Recital 90
EU GDPR

(90) In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk.

That impact assessment should include, in particular, the measures, safeguards and mechanisms envisaged for mitigating that risk, ensuring the protection of personal data and demonstrating compliance with this Regulation.
=> Dossier: Data Protection Impact Assessment, Data Protection Guarantee, Risk For Rights And Freedoms

NEW: The practical guide PrivazyPlan® explains all dataprotection obligations and helps you to be compliant. Click here!