GDPR DPIA EN - Data Protection Impact Assessment (Art. 35-36)

Philosophy

A DPIA is not a checkbox - it is a process for managing risk to the rights and freedoms of natural persons. This skill runs the process and produces a draft; the residual-risk acceptance and the go/no-go decision belong to the controller.

Step 1 - Is a DPIA REQUIRED (Art. 35(1) threshold)

Mandatory where processing is likely to result in a high risk. Three routes: