# Standards and Regulatory References

## Primary Legislation

### GDPR Article 35 — Data Protection Impact Assessment

- **Art. 35(1)**: Where processing, in particular using new technologies, is likely to result in a high risk to rights and freedoms of natural persons, the controller shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data prior to processing.
- **Art. 35(2)**: Controller shall seek the advice of the DPO where designated when carrying out a DPIA.
- **Art. 35(3)**: DPIA is required in particular in the case of: (a) systematic and extensive evaluation of personal aspects based on automated processing including profiling producing legal or similarly significant effects; (b) processing on a large scale of special categories of data (Art. 9(1)) or data relating to criminal convictions and offences (Art. 10); (c) systematic monitoring of a publicly accessible area on a large scale.
- **Art. 35(4)**: Supervisory authority shall establish and make public a list of the kind of processing operations which are subject to the requirement for a DPIA.
- **Art. 35(5)**: Supervisory authority may also establish a list of processing operations for which no DPIA is required.
- **Art. 35(6)**: Prior to adoption of Art. 35(4)-(5) lists, the competent supervisory authority shall apply the consistency mechanism referred to in Art. 63 where such lists involve processing activities related to goods or services offered to data subjects in several Member States.
- **Art. 35(7)**: The assessment shall contain at least: (a) systematic description of envisaged processing operations and purposes including legitimate interest pursued by controller; (b) assessment of necessity and proportionality of processing in relation to purposes; (c) assessment of risks to rights and freedoms of data subjects; (d) measures envisaged to address risks including safeguards, security measures, and mechanisms to ensure protection and demonstrate compliance.
- **Art. 35(8)**: Compliance with approved codes of conduct under Art. 40 by relevant controllers or processors shall be taken into account in assessing the impact of processing.
- **Art. 35(9)**: Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing.
- **Art. 35(10)**: Where processing pursuant to Art. 6(1)(c) or (e) has a legal basis in Union or Member State law, that law regulates the specific processing operation, and a DPIA has already been carried out as part of a general impact assessment in the context of the adoption of that legal basis, paragraphs 1-7 shall not apply unless Member States deem it necessary.
- **Art. 35(11)**: Where necessary, the controller shall carry out a review to assess if processing is performed in accordance with the DPIA at least when there is a change in the risk represented by processing operations.

### GDPR Article 36 — Prior Consultation

- **Art. 36(1)**: Controller shall consult the supervisory authority prior to processing where DPIA under Art. 35 indicates processing would result in high risk in the absence of measures taken by the controller to mitigate the risk.
- **Art. 36(2)**: Where the supervisory authority is of the opinion that intended processing would infringe the Regulation, it shall within a period of up to 8 weeks (extendable by 6 weeks) provide written advice to the controller.
- **Art. 36(3)**: The controller shall provide the supervisory authority with the DPIA, the respective responsibilities of controller and processors, measures and safeguards, DPO contact details, and any other information requested.

## EDPB and WP29 Guidance

### WP248rev.01 — Guidelines on Data Protection Impact Assessment (Adopted 4 April 2017, Revised 4 October 2017)

Key provisions:
- **Section II**: Established the nine criteria for determining whether processing is "likely to result in high risk": evaluation/scoring, automated decision-making with legal/significant effect, systematic monitoring, sensitive data, large scale, matching/combining datasets, vulnerable data subjects, innovative use of technology, processing preventing exercise of rights.
- **Section III**: Recommended that if processing meets two or more of the nine criteria, a DPIA should be carried out.
- **Section IV**: Clarified that "new technologies" should be interpreted broadly and that the novelty of a technology can contribute to risk.
- **Annex 1**: Published European DPIA criteria list adopted under the consistency mechanism.
- **Annex 2**: Provided DPIA criteria mapped to existing EDPB frameworks.

### EDPB Opinion 5/2018 — Art. 35(4) Lists

- EDPB reviewed and issued opinions on national supervisory authority DPIA lists to ensure consistency across the EEA.
- Established common baseline processing types requiring DPIA across Member States.

## National Supervisory Authority DPIA Lists

### CNIL (France) — Deliberation No. 2018-327 (11 October 2018)
14 processing types requiring DPIA including:
- Health data for patient management across multiple care establishments
- Profiling generating legal or similarly significant effects
- Systematic employee monitoring (productivity, keystroke, screen capture)
- Large-scale biometric data processing for identification
- Genetic data processing outside of healthcare
- Location data collection on a large scale

### ICO (United Kingdom) — DPIA Required List (2018)
10 processing types requiring DPIA including:
- Innovative technology combined with any Art. 35(3)(a)-(c) criterion
- Denial of service based on automated decision-making
- Large-scale profiling of individuals
- Biometric data processing for identification in a public space
- Genetic data processing for purpose of healthcare
- Tracking of individuals' location or behaviour

### BfDI (Germany) — DPIA Required List (2018)
Processing types including:
- Processing of biometric data for unique identification of natural persons
- Scoring by credit reference agencies or financial institutions
- Large-scale profiling including formation of personality profiles
- Collecting personal data from third parties and merging data sets on a large scale

## ISO/IEC Standards

### ISO/IEC 29134:2023 — Guidelines for Privacy Impact Assessment
- Provides a comprehensive PIA methodology aligned with ISO 31000 risk management
- Defines PIA scope, preparation, execution, and follow-up phases
- Specifies risk criteria for privacy impact assessment
- Annex A contains a PIA report template

### ISO/IEC 27701:2019 — Privacy Information Management System
- **Section 7.2.5**: Requires the organisation to carry out privacy impact assessments for new or significantly changed processing of PII
- Maps to GDPR Art. 35 DPIA requirements

### ISO 31000:2018 — Risk Management
- Provides the foundational risk management framework referenced by DPIA methodologies
- Risk assessment process: risk identification, risk analysis, risk evaluation
- Risk treatment options: avoid, modify, share, retain

## Enforcement Decisions

- **Karolinska Institute (Swedish DPA, DI-2019-2262, 2019)**: SEK 200,000 administrative fine for failing to conduct DPIA before processing sensitive genetic research data, violating Art. 35(1).
- **Austrian Post AG (Austrian DPA, DSB-D123.270/0009-DSB/2019, 2019)**: EUR 18 million fine for creating political affinity profiles of 3 million Austrian citizens without adequate DPIA and without lawful basis under Art. 35 and Art. 6.
- **Clearview AI (CNIL, SAN-2022-019, 2022)**: EUR 20 million fine for scraping biometric data from public internet sources and processing it for facial recognition without DPIA, consent, or lawful basis.
- **Real Madrid CF (AEPD, PS/00377/2022, 2023)**: Sanctioned for deploying Wi-Fi tracking technology in Santiago Bernabeu stadium without DPIA for systematic monitoring of publicly accessible area.
- **Italian DPA vs Deliveroo (2021)**: EUR 2.5 million fine for algorithmic management of riders without DPIA for automated decision-making with significant effects on workers.