According to Art. 35 of the GDPR there should always be a Data Protection Impact Assessment (DPIA), if there is a potential elevated risk during data processing operations due to the kind, the scope, the circumstances, and the goals of the data processing. A DPIA expertly analyses the protection risks to personal data before the data is processed, which has very extensive requirements for complex processes.