When should I do an impact assessment?
The Data Protection Regulation requires an impact assessment where the processing is likely to result in a high risk to the rights and freedoms of data subjects. In the assessment of risks, it is important, among other things, to determine the purpose of processing and the nature of the data being processed, the scope and context of the processing, the number of data subjects and the technology used.
The DPIA is mandatory, for example, when personal data belonging to special categories of personal data (such as health data) are processed on a large scale or when the processing involves profiling or other similar assessment and automated decision-making.
An impact assessment is also necessary, for example, for the systematic monitoring of public spaces. In Finland, an impact assessment is also required in connection with whistleblowing systems and in certain situations when, for example, location data is processed.
