<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-11-01","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/gdpr/recitals/90","url":"https://www.headlesslaw.com/gdpr/recitals/90","title":"Recital 90","family":"l1_recital_view","work_id":"gdpr","view_of":"/gdpr/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Regulation (EU) 2016/679, OJ L 119, 4.5.2016","check":{"against":"EUR-Lex","on":"2026-11-01"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679","valid_from":"2016-05-04","valid_until":null,"content_id":"88f4e34e93402d5f","versions":["2016-05-04"],"version_url":"https://www.headlesslaw.com/gdpr/recitals/90/versions/2016-05-04","revision_url":"https://www.headlesslaw.com/gdpr/recitals/90/versions/2016-05-04/rev/88f4e34e93402d5f","versions_url":"https://www.headlesslaw.com/gdpr/recitals/90/versions","relations_url":"https://www.headlesslaw.com/gdpr/recitals/90/relations","act_url":"https://www.headlesslaw.com/gdpr/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"gdpr","path":"/gdpr/recitals","name":"GDPR","number":"Regulation (EU) 2016/679","celex":"32016R0679","title_official":null,"document_date":null},"position":{"kind":"recital","key":"90","index":90,"articles":173,"annexes":0},"prev":{"path":"/gdpr/recitals/89","key":"89","title":"Recital 89"},"next":{"path":"/gdpr/recitals/91","key":"91","title":"Recital 91"},"act_anchor":""}}} -->
# Recital 90

*In force · Regulation (EU) 2016/679, OJ L 119, 4.5.2016 · Checked against EUR-Lex on 1 Nov 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679)*

In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk. That impact assessment should include, in particular, the measures, safeguards and mechanisms envisaged for mitigating that risk, ensuring the protection of personal data and demonstrating compliance with this Regulation.