## 3 Results
### Synergies Between DPIA and FRIA  
In the process of developing the unified DPIA--FRIA framework, it became evident that several interconnected questions feed into each other, i.e., the answer to a question in the FRIA section may directly determine the answer to a question in the DPIA framework (and vice versa). This observation in fact highlights the importance of a holistic approach in assessing the impact of AI systems. It is crucial to note though that this correlation is not absolute; the Deployer (being typically the data controller under the GDPR's provisions) needs to consider such correlations and further enhance/enrich the output she/he provides, according to the specific context of each application.  
Generally, correlations between DPIA and FRIA can be identified as follows:  
* Stakeholder responsibilities: The responsibilities outlined in DPIA concerning data processing activities will contribute to the corresponding question in FRIA that address the allocation of responsibility and accountability throughout the system's design, development, operational use, and ongoing maintenance.
* Personal data processing: Understanding whether and which personal information the AI system utilizes will provide essential details for the DPIA, enabling a clear definition of the scope and nature of personal data processing. Therefore, the relevant questions in FRIA will supply valuable information to the DPIA's question concerning the processing of personal data.
* Legal basis: The questions in DPIA that identify the lawful basis for data processing are related somehow with corresponding questions in FRIA regarding specific legislation and standards.
* Data security and privacy: the questions concerning data security and privacy in the FRIA can offer valuable insights into the DPIA regarding the preventative and mitigating measures needed to safeguard personal data. For instance, the implementation of encryption, anonymization, traceability, and logical access control alleviate risks into both DPIA and FRIA contexts.
* Contracts/agreements: The DPIA question regarding contracts, which seeks to understand how subcontractors are committed and being managed in terms of data protection practices, is relevant with the corresponding FRIA question concerning the existence of agreements or arrangements with appropriate safeguards when personal data are being processed.
* Network security: Network security questions within the FRIA part offer vital insights to the relevant queries in the DPIA part, particularly concerning network security practices and their effectiveness.
* Data anonymization and minimization: The answers to the corresponding FRIA questions may provide essential input the DPIA framework about identifying, categorizing, and addressing risks, threats, and mitigation measures.
* Logical access control: The FRIA questions regarding who has access to the system, how access rights are granted, monitored, and revoked provide feedback to the DPIArelevant questions understanding the potential risks and vulnerabilities associated with unauthorized access or misuse of personal data.
* The questions within FRIA pertaining to the effects of the AI system: The roadmap for protecting fundamental rights, mitigation measures, data quality, stakeholder responsibilities, security, privacy and system accuracy will significantly affect the responses to specific questions of the DPIA, concerning the potential threats, sources of risk, and the necessary measures to be adopted in the DPIA.  
From the aforementioned analysis, it becomes evident that there is a close relationship between FRIA and DPIA that should be utilized for a holistic approach that covers both these instruments. The following table (Table 3) provides specific information on which questions of the DPIA framework are related to which questions of the FRIA framework and how (\(\rightarrow\) means that it provides input).