Article 35(1) and 35(3) When a DPIA is required
The high-risk trigger for a DPIA, the three cases where one is always required, national lists of operations that need one, and the WP29 nine-criteria screening test.
DPIA and prior consultation
GDPR Articles 35 and 36: when a data protection impact assessment is required, what it must contain and when to review it, and consulting the supervisory authority when high risk remains after mitigation.
Article 35(7) DPIA content and review
The minimum content of a DPIA: description, necessity and proportionality, risk assessment and mitigating measures; seeking views of data subjects; publishing; and reviewing the assessment when risk changes.
Article 36 Prior consultation
Consulting the supervisory authority before processing when a DPIA shows high residual risk: what to submit, the eight-week response period and extension, and the authority's powers if processing would infringe the GDPR.
