1 Comment

If you want to comment on this post, you need to login.

• comment Stuart Thomas CIPP/E • Oct 13, 2018

  If you read the other EDPB notices, it has said the same to most of the EU Supervisory Authorities. And in any case, DPIA's are relatively easy to do, and to have a record of no-harm, is probably a good risk management approach anyway; ethically, it not legally - some projects might not be of high risk, but are weakened by a lack of good security controls - which could be unpicked from a DPIA - which without could undermining other IT or processing environments where there are a large amounts of sensitive personal information.