Overview

This article requires controllers to consult the supervisory authority before processing personal data when a Data Protection Impact Assessment (DPIA) indicates a high risk to data subjects’ rights and freedoms that cannot be mitigated. The consultation must include details on responsibilities, processing purposes, safeguards, DPO contact information, and the DPIA itself. The supervisory authority may provide advice or exercise its powers within 8 weeks, extendable by 6 weeks.


Key Principles

  • High-Risk Processing: Prior consultation is required when DPIA identifies risks that cannot be mitigated.

  • Transparency: Controllers must provide complete information about processing activities and safeguards.

  • Regulatory Engagement: Supervisory authorities provide guidance or take action to prevent or reduce risks.

  • Accountability: Consultation demonstrates proactive compliance with GDPR obligations.

Organizational Applicability

This article applies to all organizations acting as controllers within the EU:

  • Entities conducting processing activities with high-risk outcomes for data subjects.

  • Public and private sector organizations performing profiling, special category processing, or large-scale monitoring.

  • Teams responsible for compliance, DPIAs, legal, IT systems, and data governance.

Implementation Requirements

  • Identify high-risk processing activities requiring prior consultation.

  • Prepare and submit the consultation dossier including responsibilities, purposes, safeguards, DPO contact, and DPIA.

  • Respond to supervisory authority requests for additional information.

  • Maintain records of the consultation and outcomes.

Implementation Guidance

  • Establish a process for submitting prior consultations to the relevant supervisory authority.

  • Use DPIA results to document risks and mitigation measures clearly.

  • Ensure staff and DPO are prepared to provide supporting documentation.

  • Track the 8-week consultation period and any extensions to comply with timelines.

Periodic Review

  • Frequency: Annually or whenever new high-risk processing is introduced.

  • Responsible Role: Data Protection Officer (DPO) or Compliance Team.

  • Outcome: Ensure timely consultation with supervisory authorities and proper documentation for accountability.

Non-Compliance Risks

  • Fines: Up to €20 million or 4% of global annual turnover.

  • Legal Exposure: Enforcement actions for failing to consult prior to high-risk processing.

  • Reputational Damage: Loss of trust due to inadequate regulatory engagement.

  • Operational Risk: Processing high-risk data without prior consultation may lead to regulatory sanctions or corrective actions.