Data protection impact assessment (DPIA)
Art. 35
-
Last updated
Applicable
Catalog reference
Before starting processing likely to result in a high risk to people's rights and freedoms (e.g. large-scale systematic monitoring, large-scale special-category processing, or use required by a supervisory authority's Art. 35(4) list), carry out a DPIA describing the processing, assessing necessity and proportionality, and identifying risks and mitigations. Decide this in only if you run processing that meets the high-risk threshold.
Narrative — how we satisfy this requirement
An impact assessment template exists and is used for new high-risk services, and the finished assessments are still being added to the register.