A privacy team builds a shortlist of processing that likely needs a DPIA, including systematic monitoring and large-scale special-category processing. What does that shortlist correctly reflect?
Select an answer to reveal the explanation.
Short Explanation
Think of a DPIA shortlist like a fire-code checklist for risky kitchens—systematic watching of people or special-category data at scale is the grease fire waiting to happen. Those known triggers tell you when a deeper risk look is expected.
Full Explanation
A privacy team’s shortlist of processing likely needing a DPIA—including systematic monitoring and large-scale special-category processing—correctly reflects established criteria and examples indicating when a DPIA is likely required. That inventory is civic risk hygiene: it flags programmes most likely to harm individuals’ rights before launch, aligning with GDPR Article 35 and WP29/EDPB-style high-risk examples. Treating DPIAs as optional marketing brochures with no link to risk fails by emptying the tool of its purpose as a high-risk assessment duty. Claiming only payroll files under ten employees ever require a DPIA fails by inventing an arbitrary headcount rule that ignores monitoring and special-category scale criteria. Saying supervisory authorities forbid any inventory of high-risk processing types fails conceptually—authorities expect risk-based identification, and many publish DPIA blacklists/whitelists precisely to guide such inventories. Exam caveat: meeting listed criteria creates a strong presumption a DPIA is required; absence from a shortlist does not prove low risk if the concrete processing is still likely high risk. Operational check: map processing against Article 35 criteria and SA lists, schedule DPIAs before high-risk go-lives, involve the DPO, document mitigations, and revisit the shortlist when new monitoring or special-category programmes appear.