### Legal Framework
#### 1.6.3 A Comparison Between DPIA and FRIA  
Mantelero [32] emphasizes FRIA's critical role in balancing innovation with the protection of fundamental rights. The FRIA builds upon existing frameworks, such as the DPIA established by the GDPR, but it expands its scope significantly. While the DPIA primarily focuses on risks to data protection and privacy, the FRIA encompasses a broader range of fundamental rights, such as equality, freedom of expression, and non-discrimination. The FRIA shares the DPIA's ex-ante, rights-based approach to risk assessment and its iterative nature, ensuring risks are managed throughout the AI system's lifecycle. However, important differences are highlighted. The FRIA does not adopt the DPIA's reliance on data protection-specific categories and methodologies, which can obscure the broader implications for fundamental rights. Instead, the FRIA calls for a more transparent and comprehensive evaluation of rights beyond data protection. [PERSON] [32] critiques the limited attention DPIAs often give to rights other than privacy and stresses that the FRIA should address this gap by systematically evaluating all fundamental rights affected by AI systems. FRIA can be applied to AI systems, whether or not personal data are involved, and takes a multidisciplinary approach, integrating societal, ethical, and technical considerations. In contrast, DPIA primarily targets data controllers and processors, centering on compliance with GDPR requirements. European Union Agency for Fundamental Rights [33] calls for better harmonization between the two, as organizations often focus on DPIA but neglect FRIA's wider scope, which is essential for addressing the societal and ethical challenges posed by AI systems. This alignment would ensure comprehensive protection of both data protection rights and the full spectrum of fundamental rights. Table 1 below provides a comparative overview of the key differences between DPIA and FRIA. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt}} \hline \hline
**Requirement** & **DPIA** & **FRIA** \\ \hline Purpose & The purpose of the said data process as well as the relevant legal basis according to Art. 6 of the GDPR. & The purposes for which the Deployer uses the AI system. \\ \hline Description of Processing/System & Detailed description of personal data being processed, including data flows, recipients etc. & Description of the AI system’s operation, context, and intended societal or operational goals. Specific information related to the design of the AI system are also needed. \\ \hline Necessity and Proportionality & Assess whether the processing is necessary and proportional to achieve the intended purpose. & Evaluate whether the use of an AI system is necessary and whether its benefits outweigh risks to human rights. \\ \hline Risks Identified & Risks to privacy and data protection (e.g., breaches, profiling, unauthorized access, collecting excessive personal data related to the desired purposes etc.). & Risks to fundamental rights due to the use of the AI system (e.g., discrimination, bias, human dignity, and freedom of expression). Societal risks are also considered. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: DPIA And FRIA minimum information requirements.