GDPR Article 36 deals with a particular outcome of a data protection impact assessment: a planned processing operation still presents high risk to people’s rights and freedoms after the controller has considered measures to reduce it. The controller must consult the competent supervisory authority before starting that processing. A high-risk idea is not automatically a consultation case; the controller first needs a meaningful DPIA under Article 35, including realistic safeguards and an assessment of the remaining risk. The EDPB’s small-business guidance explains the residual-risk decision, and the official Article 36 text governs it.
Consultation is not a request for a commercial “compliance approval” or a shortcut around the controller’s own lawful-basis and necessity analysis. The authority may give written advice and use its corrective powers where it considers the proposed processing would infringe the GDPR, particularly because risk was inadequately identified or mitigated. Silence is not a certificate. A team should use the process to expose unresolved risks and obtain the authority’s response before taking a decision about launch. This guide sets out the trigger, package, timeline and evidence a controller can prepare.
Decide whether a DPIA is needed first
Article 35 requires a DPIA before processing likely to result in high risk, especially where new technologies are used and taking account of the nature, scope, context and purposes. Examples in the Regulation include certain systematic and extensive evaluations with significant effects, large-scale special-category processing, and systematic monitoring of publicly accessible areas on a large scale. Supervisory authorities also publish lists of processing operations requiring a DPIA. A project can be new or sensitive without automatically meeting every Article 35 example; assess the actual operation and the applicable authority’s list.
Describe the processing in enough detail to test it: who decides purposes, which categories of people and data are involved, how information is collected, who can access it, where it goes and how long it remains. Assess necessity and proportionality. Identify plausible harm to people, the measures proposed to address it and the remaining risk. The step-by-step DPIA guide helps structure that work. The ROPA data-fields guide can identify the activity and data categories to examine, although a register does not replace a DPIA. A form completed with generic statements about encryption and staff training does not establish that the risk is controlled.
The Article 36 trigger is best understood after that assessment. The European Commission explains that consultation is required where a DPIA indicates high risk and residual risks remain despite safeguards. Do not read the phrase “in the absence of measures” in Article 36(1) as meaning every processing operation with high initial risk requires consultation. Equally, do not mark the risk acceptable merely because a safeguard appears in a plan. Determine whether the measure can actually be deployed, maintained and tested before the proposed processing begins.
Separate high initial risk from high residual risk
Consider an employer proposing continuous location tracking of field workers. The initial risk may be high because of the possibility of detailed behavioural inferences. Restricting tracking to working hours, reducing precision, limiting managerial access and deleting data promptly might reduce risk; whether it falls below high risk depends on the context and evidence. If the operational purpose still requires intrusive continuous tracking and the measures do not sufficiently address the risk, prior consultation may be required. The scenario is illustrative, not a categorical rule that all employee-location systems must be referred.
For a clinical research project, pseudonymisation, restricted access and independent review may reduce some confidentiality risks, while difficult questions about re-identification, fairness or vulnerable participants remain. A controller should explain which risk each measure reduces and what remains. If an unresolved risk is high, the correct next step may be redesign, postponement or consultation. A project owner cannot resolve high residual risk merely by obtaining a general sign-off from management. The Article 24 controller-responsibility guide covers why accountability remains with the controller.
Consultation is also distinct from Article 22 restrictions on certain automated individual decisions. If a system makes a decision with legal or similarly significant effects, the automated-decision guide helps assess those substantive conditions. Article 36 does not waive Article 22. An AI Act high-risk classification likewise does not automatically answer the GDPR residual-risk question. The same system may engage both legal regimes, but each has its own tests and obligations.
Identify the authority and the processing entity
The consultation belongs to the controller proposing the processing. If several controllers decide purposes jointly, map their responsibilities and explain them in the request. A supplier may prepare technical evidence or help respond, but it does not replace the controller’s decision. Identify the supervisory authority competent for the planned operation under GDPR rules, including cross-border arrangements where applicable. The supervisory-authority guide gives a starting point; confirm the authority’s current Article 36 submission instructions before filing.
Do not assume that a form available in one country is suitable for another, or that the authority overseeing a group headquarters automatically covers a distinct local public-sector operation. Article 36(5) permits Member State law to require consultation and prior authorisation in certain processing for public interest tasks, including social protection and public health. Any national requirement must be checked for the jurisdiction and operation. This guide does not infer a French, German, Irish or Spanish authorisation process from Article 36 alone. National forms, legal bases and sector rules may differ.
Record who will correspond with the authority. If a DPO is designated, include the DPO’s contact and involve them in the DPIA advice process. A designated contact should be able to answer technical questions, provide versioned documents and relay requests promptly. The project team should know which planned activities are paused pending the outcome and which unrelated preparation can continue. “Prior” means before the relevant processing, not necessarily before every design meeting or procurement conversation.
