Direct answer · GDPR
Prior consultation after a DPIA
Yes. Where the DPIA indicates that the processing would result in a high risk in the absence of measures taken by the organisation to mitigate the risk, it consults the supervisory authority, in the Netherlands the Autoriteit Persoonsgegevens, before the processing starts (prior consultation, Article 36(1)). The supervisory authority provides written advice within eight weeks; that period may be extended by six weeks (Article 36(2)).
For you to establish
- Which measures have already been taken, and what risk remains after them?
Articles
- Art. 36(1) GDPR Consultation before processing where a high risk has not been mitigated.
- Art. 36(2) GDPR Advice within eight weeks, extendable by six weeks.
Guidelines and decisions
- Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679 (Article 29 Working Party, WP248 rev.01, 2017-10-04)DPIA guidelines: when the residual risk is high enough to require consultation.
Read the article Check your own case General interpretation, not legal advice. The official source remains authoritative.
