Impact assessment: required if the risk to the person is high

Article 22 FADP requires a data-protection impact assessment when the intended processing is likely to result in a high risk to personality or fundamental rights. That includes extensive processing of sensitive data or high-risk profiling. The assessment describes the processing, the risks and the measures. If the risk remains high, the controller consults the FDPIC before starting. An SME that keeps only an ordinary client file does not automatically have this duty.