Mandatory GDPR risk assessment for processing likely to result in a high risk to data subjects (Art. 35).
A Data Protection Impact Assessment is a structured assessment required under GDPR Art. 35 when processing — particularly new technology — is likely to result in a high risk to the rights and freedoms of natural persons. EDPB lists nine criteria; meeting any two triggers DPIA.
Run a free ComplianceIQ audit against GDPR and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.