Although considered burdensome by some, data protection impact
assessments (DPIAs) help controllers assess any data protection
implications of their processing operations, with the added benefit
of demonstrating compliance with the EU General Data Protection
Regulation (GDPR). The Article 29 Working Party (WP29) recently
published Guidelines on DPIAs and on determining whether
processing is "likely to result in a high risk" for the
purposes of Regulation 2016/679 (Guidelines) to assist controllers
in implementing DPIAs. The Guidelines explain not only what should
be included in DPIAs but also, importantly, how they can be used
effectively. Rather than defining DPIAs, the GDPR states they are
required in "high risk" situations and thus the
Guidelines explain 'high risk' and specify, to the extent
possible, the circumstances in which DPIAs are mandatory. Although
the Guidelines do not provide a complete picture of how DPIAs will
work in practice, several key questions
