Conducting Prior Consultation with Supervisory Authority

Overview

Article 36(1) requires the controller to consult the supervisory authority prior to processing where a DPIA under Art. 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk. Prior consultation is the final safety net when a DPIA reveals risks that cannot be adequately mitigated through technical, organisational, or contractual measures. The supervisory authority has up to 8 weeks (extendable by 6 weeks) to provide written advice. Processing must not commence until the supervisory authority's response is received and addressed.

When Prior Consultation Is Required

Art. 36(1) Trigger

Prior consultation is mandatory when:

1. A DPIA has been conducted under Art. 35
2. The DPIA identifies that processing would result in high risk
3. The controller cannot sufficiently mitigate the risk through available measures
4. Residual risk remains High or Very High despite all reasonable mitigations

Residual Risk Assessment

| Residual Risk Level | Action |