What the law says
The FADP requires a data protection impact assessment when processing may result in a high risk to the personality or fundamental rights of the data subjects, which depends in particular on the use of new technologies (Art. 22 paras 1 and 2 FADP). A high risk exists in particular in two cases: the large-scale processing of sensitive personal data and the systematic monitoring of extensive public areas (Art. 22 para. 2 FADP).
The GDPR adds systematic and extensive evaluations with automated decisions that produce significant effects (Art. 35 para. 3 GDPR); the European authorities use criteria such as the vulnerability of the data subjects, systematic monitoring and the combination of data. The tool counts these signs: one of the cases named in the law, or two criteria, make an assessment likely.
What an assessment contains
- a description of the planned processing;
- an assessment of the risks for the data subjects;
- the measures to protect them.
Related questions
Useful templates
General guidance, not advice on your case: for your case the text of the law is what counts, and the assessment remains yours.