When is a data protection impact assessment required?

When the processing is likely to result in a high risk to the rights and freedoms of the persons concerned – for mobile camera systems in the workplace this is regularly to be assumed.

Art. 35 GDPR expressly names the systematic monitoring of publicly accessible areas on a large scale. For a system with changing recording areas and an automated sequence, an impact assessment is indicated.

The competent supervisory authorities also keep lists of processing operations that always require an impact assessment. A look at the list for your federal state is the quickest way to clarify the matter.

How the impact assessment fits into the course of the project is set out in the guide to data protection and co-determination.