Complete a Data Protection Impact Assessment before: Before the processing begins, which GDPR controller

Systematic large-scale profiling with significant effects triggers a mandatory DPIA that must be completed before the processing begins.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. Notify the supervisory authority about the profiling as a reportable breach within 72 hours.

   Plausible but wrong: the 72-hour notification applies to a personal data breach, not to launching lawful high-risk profiling.
2. Put standard contractual clauses in place to render the profiling activity lawful.

   Plausible but wrong: standard contractual clauses safeguard international data transfers; they do not authorize domestic profiling.
3. Complete a Data Protection Impact Assessment before the profiling processing starts. ✓

   Correct: systematic, extensive profiling with legal or significant effects is a mandatory DPIA trigger, and the DPIA must be carried out prior to the processing.
4. Appoint an EU representative to receive and manage all data-subject access requests.

   Plausible but wrong: appointing an EU representative addresses controllers established outside the EU, which is unrelated to the DPIA trigger described.

How to remember it

Systematic large-scale profiling with significant effects triggers a mandatory DPIA that must be completed before the processing begins.

More Understanding How Laws, Standards and Frameworks Apply to AI questions

• Retain only data needed for the defined purpose: Which measure best satisfies those requirements here? →
• Facial templates are biometric special-category data: Which characterization of this processing under GDPR is →
• Copyright can bar using protected works as training data: Which of the following is an example of how →
• All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →