Complete a Data Protection Impact Assessment before: Before the processing begins, which GDPR controller

Systematic large-scale profiling with significant effects triggers a mandatory DPIA that must be completed before the processing begins.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. Notify the supervisory authority about the profiling as a reportable breach within 72 hours.

   Plausible but wrong: the 72-hour notification applies to a personal data breach, not to launching lawful high-risk profiling.
2. Put standard contractual clauses in place to render the profiling activity lawful.

   Plausible but wrong: standard contractual clauses safeguard international data transfers; they do not authorize domestic profiling.
3. Complete a Data Protection Impact Assessment before the profiling processing starts. ✓

   Correct: systematic, extensive profiling with legal or significant effects is a mandatory DPIA trigger, and the DPIA must be carried out prior to the processing.
4. Appoint an EU representative to receive and manage all data-subject access requests.

   Plausible but wrong: appointing an EU representative addresses controllers established outside the EU, which is unrelated to the DPIA trigger described.

How to remember it

Systematic large-scale profiling with significant effects triggers a mandatory DPIA that must be completed before the processing begins.

More Understanding How Laws, Standards and Frameworks Apply to AI questions

• Inclusive growth: Which of the following is one of the OECD's five values-based principles for trustworthy AI? →
• Product liability law: Which body of law most directly addresses the manufacturer's responsibility for that →
• A cap set at a fixed euro sum or a share of global annual: How are administrative fines generally structured →
• All 125 Understanding How Laws, Standards and Frameworks Apply to AI questions →