GDPR Article 35(1): data protection impact assessment (Regulation (EU) 2016/679, Art 35(1))
Bulk disclosure of conversations, recordings and email to an AI buyer is new-technology processing at scale and will often need an impact assessment before it starts. The Irish regulator listed one among the papers it required from Meta.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.”
Where it was read
Also read from the same source
- GDPR Article 5(1)(b): purpose limitation (Regulation (EU) 2016/679, Art 5(1)(b))
- GDPR Article 6(1)(f): legitimate interests as a lawful basis (Regulation (EU) 2016/679, Art 6(1)(f))
- GDPR Article 6(4): compatibility test for a new purpose (Regulation (EU) 2016/679, Art 6(4))
- GDPR Recital 50: further processing and the legal basis (Regulation (EU) 2016/679, recital 50)
- GDPR Article 9(1): special categories of personal data (Regulation (EU) 2016/679, Art 9(1))
- GDPR Article 13(3): telling people before a new purpose (Regulation (EU) 2016/679, Art 13(3))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide