DPIA Stakeholder Consultation

Overview

Article 35(9) GDPR requires that controllers "shall, where appropriate, seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations." This skill provides a structured approach to meeting this obligation.

Legal Requirements

Art. 35(9) -- Data Subject Consultation

The controller must seek data subject views "where appropriate." EDPB WP248rev.01 clarifies that failure to consult must be justified and documented.

Art. 35(2) -- DPO Involvement

"The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment."

Art. 36(1) -- Prior Consultation Context

Where prior consultation with the supervisory authority is required, evidence of stakeholder consultation strengthens the submission.

Consultation Methods