{"id":19743,"date":"2025-12-23T08:00:43","date_gmt":"2025-12-23T08:00:43","guid":{"rendered":"https:\/\/letslaw.es\/?p=19743"},"modified":"2025-12-17T16:16:17","modified_gmt":"2025-12-17T16:16:17","slug":"big-data-impact-assessment","status":"publish","type":"post","link":"https:\/\/letslaw.es\/en\/big-data-impact-assessment\/","title":{"rendered":"Do you work with Big Data? How to conduct an impact assessment"},"content":{"rendered":"

The General Data Protection Regulation (GDPR), in force since 25 May 2018, introduced the obligation to carry out a Data Protection Impact Assessment (DPIA)<\/strong> for processing operations that may entail a high risk to the rights and freedoms of individuals.<\/p>\n

Any company or ecommerce platform that processes personal data should understand what this preventive analysis involves and when it is mandatory. At LETSLAW, we have previously addressed the key aspects of DPIAs, and today we update this information in light of the most recent European and national regulatory developments.<\/p>\n

The European Data Protection Board (EDPB) (formerly the Article 29 Working Party) has issued several guidelines interpreting the GDPR and setting out practical criteria on when a DPIA should be carried out and what it should include<\/strong>. Moreover, recent European regulations on Artificial Intelligence and data governance have reinforced its relevance in Big Data and automation environments.<\/p>\n

Privacy risks in Big Data<\/h2>\n

Big Data involves the large-scale, continuous, and automated processing of massive amounts of information<\/strong>, often using predictive analytics, profiling, or artificial intelligence techniques. These processing activities can seriously compromise privacy if their risks are not properly assessed.<\/p>\n

Article 35 of the GDPR establishes that a DPIA must be carried out whenever processing operations are \u201clikely to result in a high risk to the rights and freedoms of natural persons.\u201d There are three specific scenarios in which this obligation always applies:<\/p>\n

    \n
  1. Large-scale processing of sensitive data<\/strong>, such as health, political beliefs, sexual orientation, or biometric data.<\/li>\n
  2. Systematic large-scale monitoring<\/strong> of publicly accessible areas.<\/li>\n
  3. Automated evaluations or decisions producing legal or similarly significant effects<\/strong> on individuals (for example, profiling or credit scoring systems).<\/li>\n<\/ol>\n

     <\/p>\n

    The GDPR also clarifies that this list is not exhaustive. Any processing operation that poses significant risks must be evaluated.<\/p>\n

    The EDPB and the Spanish Data Protection Authority (AEPD) identify several criteria that help determine when a processing activity is considered high-risk<\/strong>, including:<\/p>\n