{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-11-01","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/recitals/90","url":"https://www.headlesslaw.com/gdpr/recitals/90","title":"Recital 90","family":"l1_recital_view","work_id":"gdpr","view_of":"/gdpr/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Regulation (EU) 2016/679, OJ L 119, 4.5.2016","check":{"against":"EUR-Lex","on":"2026-11-01"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","valid_from":"2016-05-04","valid_until":null,"content_id":"88f4e34e93402d5f","versions":["2016-05-04"],"version_url":"https://www.headlesslaw.com/gdpr/recitals/90/versions/2016-05-04","revision_url":"https://www.headlesslaw.com/gdpr/recitals/90/versions/2016-05-04/rev/88f4e34e93402d5f","versions_url":"https://www.headlesslaw.com/gdpr/recitals/90/versions","relations_url":"https://www.headlesslaw.com/gdpr/recitals/90/relations","act_url":"https://www.headlesslaw.com/gdpr/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"gdpr","path":"/gdpr/recitals","name":"GDPR","number":"Regulation (EU) 2016/679","celex":"32016R0679","title_official":null,"document_date":null},"position":{"kind":"recital","key":"90","index":90,"articles":173,"annexes":0},"prev":{"path":"/gdpr/recitals/89","key":"89","title":"Recital 89"},"next":{"path":"/gdpr/recitals/91","key":"91","title":"Recital 91"},"act_anchor":""}},"provenance":{"official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","check":{"result":"matched","checked_at":"2026-11-01","against":"EUR-Lex"},"repo_path":"spaces/gdpr/recitals.md","unit_text_sha256":"9060e52c9933deddeec378523cb9bb55af9bb00ab9ffdffded30b7666cf24f85","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"gdpr/recitals/rec/90","kind":"recital","key":"90","heading":"","text":"In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk. That impact assessment should include, in particular, the measures, safeguards and mechanisms envisaged for mitigating that risk, ensuring the protection of personal data and demonstrating compliance with this Regulation.","marks":[],"text_hash":"9060e52c9933deddeec378523cb9bb55af9bb00ab9ffdffded30b7666cf24f85","revision":1,"blocks":[{"locator":"gdpr/recitals/rec/90/block/1","text_hash":"9060e52c9933deddeec378523cb9bb55af9bb00ab9ffdffded30b7666cf24f85","revision":1}]}}