Under GDPR Article 35, which criterion ALONE is sufficient to trigger a mandatory Data Protection Impact Assessment?
-
A
Processing personal data of fewer than 500 individuals
-
B
Systematic and extensive profiling used to make significant decisions about individuals
-
C
Storing encrypted backups of employee records
-
D
Sending marketing emails to opted-in subscribers