# Standards and References

## GDPR Art. 35(1), (3)-(5)
- Art. 35(1): DPIA required for processing likely to result in high risk using new technologies.
- Art. 35(3)(a)-(c): Mandatory DPIA triggers.
- Art. 35(4)-(5): National SA DPIA required/not required lists.

## EDPB WP248rev.01
- Nine criteria for identifying high-risk processing.
- Two or more criteria presumptively require a DPIA.

## National SA DPIA Lists
- CNIL: 14 processing types (Deliberation 2018-327).
- ICO: 10 processing types.
- BfDI: Processing types including biometric identification and scoring.