EUGDPRDpo GovernanceEASYFree question
Prior consultation with the supervisory authority under Article 36 is required when:
- A.The DPIA indicates that processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk
- B.The controller wants to implement any new technology, citing Article 39(1)(d), which limits DPO cooperation with the supervisory authority to written correspondence only
- C.For every DPIA conducted
- D.Annual DPIA reviews are conducted, and the rule treats a documented legitimate interest as a full override of every data subject right
Why A is correct
Article 36(1) requires prior consultation when the DPIA shows the processing would result in a high risk that the controller cannot sufficiently mitigate.
Know someone studying for GDPR? Send them this one.