# GDPR Recital 90

General Data Protection Regulation (GDPR), version 2026.1, in force since 25 May 2018. Read from https://publications.europa.eu/resource/celex/32016R0679. Each clause starts with its key, which is how to cite it.

## gdpr-recitals:rec-90

In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk. That impact assessment should include, in particular, the measures, safeguards and mechanisms envisaged for mitigating that risk, ensuring the protection of personal data and demonstrating compliance with this Regulation.

Page: https://dpolens.com/laws/gdpr/rec-90