Set by the law · GDPR Art. 35(1)
Data protection impact assessment
In plain English
An assessment a controller must carry out before starting processing that is likely to result in a high risk to people's rights and freedoms, especially when new technologies are used.
The official text
Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
125 decisions on Fino cite Article 35 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.