Data protection impact assessment procedure

The organization must assess whether a privacy impact assessment is needed and carry one out where appropriate whenever new processing of personal data or a change to existing processing is planned, determining the elements the assessment needs, which can include the types of personal data processed, where it is stored and where it may be transferred, supported by data flow diagrams and data maps, and recognising that some jurisdictions mandate an assessment for cases such as automated decisions with legal effect, large scale processing of special categories, or systematic large scale monitoring of public areas.

Where a type of processing, in particular using new technologies and taking account of the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data before the processing begins; a single assessment may address a set of similar operations presenting similar risks. An assessment is required in particular for systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions producing legal or similarly significant effects are based, for large scale processing of special category or criminal offence data, and for systematic monitoring of a publicly accessible area on a large scale. Seek the advice of the data protection officer where one is designated, and where appropriate seek the views of data subjects or their representatives. The assessment must contain at least a systematic description of the envisaged operations and purposes including any legitimate interest pursued, an assessment of the necessity and proportionality of the operations in relation to the purposes, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address those risks including safeguards, security measures and mechanisms to protect personal data and demonstrate compliance. Carry out a review where necessary and at least when the risk represented by the processing operations changes.

Consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate that risk. When consulting, provide the respective responsibilities of the controller, any joint controllers and the processors involved, the purposes and means of the intended processing, the measures and safeguards provided to protect the rights and freedoms of data subjects, the contact details of the data protection officer where applicable, the impact assessment itself, and any other information the authority requests. The authority has up to eight weeks to provide written advice where it considers the intended processing would infringe the Regulation, extendable by six weeks with notification of the extension and its reasons, and may use its Article 58 powers. Member State law may additionally require consultation and prior authorisation for processing carried out for a public interest task.