Risk and controls

Escalate for prior consultation

Where high residual risk remains, record the decision to consult the supervisory authority and preserve the submission, the correspondence and the outcome.

When a DPIA concludes with high residual risk that no further measure can reduce, the organisation cannot simply proceed; it has to consult the supervisory authority and wait for its response, and that entire exchange has to be evidenced.

A biometric access control rollout that trips this threshold is a realistic example: the residual rating is recorded, the relevant authority is identified, and the correspondence is held against the assessment rather than in someone's inbox.

The proof is that the consultation decision, its date and its outcome are all readable from the assessment, and that processing stays blocked until the outcome is recorded.

Regulation

Article 36

Registers

DPIA · Entity · Audit and review · Privacy action

The steps

1. 01On the assessment's treatment stage, confirm the residual rating that triggers the consultation.
2. 02Open the Entities register and check whether the supervisory authority already exists; if not, create it with the plus button beside the register title.
3. 03Return to the assessment and open the Linked records band to attach the authority entity.
4. 04Open the Evidence tab and attach the submission made to the authority.
5. 05Once a reply is received, attach it to the same tab and record the outcome and the date in the fields provided.
6. 06Leave the activity's state rail blocked until the outcome is recorded as favourable.