Data Protection Impact Assessment, a structured analysis required for high-risk processing of personal data.
A Data Protection Impact Assessment (Article 35 GDPR) is mandatory when processing is likely to result in a high risk to the rights and freedoms of natural persons, including systematic large-scale processing of special category data, large-scale monitoring of public areas, or use of new technologies. A DPIA must describe the processing, assess necessity and proportionality, identify risks, and document mitigation measures. KVKK has parallel guidance for high-risk processing.
Türkiye's Personal Data Protection Law (Law No. 6698), the national data protection regime supervised by KVKK Authority.
EU General Data Protection Regulation 2016/679, the primary data protection law for the European Economic Area.
The natural or legal person who, alone or jointly, determines the purposes and means of processing personal data.