Do I have to consult the supervisory authority for every DPIA?

No. Paragraph 1 requires consultation only where the DPIA shows that the processing would result in a high risk in the absence of measures taken by you to reduce that risk. Recital 94 clarifies that this concerns cases where you cannot reduce the risk by reasonable means, given the available technology and the costs. If you can reduce the risk sufficiently, you record that in the DPIA and consultation is not required.

How long does such a consultation take and what happens then?

The supervisory authority has up to eight weeks from receipt of your request to give written advice if it believes the processing would infringe the GDPR (paragraph 2). That period may be extended by six weeks, of which you are informed within one month, and it is suspended as long as requested information is missing. The supervisory authority may use any of its powers under Article 58, and recital 94 says that the absence of a reaction does not prevent it from intervening later.

What do I have to send along?

Paragraph 3 lists six elements: the allocation of responsibilities between the parties involved, the purposes and means of the processing, the measures and safeguards for data subjects, the contact details of the data protection officer, the DPIA under Article 35 and any other information the supervisory authority requests. Your processor assists with this on request (recital 95).

Article 36: Prior consultationAI-relevant

Praxikon tracks Article 36 (Prior consultation) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IVIn force since 25-05-2018

Article 36 governs what happens when a DPIA shows that a processing operation would result in a high risk in the absence of measures to reduce that risk: the controller must then consult the supervisory authority before starting (paragraph 1). Paragraph 3 lists the information you provide, such as the purposes and means of the processing, the safeguards for data subjects and the DPIA itself. If the supervisory authority believes the processing would infringe the GDPR, it gives written advice within eight weeks, extendable by six weeks, and may use any of its powers under Article 58 (paragraph 2). In addition, member states must consult the supervisory authority when preparing legislation on processing (paragraph 4, recital 96) and national law may require prior authorisation for tasks in the public interest (paragraph 5). The article exists as a safety net: for processing whose high risk cannot be reduced by reasonable means, the supervisory authority looks in beforehand and can prohibit the processing if necessary (recital 94).

Key term: Prior consultation: the controller puts a processing operation with a high risk it cannot reduce to the supervisory authority before starting that processing

Directly affects:controllerprocessordata protection officersupervisory authoritymember state

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Prior consultation with the supervisory authority may be required for high-risk AI systems, alongside the FRIA obligation (Art. 27 AI Act).

AI Act Art. 6 →AI Act Art. 27 →

Official text

The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.

Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58. That period may be extended by six weeks, taking into account the complexity of the intended processing. The supervisory authority shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay. Those periods may be suspended until the supervisory authority has obtained information it has requested for the purposes of the consultation.

When consulting the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory authority with: (a) where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings; (b) the purposes and means of the intended processing; (c) the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation; (d) where applicable, the contact details of the data protection officer; (e) the data protection impact assessment provided for in Article 35; and (f) any other information requested by the supervisory authority.

Member States shall consult the supervisory authority during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing.

Notwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior authorisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health. Section 4 Data protection officer

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

If your DPIA shows that the high risk remains without mitigating measures, you consult the supervisory authority before you start (paragraph 1). Think of an AI system that predicts people's behaviour on a large scale and for which you cannot find adequate safeguards. You provide the information listed in paragraph 3: the allocation of responsibilities, purposes and means, safeguards, the contact details of the data protection officer, the DPIA and anything else the supervisory authority requests. Allow for a period of eight weeks, extendable by six weeks (paragraph 2).

Processor

The consultation is the controller's task, but the supervisory authority may also address its written advice to you (paragraph 2). Recital 95 expects you to assist the controller on request, for example by providing information about the processing and its security.

Data Protection Officer

Your contact details are included in the request for consultation (paragraph 3(d)), so the supervisory authority can use you as a point of contact during the consultation.

Compliance checklist

Every DPIA ends with a recorded conclusion on whether the high risk remains without measures and whether consultation of the supervisory authority is required (paragraph 1).Where consultation is required, the processing does not start before the supervisory authority has been consulted (paragraph 1).The request for consultation sets out the allocation of responsibilities between the controller, joint controllers and processors (paragraph 3(a)).The request describes the purposes and means of the processing and the safeguards for data subjects (paragraph 3(b) and (c)).The contact details of the data protection officer and the full DPIA are attached (paragraph 3(d) and (e)).Additional information requests from the supervisory authority are answered, because the period is otherwise suspended (paragraph 2 and paragraph 3(f)).For processing carried out for a task in the public interest, it has been checked whether national law requires prior authorisation from the supervisory authority (paragraph 5).

Related recitals

(94)

Where a data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights ...

(95)

The processor should assist the controller, where necessary and upon request, in ensuring compliance with the obligations deriving from the carrying out of data protection impact assessments and from ...

(96)

A consultation of the supervisory authority should also take place in the course of the preparation of a legislative or regulatory measure which provides for the processing of personal data, in order ...

Cross-references

Art. 35: Data protection impact assessment Art. 58: Powers

Frequently asked questions

← Art. 35: Data protection impact assessment Art. 37: Designation of the data protection officer →

Connections

Themes where this returns

Assessing risks in advance: DPIA and FRIA

The counterpart in the other law

Guidelines

EDPB Template for Data Protection Impact Assessment
2026-04-14 · under consultation, European Data Protection Board (EDPB)
Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is likely to result in a high risk
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)

Enforcement and fines

Formal warning to the Dutch Minister of Education, Culture and Science not to put the CABR war archive online and searchable
2024-11-26 · final, Autoriteit Persoonsgegevens

Analysis

AI DPIA: when it's required + free template (2026)
2026-03-23