Prior assessment of the impact that a processing operation may have on the protection of personal data. Article 35 of the GDPR requires it when the processing is likely to result in a high risk to the rights and freedoms of individuals.