When do you need to consult with the Data Protection Authority beforehand?
The controller shall consult the Data Protection Authority before processing if the data protection impact assessment (DPIA) indicates that processing would present a high risk, unless the controller takes steps to reduce it.
How is the consultation process done?
A request for prior consultation must be in writing and must be accompanied by a copy of the DPIA.
The Data Protection Authority has eight weeks to assess whether the proposed processing would violate the Data Protection Act or the General Data Protection Regulation and shall advise the controller and/or the processor about the processing.
This period may be extended by six weeks if processing is complicated and the Data Protection Authority must notify the controller and/or the processor of such a delay.
These deadlines may then be extended until the Data Protection Authority has received the information it requests for the consultation.
