Set by the law · GDPR Art. 36(1)
Prior consultation
In plain English
If a data protection impact assessment shows that processing would be high risk without mitigating measures, the controller must consult the data protection authority before starting.
The official text
The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.
16 decisions on Fino cite Article 36 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.