2. The impact assessment shall include at least the following elements:

1. Purpose of the Processing and its legal basis.
2. Description of the nature of the Processing to be conducted, the types and sources of Personal Data to be processed, and any entities to whom the Personal Data is to be Disclosed.
3. Description of the scope of the Processing, which identifies the type of Personal Data and the geographical scope of the Processing.
4. Description of the context of the Processing, which identifies the relationship between the Data Subjects, the Controller, and the Processors, as well as any other relevant circumstances.
5. Necessity and proportionality of the measures to be taken to enable the Controller and Processors to process the minimal Personal Data necessary to achieve the purposes of the Processing.
6. Impact of the Processing, based on the severity of its impact, materially and morally, and the likelihood of any negative impact on Data Subjects, including any psychological, social, physical, or financial impact, and the likelihood of their occurrence.
7. Measures that will be taken to prevent or limit the risks.
8. The suitability of the measures envisaged to avoid identified risks.

3. The Controller shall provide a copy of the impact assessment to any Processor acting on its behalf in relation to the relevant Processing.