Personal data • Impact assessment: Ministerial Order no. 2025-361 of 14 July 2025 implementing Article 35 of Law no. 1.565

Ministerial Order No. 2025-361 of 14 July 2025 (JDM No. 8756 of 18 July 2024) implements Article 35 of Law No. 1.565 of 3 December 2024, which requires the data controller to carry out an impact assessment of the planned processing operations on the protection of personal data when the processing (in particular through the use of new technologies, and taking into account the nature, scope, context and purposes of the processing) is likely to result in a high risk to the rights and freedoms of data subjects.

→ The Ministerial Order establishes (after obtaining the opinion of the APDP) the list of criteria for determining whether processing is likely to result in a high risk to the rights and freedoms of natural persons::

1. Systematic and in-depth evaluation of personal aspects relating to natural persons, including profiling;
2. Automated decision-making that produces legal effects concerning a natural person or similarly significantly affects them;
3. Systematic monitoring of data subjects;
4. Processing of sensitive data within the meaning of Article 2(9.) of Law No. 1.565 or relating to offences, criminal convictions and security measures or relating to suspected illegal activities;
5. Cross-referencing or combining data sets;
6. Processing personal data relating to vulnerable persons;
7. Innovative use or application of new technological or organisational solutions;
8. Processing that prevents the data subject from exercising a right or benefiting from a service or contract.

→ The following are processing operations that are likely to result in a high risk within the meaning of Article 35 of Law No. 1.565, triggering an impact assessment:

• processing operations that meet at least two of these eight criteria;
• operations that aim to process a considerable volume of personal data, which may affect a significant number of data subjects, assessed in absolute terms or in relative terms in relation to the population concerned, taking into account, in particular, the duration or permanence of the processing activity and its geographical scope, where they meet at least one of these eight criteria or where they give rise to the use of a digital identifier.

The data controller may also consider that processing that satisfies only one of the eight criteria listed in Ministerial Order No. 2025-361 is likely to result in a high risk.

* * *

See also Sovereign Order no. 11.327 of 10 July 2025 implementing Law no. 1.565

* * *