NIST Privacy Framework, Identify-PID.RA-P4

From two years after the law's publication in the Official Gazette, carry out a data protection impact assessment before processing likely to result in a high risk to the rights and freedoms of a person in Albania, and seek the Commissioner's opinion in advance where the risk cannot be mitigated; until then, Articles 31 and 32 do not themselves bind.

Carry out a data protection impact assessment before high-risk processing such as systematic automated evaluation with legal effects, large-scale special-category processing, or large-scale systematic monitoring of a publicly accessible area, and consult the Agency first where the assessment shows a risk you have not mitigated.

Carry out a data protection impact assessment before any type of processing, in particular using new technologies, that is likely to result in a high risk to the rights and freedoms of an individual, taking the advice of the data privacy officer where one is designated, and consult the Commissioner beforehand where the assessment shows a high risk.

Carry out a data protection impact assessment before a processing likely to create a high risk to individuals' rights and freedoms, and consult the Autorité first where the assessment shows a risk you cannot mitigate.

Carry out a data protection impact assessment under Article 37 before processing likely to result in a high risk to a person's rights and freedoms, and consult the Agency in advance under Article 38 wherever the assessment shows a high risk the controller cannot mitigate.

Carry out a data protection impact assessment before processing that is likely to result in a high risk to a natural person's rights and freedoms, and designate a data protection officer where your core activities require regular and systematic large-scale monitoring, or large-scale processing of sensitive personal data or of data relating to criminal convictions and offences.

Before you start processing, and before you notify it to the CNPD, carry out an impact assessment of the envisaged operations on the protection of personal data if the processing, in particular using new technologies, is likely to result in a high risk to individuals' rights and freedoms (Article 29(1)).

Carry out the assessment in particular for a systematic and extensive evaluation of personal aspects of individuals based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; for large-scale processing of the special categories of data in Article 8(1) or of data on criminal convictions and offences in Article 11; and for large-scale systematic monitoring of publicly accessible areas (Article 29(2)).

A data controller that determines its processing may pose a high risk to a data subject's rights and freedoms must conduct a personal data impact assessment and submit its report to the Ministry of Post and Telecommunications.

Weigh whether processing personal data in an artificial intelligence system is suitable to the goal pursued, necessary because no less intrusive measure achieves it equally well, reasonable because it serves a constitutional purpose, and proportionate because its benefits are not outweighed by the harm to the right to data protection.

Complete and document a privacy impact assessment before an artificial intelligence system likely to pose a high risk to data subjects processes their personal data, covering the processing operations, a risk evaluation, and the measures planned to prevent the risks identified.

Carry out a data protection impact assessment before processing likely to create a high risk to individuals' rights and freedoms, and consult the Data Protection Authority in advance where that assessment shows a high risk you have not sufficiently mitigated.

If you offer an online service, product, or feature that you actually know or willfully disregard is used by a minor, use reasonable care to avoid a heightened risk of harm to that minor, and complete a data protection assessment where that risk exists.

Prepare an internal annual risk assessment of the use of targeting techniques or ad-delivery techniques on fundamental rights and freedoms, and make its results publicly available (Article 19(1)(d)).

Conduct a data protection impact assessment before processing special categories of personal data, including biometric data, of persons in Lithuania on a large scale, under GDPR Article 35(3)(b).

Apply the measures Article 181-3 lists: a data protection officer, impact assessments, anonymization, pseudonymization or functional separation, encryption in transit with state-of-the-art key management, access restrictions, logging of the reason, date, time and person for each access, staff awareness, regular independent audit, sectoral codes of conduct and an internal policy on the principles of GDPR Article 5 (Article 181-3, paragraph 1, point 2).

Document those parameters and file them with the Commission as part of your Compliance Audit Returns, with an impact assessment that weighs disparate outcomes of the processing and the Data Subjects' Vulnerability Indexes in Schedule 6.

As a health information network provider, assess the threats, vulnerabilities and risks to the security and integrity of the information and how your services may affect the privacy of the individuals concerned, and give each custodian a written copy of the results.

