors, people who are ill, elderly or otherwise in need of protection increase the weight of the data subjects' interests.

No++Occasionally possible~Regularly-

Transparency before the call *

How are data subjects informed before the processing begins - by an announcement during the call, by a privacy notice on the website, or not at all.

Announcement plus privacy notice++Announcement during the call++Privacy notice on the website++No specific information~

Willingness to explain openly *

Would you be willing to explain the actual processing openly, without softening the wording? Would a reasonably informed person accept that explanation as appropriate? This self-check surfaces processing that may be lawful but is not communicable.

Yes, without reservation++Yes, with an explanation of the customer benefit+Probably not, explaining it would be difficult-No, the details should not be disclosedBlocker

Reasonable expectations in this context *

Would data subjects expect an AI system to be used in this situation?

Expected in this context++Partly expected~Not expected-

Likelihood of objections and complaints *

How likely do you consider it that data subjects will object, complain or perceive the processing as intrusive? Support your estimate.

Low++Moderate~High-Very high-

Nature of the relationship with the data subject *

How is the relationship structured: existing customer, prospect, employee, unknown third party or a public relationship? An existing contractual relationship strengthens reasonable expectations considerably.

Existing customer, long-term relationship++Prospect in active discussions+Employment relationship-Unknown third party-Public relationship (e.g. press, public authority)~

Possible adverse consequences *

For example misclassification, risk of discrimination, exclusion from a service, financial disadvantage.

None of substance++Minor (inconvenience)+Moderate (financial disadvantage)-Severe (exclusion, discrimination)Blocker

Likelihood and severity *

Assess both dimensions together - likelihood and severity combine into the overall level of risk.

Low x low++Low x moderate or moderate x low+Moderate x moderate~High x moderate or moderate x high-High x highBlocker

Solely automated decision-making *

Does the system make decisions with legal or similarly significant effect without substantive human review? Art. 22(1) GDPR needs to be assessed.

No, no automated decision is made++No, only with substantive human review+Yes, solely automatedBlocker

How human oversight is set up *

Depth of review, override rate, qualification of the reviewers. Routinely rubber-stamping the model output is not enough (CJEU C-634/21).

Legal basis and safeguards under Art. 22(2) and (3) *

Where automated decision-making is permitted: the legal basis plus the right to human intervention, to express a point of view and to contest the decision.

Employment context

Involvement of the works council or staff council *

For employee data, co-determination requirements must be assessed. A works agreement can become a legal basis in its own right.

A works agreement is in place++Works council informed and involved+Information only, no involvement-Not assessedBlocker

Exclusion of performance and behaviour monitoring *

Is any assessment of individual performance or individual behaviour excluded, or documented as limited?

Excluded, limited by technical means++Limited and documented+Not excluded-

Safeguards

Technical and organisational measures you have put in place.

Encryption *

Methods used at rest and in transit.

At rest and in transit++In transit only-NoneBlocker

Access controls *

Role-based access control, multi-factor authentication, single sign-on.

RBAC, MFA and SSO++RBAC and MFA+Role-based only~Password only-

Logging and auditability *

Event log, tamper resistance, retention period.

Tamper-resistant log kept for at least 12 months++Standard log+No logging-

Model governance *

Monitoring for bias and accuracy, model cards, version pinning.

Bias monitoring, model card, version pinning++Partly established+Not established-

Evidence of the security level *

External evidence of an established security management system. Alongside classic certifications (ISO 27001, SOC 2, BSI C5) this includes sectoral supervision (telecoms regulators, financial supervision, critical infrastructure regimes) and industry-specific evidence (PCI DSS SAQ for payment data, TISAX) - what counts is the actual density of controls, not the certificate itself.

ISO 27001, SOC 2, BSI C5++ISO 27001 or SOC 2+Regulatory supervision and industry evidence (e.g. telecoms regulator, PCI DSS SAQ, critical infrastructure regime, TISAX)+None~

Transfer mechanism for third country transfers *

Standard contractual clauses, adequacy decision, binding corporate rules. Plus a transfer impact assessment.

Not applicable, no transfer++Adequacy decision+SCCs plus a transfer impact assessment~SCCs without a transfer impact assessment-No safeguardsBlocker

Optional: Organisational measures at the controller

Role assignment, training, internal processes, four-eyes principle.

Handling of data subject rights *

Processes for access, rectification, erasure, restriction and data portability.

Processes established for all rights++Processes for the core rights+Handled ad hoc-

Objection process under Art. 21 GDPR *

Channel, response deadline, documentation duty. For direct marketing the right to object is unconditional.

Established, documented, low-threshold++Defined but rarely used+No established process-

Erasure concept *

Criteria for erasure once the purpose falls away, technical implementation, demonstrability.

Documented and automated++Documented, triggered manually+Informal~None-

Mention in the privacy notice *

Is this specific legitimate interest assessment named in your public privacy notice, or linked as a document? Public mention strengthens reasonable expectations and is viewed favourably by supervisory authorities.

Yes, summarised in the notice and the LIA linked++Yes, named in the privacy notice+Internally in the RoPA only~Not documented so far-

Outcome

Your final assessment and the conditions you impose on yourself.

Overall assessment *

Summarise the balancing test and justify the outcome in a few sentences.

Outcome of the assessment *

The formal decision on whether legitimate interest holds as a legal basis.

Sustainable~Sustainable subject to conditions~Not sustainable~

Optional: Conditions and requirements

Concrete measures to be implemented before or during the processing.

Next review date *

Recommended: routinely after twelve months, or whenever there is a trigger.

Optional: Events triggering an early re-assessment

For example a change of model, activation of new features, changed categories of data subjects.

Review before completion

Check every entry and answer each question truthfully. An inaccurate statement will not survive scrutiny by a supervisory authority and renders the record worthless.

Billing details

Check your email