You do not need to conduct a data protection impact assessment (DPIA) when your data processing:
Probably not a high privacy risk.
Very similar to another data processing for which a DPIA has already been conducted.
Is governed by another European or national law and a DPIA has already been carried out when this law was created. Unless the privacy regulator judges that a DPIA is still needed.
There is a list of processing operations for which a DPIA is not mandatory. The AVG allows the privacy regulator to draw up such a list, but it is not mandatory. The AP has not made use of the option to draw up such a list.
