(1) Where having regard to its nature, scope, context and purposes, a type of processing, and in particular a type of processing using new technology, is likely to result in a high risk to the rights and freedoms of individuals, the controller that is proposing to carry out the processing shall conduct an assessment of the likely impact of the proposed processing operations on the protection of personal data (in this Part referred to as a "data protection impact assessment") prior to carrying out the processing.
(2) A data protection impact assessment carried out in accordance with subsection (1) shall include:
(a) a general description of the proposed processing operations to which it relates;
(b) an assessment of the potential risks to the rights and freedoms of data subjects as a result of the proposed processing; and
(c) a description of any safeguards, security measures or mechanisms proposed to be implemented by the controller to mitigate any risk referred to in paragraph (b) and
…