Before starting a new treatment that involves major integrity risks, you must do a consequence assessment. Impact assessments are described in Article 35 of the Data Protection Regulation.