In the context of the adoption of the Member State law on which the performance of the tasks of the public authority or public body is based and which regulates the specific processing operation or set of operations in question, Member States may deem it necessary to carry out such assessment prior to the processing activities.

This recital of the General Data Protection Regulation clarifies article 35 GDPR (Data protection impact assessment).*