The DPIA must be carried out if an individual processing operation poses a high risk to data subjects’ rights. Within this framework, a precise analysis of the risks involved and a balancing of the interests of the data subjects with the interests for processing takes place. If the interests of the data subject prevail, the processing must be stopped or further measures must be taken to reduce the risk accordingly. The DPIA is also subject so strict documenation rules. The risk check is carried out upstream and is intended to check which risks actually exist in the company, which measures should be linked to them and which have already been implemented in the company.