If the data processing and the collected data may result in a high risk of the rights and freedom of natural persons companies need to evaluate how their processing model may affect natural persons and how to protect these processes from external threats. These impact assessments are required if the company processes (article 35):
- systematic and extensive evaluation of personal data by automated means;
- processing large scale special category data or criminal convictions and offences;
- a systematic monitoring of a publicly accessible area (ex. cameras facing a public area)
