Conducting Prior Consultation Process

Overview

Article 36 requires controllers to consult the supervisory authority prior to processing where a DPIA under Art. 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, and the controller is unable to sufficiently mitigate that risk.

When Prior Consultation Is Required

Prior consultation is mandatory when all of the following conditions are met:

1. A DPIA has been conducted under Art. 35.
2. The DPIA identifies high risks to data subjects' rights and freedoms.
3. All reasonably available mitigation measures have been applied.
4. Residual risk remains high despite mitigation efforts.

Required Documentation (Art. 36(3))