Assemble the Article 36(3) package
Article 36(3) identifies information the controller must provide where applicable: the respective responsibilities of the controller, joint controllers and processors, particularly within a group; the purposes and means of intended processing; the measures and safeguards provided to protect rights and freedoms; the DPO contact where applicable; the DPIA; and other information requested by the authority. Prepare the materials as one coherent description. An authority cannot give useful advice if the DPIA describes one system while the annexes describe a different vendor or data flow.
Explain the unresolved risk in plain terms. Identify the person or group exposed, the harm that could occur, its likelihood and severity, and the limits of planned safeguards. Include alternatives considered and why they were rejected. If the processing can be altered to avoid high residual risk, say whether that option is feasible and what business consequence it has. Do not present a preferred design as the only possible means without examining less intrusive routes. Attach a current data-flow diagram, access model and retention schedule where these clarify the Article 36(3) information; the Regulation does not itself prescribe a universal document template.
If a processor or software supplier controls a technical safeguard, obtain evidence rather than a marketing promise. A statement that data are “secure” does not explain key management, privileged access or deletion. If the controller does not yet know the supplier or hosting location, flag the uncertainty and determine whether the DPIA can be completed. Consultation should not be used to ask the authority to conduct the controller’s initial vendor investigation. Cross-reference the Article 32 security assessment for risk-appropriate controls and the cross-border transfer guide if international access is part of the design.
Understand the authority’s timeline accurately
Article 36(2) provides that where the authority is of the opinion that the proposed processing would infringe the GDPR, it provides written advice within a maximum of eight weeks after receiving the request and may use Article 58 powers. The period can be extended by six weeks according to complexity, with information to the controller about extension and reasons within one month of receipt. The period can be suspended until the authority obtains information it requested for the consultation. This is not a simple promise of a final answer exactly eight weeks after an incomplete submission.
Build the project timetable around the actual receipt and correspondence. Keep the filing acknowledgment, any request for missing material, the dates on which it was supplied, extension notice and advice. Ask the authority how to handle an ambiguous status rather than treating an elapsed date as approval. Article 36 contains no general rule that silence after eight or fourteen weeks legally authorises the processing. If unresolved high risk remains, the controller should not use the deadline as a substitute for a lawful and sufficiently protective design.
Authorities may point out deficiencies, suggest further safeguards or use corrective powers, such as a warning about intended processing or a limitation or ban where the legal conditions for those powers are met. Article 36 does not promise an “approve with conditions” certificate. The controller should compare any advice with the DPIA and implement necessary changes before starting. If the design changes materially during consultation, notify the authority as appropriate rather than relying on advice given for another system. Keep the final decision and reasons in the project record.
Deal with requests for more information
An authority may ask who can view the records, what an algorithm does, why a long retention period is needed or whether a less intrusive purpose can be achieved. Assign each answer to a named owner and provide the evidence used, not only a legal conclusion. Where a supplier holds the facts, coordinate the response through the contract and technical owner. The controller remains responsible for the accuracy of what it submits. Note which assumptions the answer depends on, such as a control that has been agreed but not yet installed.
If requested information reveals a gap in the DPIA, update the assessment, including the residual-risk finding. A change that genuinely mitigates the risk could alter the consultation analysis, but the controller should not silently withdraw or ignore an active consultation without explaining the changed facts. Conversely, new information may make the risk higher. A consultation record should tell a later reviewer which version of the project the authority saw and what happened after its response.
A practical decision path for project owners
First, describe the planned processing and check whether Article 35 and the competent authority’s list call for a DPIA. Second, carry out the DPIA before processing: map necessity, proportionality, risks and measures. Third, test whether the measures sufficiently reduce the risks to people’s rights and freedoms. If high residual risk remains, pause the processing and prepare an Article 36 request with the information in paragraph 3. Fourth, track authority correspondence and any Article 58 action. Fifth, update the design and DPIA, then record the controller’s decision on whether and how the processing can lawfully start.
The path should also separate related obligations. A high-risk transfer issue calls for a Chapter V assessment; it does not automatically become an Article 36 case merely because safeguards are difficult. A DPIA about an automated decision does not itself satisfy Article 22. Failure to choose a lawful Article 6 basis cannot be cured by a favourable consultation conversation. Treat these as connected checks with distinct legal consequences, rather than a single approval gate.
Article 83(4)(a) includes infringements of obligations under Article 36 in a statutory fine tier, subject to the particular case and Article 83 factors; the administrative-fines guide explains that structure. It does not make every late consultation a fixed penalty. The controller should keep the consultation record with the version of the DPIA and the system actually launched. If the authority advised on a narrower pilot but the controller later extends it to a different population or data source, a fresh risk assessment is necessary; old correspondence does not silently cover the expansion. The greater immediate risk is launching a processing activity whose high residual harm was known and insufficiently addressed. Earlier versions of this guide implied that silence authorised launch, that consultation provided a liability shield and that whole categories such as AI or transfers always required consultation. The official Article 36 wording, EDPB DPIA guidance and the applicable supervisory authority’s instructions provide a sounder basis for a case-specific decision.