Privacy Impact Assessment

Data Protection Impact Assessment. A Data Protection Impact Assessment (DPIA) shall be conducted prior to the commencement of any processing activity that is likely to result in a high risk to the rights and freedoms of natural persons, as required by Article 35 of the GDPR. A DPIA is required in particular where the processing involves: (a) systematic and extensive evaluation of personal aspects relating to natural persons based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect the data subjects; (b) processing on a large scale of special categories of data referred to in Article 9(1) or data relating to criminal convictions and offences referred to in Article 10; or (c) systematic monitoring of a publicly accessible area on a large scale. The DPIA shall contain at a minimum: a systematic description of the processing operations and their purposes, an assessment of the necessity and proportionality of the processing, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address those risks. Where the DPIA indicates that the processing would result in a high risk in the absence of mitigation measures, the Controller shall consult with the supervisory authority prior to processing.