# Standards and Regulatory References — RoPA-DPIA Linkage

## Primary Legislation

### GDPR Article 35 — Data Protection Impact Assessment

- **Art. 35(1)**: Where a type of processing, in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
- **Art. 35(3)**: A DPIA shall be required in particular in the following cases: (a) systematic and extensive evaluation of personal aspects based on automated processing, including profiling; (b) processing on a large scale of special categories of data under Art. 9(1) or criminal conviction data under Art. 10; (c) systematic monitoring of a publicly accessible area on a large scale.
- **Art. 35(7)**: The assessment shall contain at minimum: (a) systematic description of the processing operations and purposes, including legitimate interest; (b) assessment of necessity and proportionality; (c) assessment of risks to rights and freedoms of data subjects; (d) measures envisaged to address the risks.
- **Art. 35(11)**: Where necessary, the controller shall carry out a review to assess if processing is performed in accordance with the DPIA at least when there is a change in the risk represented by processing operations.

### GDPR Article 36 — Prior Consultation

- **Art. 36(1)**: The controller shall consult the supervisory authority prior to processing where a DPIA under Art. 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.

### GDPR Article 30 and DPIA Intersection

- **Art. 30(1)(b)**: Purposes documented in RoPA must align with purposes assessed in the DPIA (Art. 35(7)(a)).
- **Art. 30(1)(c)**: Data categories in RoPA must match the processing description in the DPIA.
- **Art. 30(1)(g)**: Security measures in RoPA should reflect the risk mitigation measures from the DPIA (Art. 35(7)(d)).

## Regulatory Guidance

### EDPB / Article 29 Working Party

- **WP29 Guidelines on DPIAs (WP 248 rev.01, adopted 4 October 2017, last revised 4 April 2018)**: Provides the nine criteria for determining whether a DPIA is required (evaluation/scoring, automated decision-making, systematic monitoring, sensitive data, large scale, matching/combining, vulnerable data subjects, innovative use/new technology, transfer outside EEA, blocking exercise of right). If two or more criteria are met, a DPIA is presumed required.
- **EDPB Guidelines 4/2019 on Article 25 (adopted 20 October 2020)**: Recommends that DPIAs and RoPA be maintained in an integrated framework, as both serve the accountability principle and share overlapping content.

### National Supervisory Authority DPIA Blacklists

Under Art. 35(4), SAs publish lists of processing operations requiring a DPIA:

- **CNIL (France)**: 14 categories requiring DPIA, published in Deliberation 2018-326. Includes employee evaluation, health data processing, biometric processing, genetic data processing.
- **ICO (United Kingdom)**: Published list including automated decision-making with legal effects, large-scale profiling, biometrics in public spaces, genetic/health data processing.
- **BfDI (Germany)**: DSK (Datenschutzkonferenz) published a common blacklist for all German SAs, including 17 processing types requiring DPIA.
- **AEPD (Spain)**: Published list in Resolution AEPD/2019/003 including automated decision-making, biometric identification, and large-scale health data processing.

## ISO/IEC Standards

- **ISO/IEC 27701:2019**: Section 7.2.5 requires privacy impact assessments. Section 7.2.8 requires processing records. The PIMS standard expects these to be cross-referenced.
- **ISO 31700-1:2023**: Section 6.5 requires privacy risk assessments integrated with processing activity documentation.