National laws

Impact assessments can also be required under national laws within the national leeway provided by the EU’s General Data Protection Regulation.

GDPR on EUR-Lex' website

For example, carrying out an impact assessment and delivering it to the Data Protection Ombudsman can be a requirement for derogating from the rights of the data subject for purposes of historical and scientific research or the compilation of statistics, as provided for in section 31 of the Data Protection Act. In this case, the impact assessment is related to a case in which the controller processes special categories of personal data or personal data related to criminal convictions and offences for purposes of historical and scientific research and wishes to derogate from certain rights of the data subject.

More information: Derogating from the rights of data subjects in the context of scientific or historical research or for statistical purposes