DPIA is a process to help identify and mitigate data protection risks that could affect the rights and freedoms of individuals. To help clarify the types of processing which could require a DPIA, the GDPR calls for the national supervisory authorities to create and publish lists of types of operations that are likely to result in a high risk.
The EDPB received 22 national lists with an overall of 260 different types of processing. The EDPB Chair, Andrea Jelinek said: “It has been an enormous task for the members of the Board as well as the EDPB Secretariat to examine all of these lists and to establish common criteria on what triggers a DPIA and what not. It was an excellent opportunity for the EDPB to test the possibilities and challenges of consistency in practice. The GDPR does not require full harmonisation or an 'EU list', but does require more consistency, which we have achieved in these 22 opinions by agreeing on a common view.”
THIS IS THE PROBLEM OF GDPR IMPLEMENTER IN A MULTINATIONAL COMPANY....
You may find the 22 national lists at https://edpb.europa.eu/search/site/DPIA_en
