Podľa metodiky:

"At what moment should a DPIA be carried out?

The DPIA should be carried out “prior to the processing” (Articles 35(1) and 35(10), recitals 90 and 93). This is consistent with data protection by design and by default principles (Article 25 and recital 78).

The DPIA should be started as early as practical in the design of the processing operation even if some of the processing operations are still unknown.

As the DPIA is updated throughout the lifecycle project, it will ensure that data protection and privacy are considered and promote the creation of solutions which promote compliance.

It can also be necessary to repeat individual steps of the assessment as the development process progresses because the selection of certain technical or organizational measures may affect the severity or likelihood of the risks posed by the processing.