EDPB Guidelines on DPIA

Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679

The document outlines guidelines for conducting a Data Protection Impact Assessment (DPIA) under the GDPR. It details the DPIA process, including when and how it should be conducted, who is responsible, the methodology to follow, and conditions under which the supervisory authority should be consulted. The document concludes with recommendations and includes annexes with examples of existing EU DPIA frameworks and criteria for an acceptable DPIA.