"The EU General Data Protection Regulation (GDPR) requires controllers to conduct a Data Protection Impact Assessment (DPIA) to identify processing activities that are likely to result in a high risk to the rights and freedoms of natural persons, by virtue of their nature, scope, context and purposes. (GDPR Article 35) The following high level assessment is used to determine whether a detailed DPIA is required for the proposed processing activities - i.e., whether processing activities are likely to result in a high risk to the rights and freedoms of natural persons (as described within the GDPR)"

Under GDPR, lawful processing of personal data requires a legal basis. This question aims to understand if the legal basis for processing personal data is known.

Please only fill out Q6.1 if your answer for Q6 is existing data or inferred data.

To Q10: Data subjects have the right to be informed about how data is being processed. Data subjects have the right to obtain confirmation that their data is being processed and access their personal data. Data subjects can recify their personal data if it is inaccurate or incomplete. This is an individual's right to be forgotten (i.e. their right to ask for their personal data to be erased) Data subjects have the right to restrict any component of data processing (collecting, holding, storing, transmitting and sharing) Data subjects have the right to object to personal data being processed completely. Data subjects have the right to move their personal data from one data processor/controller to another. If a decision is based on automated processing or profiling, data subjects have the right to ask for manual intervention or challange the automated decisions.

You have indicated that you will be collecting sensitive personal data in response to Question 9.