Perform a Data Protection Impact Assessment before large-scale processing of biometric or other sensitive personal data, or before systematic large-scale public-space monitoring, under FADP Article 22.

Conduct regular data protection impact assessments to identify and mitigate privacy risks to children, and ensure data protection by design and by default when processing children's data.

Applies to a business providing an online service, product or feature likely to be accessed by children under 18. Complete data protection impact assessments.

Before making a new or substantially modified companion chatbot available, perform and document a comprehensive risk assessment of covered harms to child users, and take and document measures that reasonably mitigate the child safety risks it identifies.

Conduct data protection assessments.

Complete data protection impact assessments.

Carry out periodic assessments of the risks that design, features, recommender systems, user interaction and service characteristics pose to children and adolescents, adopt reasonable measures to prevent or mitigate them, and share statistical reports on the patterns detected in Article 3 content with the competent authorities periodically (Article 4, item IX).

Complete a data protection assessment for offerings that pose such a risk to minors.

Complete a data protection assessment for any processing activity that presents a heightened risk of harm to consumers, including minors.

Before transferring special categories of personal data of a person in Cyprus to a third country on Article 46 safeguards or binding corporate rules, inform the Commissioner of your intention, and before relying on an Article 49 derogation for such a transfer, carry out an impact assessment and consult the Commissioner, under Law 125(I)/2018 Articles 17 and 18.

The Parties document the assessment under Clause 14(b) and make it available to the competent supervisory authority on request (Clause 14(d)).

Before communicating personal information outside Québec, or having a person or body outside Québec collect, use, communicate or keep it on your behalf, conduct a privacy impact assessment covering the information's sensitivity, its intended use, available protection measures including contractual ones, and the destination's legal framework.

An app transferring the personal data of an individual in Vietnam, including biometric data, to a recipient outside the country must prepare a cross-border transfer impact assessment dossier and send it to the specialized personal data protection agency within 60 days of the first transfer; a violation risks a fine of up to 5 percent of the organization's prior-year revenue, a materially higher tier than the Law's general penalty.

Complete a personal-information-protection impact assessment before deploying automated decision-making, and keep the assessment report and the processing record for at least three years.

Before you restrict, in whole or in part, a person's rights under GDPR Articles 12, 18, 19 or 20 in Cyprus on a ground in GDPR Article 23(1), carry out an impact assessment and consult the Commissioner, and tell the person about the restriction, under Law 125(I)/2018 Article 11.

Before developing an AI system that will process personal data, carry out a risk-management process and, where applicable, an impact assessment.

Conduct and document a data protection assessment before targeted advertising, sale of personal data, certain profiling, or sensitive-data processing.

Run a data protection impact assessment and document why a less intrusive alternative was rejected before deploying a biometric access-control system for employees or building access in France.

Obtain a GDPR Article 9(2) basis, with weighty grounds, and complete a data protection impact assessment before deploying a biometric identification system in Sweden.

Before processing biometric data, such as fingerprint data or facial or voice recognition used to identify a person, carry out a data protection impact assessment.

Have completed your children's risk assessment by 24 July 2025.

Carry out a children's risk assessment.

The Commission says that, in line with section 34 of the Data Protection Act 2017, you must conduct a Data Protection Impact Assessment before implementing any AI system likely to present a high risk to the rights and freedoms of data subjects.

Conduct a data protection impact assessment before undertaking automated decision-making or profiling that has a legal or similarly significant effect on a data subject.

Conduct a prior data protection impact assessment and a prior consultation procedure under Articles 35 and 36 of Regulation (EU) 2016/679 for any specific technology you use for these purposes (Article 3(1), point (c)). Until 1 April 2027 this does not apply to a provider that was using a specific technology before 31 July 2026 without having completed a prior consultation procedure, starts one before 1 September 2026 and duly cooperates with the competent supervisory authority (Article 3(2)).

If you are an operator of essential services, a digital service provider or a local government organization using such devices, use them in accordance with the technical security specifications, appoint an Internet of Things Security Officer, keep a register of the devices you use and update it annually, suspend use of a device that presents a risk, and carry out a data protection impact assessment of the related processing (Articles 35, 37(2), 38 and 41(2)).