How to decide if DPIA is needed?

A Data Protection Impact Assessment (DPIA) is required when data processing is likely to pose high risks to individuals’ rights.

Triggers include:

• Large-scale monitoring or profiling
  
• Processing sensitive personal data
  
• Using new technology
  
• Systematic tracking of individuals
  

If in doubt, conduct a risk screening against regulatory checklists.

A DPIA is required when processing could significantly affect people’s rights or freedoms.