GV008Impact assessment before deployment

The written assessment, made before a measure operates and kept afterwards, of what it will do to the people subject to it: what it will collect about them, what may follow from what it collects, and what they can do about either. It is a document, and its absence is a finding on its own.

Pillar: GV | Governance and mandate
Sources cited: 12
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
GV008/EUMandatory	European Union	Regulation (EU) 2016/679, articles 5(2), 6, 9, 12, 15, 22, 35, and 88European Parliament and Council · read 11 Aug 2026	The grounds on which processing may rest, the burden of showing it, the categories whose processing is prohibited outright save on a named ground, what a person asking has to be told and by when, the limit on deciding about someone by machine alone, when an impact assessment is owed, and the leave each member state has to set its own employment rule.	The assessment has to be completed before the measure operates, not compiled after it, wherever the processing is likely to result in a high risk.
GV008/ITMandatory	Italy	Provvedimento n. 243Garante per la protezione dei dati personali · read 11 Aug 2026	That ninety days of metadata and browsing logs, kept without the procedural steps, draws a fine, the reasoning turning on the steps and not the purpose.	Its absence is enough on its own: a decision has turned on the missing procedural steps without reaching the purpose the processing served.
GV008/CHMandatory	Switzerland	Bundesgesetz über den Datenschutz (DSG), SR 235.1, Artikel 6, 19, 21, 22, 24, 31, and 61Federal Assembly · read 5 Oct 2026Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026	That processing is lawful, in good faith, and proportionate, for a purpose recognizable to the person and compatible with it, that the controller informs the person of the collection, that a decision resting on automated processing alone with legal or significant effect is disclosed to the person, that a prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights, that a security breach likely to carry a high risk is notified to the EDÖB as fast as possible, that an infringement of personality is unlawful unless justified by consent, an overriding private or public interest, or law, and that natural persons are fined up to CHF 250,000 for the listed intentional breaches.	A prior impact assessment is made where processing may carry a high risk for the personality or fundamental rights of the person. The business examines and justifies in writing the overriding interest and the proportionality of a planned monitoring or control system, and produces the justification to the cantonal labour inspectorate on request.
Recommended	Croatiawhere written	Smjernice o obradi osobnih podataka u radnim odnosimaAgencija za zaštitu osobnih podataka (AZOP) · read 5 Oct 2026	That consent is seldom an adequate basis in the employment relationship, that GPS in company vehicles is regulated by written internal rules available to all workers, with the data processed only for the purposes those rules state and kept no longer than needed, that a data protection impact assessment is mandatory for processing workers’ data by applications or systems that track work, movement, or communication, and that video surveillance of workers rests on the GDPR implementation act and the Occupational Safety Act without consent, with the works council’s prior consent where devices follow all movements throughout working time.	A data protection impact assessment is mandatory, by the Agency’s decision of 21 December 2018, for the processing of workers’ data by applications or systems for tracking, such as the tracking of work, movement, or communication.
Recommended	Hungarywhere written	A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That consent is a basis for workplace processing only exceptionally, that the employer’s legitimate interest with a documented balancing test is the basis for checks, that gradual checking and the employee’s presence are the safeguards, that cameras are not operated for the primary observation of employees and are barred from changing rooms, washrooms, and break rooms, with recordings kept three working days as a rule and hidden cameras prohibited, that the e-mail account is checked under an internal policy, in steps from address and subject to content, and that the content of private e-mails is not inspected even after notice.	Before a check that involves personal data the employer carries out a balancing test: whether personal data are needed at all, the precise legitimate interest, the purpose, the data and the duration, the employees’ interests, and why the restriction is proportionate; the principle of gradualness and the employee’s presence are the guarantees the test relies on.
Recommended	Irelandwhere written	Guidance on the Use of CCTV, For Data ControllersData Protection Commission · read 5 Oct 2026	That staff monitoring by camera belongs to special circumstances only, that employees are told where cameras are and why, that footage justified for security is not used for attendance or performance, that a case-by-case use for a disciplinary matter has to be shown necessary and limited in scope, that covert surveillance is generally unlawful and exceptionally permitted for offences only under a written policy and after a DPIA, and that a DPIA in the employment context could engage trade union or safety representatives.	A large-scale CCTV system calls for a DPIA, a covert system calls for one before installation, and the DPO is consulted on any DPIA that is carried out.
Recommended	Luxembourgwhere written	Lignes directrices en matière de géolocalisation des véhicules mis à la disposition des salariésCommission nationale pour la protection des données · read 5 Oct 2026	That geolocation of a vehicle given to an employee is always surveillance under article L.261-1, that the employer does not monitor the employee outside working hours, so a vehicle also used privately carries a deactivation under the employee’s control and a vehicle for professional use only may stay located permanently, that the data are not used to observe performance or behaviour outside the initial purposes, so a system installed against theft does not serve to check speeding, time between clients, or route, nor to found disciplinary measures, that location data are kept two months at most, three years where the system is the only means of checking working time (five in the public sector), one year for billing evidence, and that a geolocation system in principle requires an impact assessment.	A geolocation system in principle requires an impact assessment, the CNPD’s list of processing that always requires one covering regular and systematic control of employees’ activities and systematic tracking of location.
Recommended	Portugalwhere written	Deliberação n.º 1638/2013, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes do controlo da utilização para fins privados das tecnologias de informação e comunicação no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026Deliberação n.º 7680/2014, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes da utilização de tecnologias de geolocalização no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026	That the employer defines rules of use and forms of control in an internal regulation, heard by the comissão de trabalhadores and sent to the ACT, after assessing the impact; that the worker is informed before processing of the conditions of private use, the forms of control, the data, the retention period, the tolerance admitted, and the consequences; that control data are kept at most six months save during disciplinary or judicial proceedings; that email addressed to the worker is never opened automatically, even to investigate a disciplinary infraction; that control is not permanent or systematic but pontual, directed to areas of risk, and random; that access to a mailbox is the last resort, in the presence of the worker and preferably of a representative, limited to recipients, subject, date, and time; and that access to the monitoring systems is logged with user, timestamp, operation, sequential id, and hash, signed, analysed under a policy with periodic reports, and the logs kept one year.	Before the internal rules on use and control of ICT are set, the employer assesses their impact. Before geolocation is installed, the employer assesses its impact.
Recommended	Swedenwhere written	Så får du som arbetsgivare kamerabevaka på arbetsplatsenIntegritetsskyddsmyndigheten · read 5 Oct 2026	That cameras at work serve the prevention of accidents or crime, that filming employees to check how they perform is not allowed, that the employer first sets out the problem, why less intrusive measures do not suffice, and how integrity is protected, negotiates with the union, and informs, and that hidden cameras, cameras in toilets and changing rooms, and audio are out or rarely permitted.	Before cameras go up the employer sets out, in a documented assessment, the problem they solve, why less intrusive measures do not suffice, and how the employees’ integrity is protected.
Recommended	United Kingdomwhere written	Employment practices and data protection: monitoring workersInformation Commissioner's Office · read 30 Aug 2026	What the British regulator expects of an employer that watches its workers, told apart as what an employer must do and what it should, and the conditions it sets on watching them without telling them.	An assessment must be carried out before any processing likely to cause high risk, and the examples given reach an insider risk management program directly: the biometric data of workers, keystroke monitoring, monitoring that may result in financial loss, and the use of profiling or special category data to decide on access. Where there is a Data Protection Officer, their independent advice must be sought and recorded. Anyone else the monitoring captures, a customer or a member of a worker’s household, is to be considered in it.