A school plans a new lobby system that uses facial recognition to log visitor entry on an ongoing basis. Which accountability action is most clearly indicated before go-live?

Article 35 requires a DPIA where processing is likely to result in a high risk, including systematic monitoring and large-scale processing of special categories such as biometric data used for identification. Schools are not exempt from DPIA duties merely by being educational bodies. Vendor marketing materials do not replace the controller’s assessment. Biometric identification data are special category under Article 9, not ordinary contact fields.