Art. 38 The national authority may determine that the controller must prepare a data protection impact assessment

Art. 38

The national authority may determine that the controller must prepare a data protection impact assessment, which shall include personal data, sensitive data, and refer to its data processing operations, pursuant to regulations, subject to commercial and industrial secrecy.

Sole paragraph. Subject to the provisions of the lead sentence of this article, the report must contain at least a description of the types of data collected, the methodology used for collection and for ensuring the security of the information, and the analysis of the controller regarding the adopted measures, safeguards and mechanisms of risk mitigation.