What it asks for. Where processing, especially using new technologies, is likely to result in a high risk to the rights and freedoms of individuals, the controller must carry out a data protection impact assessment before starting. The article gives examples such as systematic and extensive profiling with significant effects, large scale processing of special category data and large scale systematic monitoring of public areas, and sets out the minimum content of an assessment.
In practice. Organisations screen new projects and changes to decide whether a DPIA is needed, using supervisory authority lists of high risk processing. A good assessment describes the processing, assesses necessity and proportionality, identifies risks to individuals and records measures to address them, with advice from the data protection officer. Where high risk remains, prior consultation with the authority under Article 36 applies.
Common gaps. DPIAs are often completed after the system is built, treated as a form to fill in, or never revisited when processing changes.