Complete a Data Protection Impact Assessment before: Before the processing begins, which GDPR controller
Systematic large-scale profiling with significant effects triggers a mandatory DPIA that must be completed before the processing begins.
The question
A bank plans a new AI system that performs systematic, large-scale profiling of loan applicants and produces decisions with significant effects on them. Before the processing begins, which GDPR controller obligation is triggered?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Notify the supervisory authority about the profiling as a reportable breach within 72 hours.Plausible but wrong: the 72-hour notification applies to a personal data breach, not to launching lawful high-risk profiling.
- Put standard contractual clauses in place to render the profiling activity lawful.Plausible but wrong: standard contractual clauses safeguard international data transfers; they do not authorize domestic profiling.
- Complete a Data Protection Impact Assessment before the profiling processing starts. ✓Correct: systematic, extensive profiling with legal or significant effects is a mandatory DPIA trigger, and the DPIA must be carried out prior to the processing.
- Appoint an EU representative to receive and manage all data-subject access requests.Plausible but wrong: appointing an EU representative addresses controllers established outside the EU, which is unrelated to the DPIA trigger described.
The trap
Confusing the pre-processing DPIA obligation with the after-the-fact 72-hour breach-notification duty. How to remember it
Systematic large-scale profiling with significant effects triggers a mandatory DPIA that must be completed before the processing begins.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- Retain only data needed for the defined purpose: Which measure best satisfies those requirements here? →
- Facial templates are biometric special-category data: Which characterization of this processing under GDPR is →
- Copyright can bar using protected works as training data: Which of the following is an example of how →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.