Before likely high-risk processing, the Controller must conduct a DPIA covering the proposed operations, necessity, proportionality, risks and safeguards, and consult the Commissioner where residual high risk remains.
Interpretation and application must be checked against the official text and current version.