All new processes are also subject to risk analysis validated by the DPO, as well as a legal compliance check before being referenced in the register of processing activities, as required by the GDPR.