# Data protection impact assessment 35(7) — GDPR — provision context

> Focused context for a single provision (35(7)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-35#par-7
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Data protection impact assessment** (GDPR, full article: https://overview.legal/laws/gdpr/art-35).

## Provision text

### 35(7)

The assessment shall contain at least:

a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;
b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes;
c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and
d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.

## Cited by (exact-provision citations)

- **BVwG - W258 2227269-1/39E** (case-law) — https://overview.legal/posts/184564
- **EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro** (guidance) — https://overview.legal/posts/125823

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-35#par-7 · 2026-08-22