Recital 84
General Data Protection Regulation · UE 2016/679
| (84) | In order to enhance compliance with this Regulation where processing operations are likely to result in a high risk to the rights and freedoms of natural persons, the controller should be responsible for the carrying-out of a data protection impact assessment to evaluate, in particular, the origin, nature, particularity and severity of that risk. The outcome of the assessment should be taken into account when determining the appropriate measures to be taken in order to demonstrate that the processing of personal data complies with this Regulation. Where a data-protection impact assessment indicates that processing operations involve a high risk which the controller cannot mitigate by appropriate measures in terms of available technology and costs of implementation, a consultation of the supervisory authority should take place prior to the processing. |
In Luxembourg, the CNPD published a list of processing activities subject to mandatory DPIA (deliberation of 5 October 2018) that complements Recital 84 criteria with Luxembourg-specific cases: CSSF-regulated financial sector data, cross-border processing in the Greater Region, and profiling of posted workers. The Article 36 prior consultation must be addressed to the CNPD in Belvaux, with an investigation period of up to 8 weeks, extendable by 6 weeks.
Luxgap practice: we embed the CNPD list into the DPIA Risk Synthesizer trigger engine and prepare the prior consultation file in the format expected by the CNPD, with annexes structured according to the official grid.
