The Luxembourg National Data Protection Commission
(Commission nationale pour la protection des
données, CNPD) has published a list of processing
operations which require a mandatory data protection impact
assessment in accordance with article 35 of the General Data
Protection Regulation (GDPR).
What is a data protection impact assessment (DPIA)?
A DPIA represents a meaningful analysis of the impact of data
processing on the data subjects concerned (processing which is
required to be respectful of the privacy of such data subjects, in
consonance with the fundamental principles of the GDPR).
What does a list of processing operations contain?
The list put forward by the CNPD does not consist of a
comprehensive list of processing operations outside of which a DPIA
would not be necessary – it is limited to those operations
for which a data controller will necessarily need to perform a
DPIA. The requirement for a DPIA in relation to operations not
featured on the
