What is prior consultation with the regulator, and when is it required?

What it is

Article 36 UK GDPR requires a controller to consult the regulator where a DPIA indicates that the processing would result in a high risk in the absence of measures to mitigate it. The regulator can advise, and can use its powers, including ordering the processing not to go ahead.

When it is required

• Your DPIA identifies a high risk that your measures cannot reduce to an acceptable level. UK GDPR Art 36(1)

When it is not required

• Where the DPIA shows residual risk is not high, or where no DPIA was needed.

Who is responsible

The controller, providing the DPIA, the roles of the parties, the purposes and means, the safeguards, and the DPO's contact details.

What it involves

1. Complete the DPIA.
2. Identify the residual high risk.
3. Submit the consultation with the required information.
4. Wait for written advice before processing.
5. Act on the advice.

Timing

Before processing. The regulator responds within eight weeks of receiving the request, extendable by six weeks for complex processing.

If it goes wrong

Regulatory

Going ahead without consulting breaches Art 36. A breach of this duty sits in the standard tier of penalties: up to £8.7 million or 2% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice.

Criminal

No offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.