Fact · Voice privacy and security
Article 35(3)(b) of the GDPR lists processing on a large scale of special categories of data, which include biometric data used to identify a person, as a case that requires a data protection impact assessment.
Checked against its source on October 17, 2026
In the source's own words
“processing on a large scale of special categories of data referred to in Article 9 (1)”
Art. 35 GDPR: Data protection impact assessment, gdpr-info.eu (text of Regulation (EU) 2016/679), 2016, Article 35(3)(b).
Open the original- What it measures
- A data protection impact assessment is a documented check of the risks a processing activity poses to people, done before the processing starts. Article 9(1) defines special categories, which include biometric data used for unique identification.
- What it does not show
- The article lists the cases that always require an assessment and leaves the rest to the controller and the supervisory authority. Whether a given dictation or meeting tool processes data on a large scale is a question of fact for the controller.