GDPR Recital 90 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this law. Contains: the full text of every article, recital and provision of this law. Everything links back to its source on overview.legal — legal information, not advice.

Recital 90 — data protection impact assessment requirements

DPIA Privacy Impact Assessment Controllers Accountability Personal Data
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679

In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk. That impact assessment should include, in particular, the measures, safeguards and mechanisms envisaged for mitigating that risk, ensuring the protection of personal data and demonstrating compliance with this Regulation.

Related across sources

Enforcement Italian Garante sanctions Calabrian agency for location tracking of remote workers Case Law Spanish court reviews DPA decision on KFC Spain website privacy information and DPO Enforcement Italian DPA sanctions Lusha Systems for processing contact data without consent in B2B Guidance Guidelines on processing of personal data through blockchain technologies Enforcement Italian DPA finds GDPR applies to US-based Character.AI service Enforcement Persónuvernd examines BL ehf over alleged unlawful employee monitoring via shared OneDrive