A data protection impact assessment, also known as a privacy impact assessment, is a process for building and demonstrating compliance with the GDPR. It has to be run on any processing activity that has a high risk of infringing a natural person’s rights and freedoms. Examples of high risk processing set out in the GDPR include (1) systematic and extensive processing activities, including profiling and where decisions have legal effects - or similarly significant effects - on individuals; (2) large scale processing of special categories of or criminal convictions or offence details; or (3) large scale, systematic monitoring of public areas (e.g. CCTV)