Article 36 of the GDPR: Prior consultation of the supervisory authority

· By Bertrand BucelleBertrand Bucelle · 1 min read

Article 36 of the GDPR: Prior consultation of the supervisory authority

Article 36 of the GDPR Explained

Where the measures provided for in the DPIA are insufficient to mitigate a high risk, the data controller must:

  • Consult the supervisory authority before implementing the processing;
  • Provide it with all relevant information (impact assessment, envisaged measures, DPO contact details, etc.);
  • Await any recommendations, or even a prohibition of processing in certain serious cases.

The authority has a period of 8 weeks to issue its opinion (extendable by 6 weeks).

Why This Article Is Important For Your GDPR Compliance

It enables to anticipate major risks related to data processing and to avoid future violations or sanctions. The consultation ensures an enhanced legal framework and secures innovative or sensitive processing operations.

How to comply with Article 36 of the GDPR?

  • Systematically integrate a risk analysis before any sensitive processing project;
  • If the high risk cannot be reduced, consult the French supervisory authority before implementation;
  • Prepare a complete and documented file to submit to the authority;
  • Follow the recommendations and retain communications for your GDPR documentation.

Application examples of GDPR Article 36

  • A start-up developing a facial recognition tool fails to mitigate certain risks: it consults the French supervisory authority;
  • A company plans to automatically collect sensitive biometric data: mandatory prior consultation;
  • A public body implements a massive cross-referencing of social files without sufficient safeguards: the authority is consulted.

Related Resources

Accelerate Your Compliance in a Few Clicks

Thanks to our all-in-one solution, you can easily accelerate and ensure your compliance:

  • Automate your compliance with our GDPR software
  • Supported or outsourced by our DPO experts
  • Raise awareness among your teams with our GDPR training e-learning

Request a demo with an expert

Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.

GDPR: Self-assess now