# Standards and Regulatory References

## Primary Legislation

### GDPR Article 36 -- Prior Consultation
- **Art. 36(1)**: Controller shall consult the supervisory authority prior to processing where a DPIA indicates high risk that cannot be sufficiently mitigated.
- **Art. 36(2)**: Supervisory authority shall provide written advice within 8 weeks, extendable by 6 weeks for complex cases.
- **Art. 36(3)**: Required information: responsibilities, purposes, means, safeguards, DPO contact, DPIA, and any other requested information.
- **Art. 36(5)**: Member State law may require prior consultation for processing in the public interest.

### GDPR Article 35 -- Data Protection Impact Assessment
- **Art. 35(7)**: DPIA mandatory contents: systematic description, necessity and proportionality assessment, risk assessment, and mitigation measures.
- **Art. 35(11)**: Controller must review whether processing conforms to the DPIA when risks change.

### GDPR Article 83(4)(a) -- Fines
Non-compliance with prior consultation obligations is subject to fines up to EUR 10,000,000 or 2% of annual global turnover.

## Regulatory Guidance

### EDPB Guidelines on DPIAs (WP248 rev.01, 4 October 2017)
Section III.D.d covers prior consultation:
- Applies when the controller cannot find sufficient measures to reduce risks to an acceptable level.
- The controller must demonstrate what measures were considered and why they are insufficient.
- The authority may exercise any Art. 58 powers including prohibition.

### National Authority Procedures
- **CNIL (France)**: Published a specific prior consultation form requiring structured submission via the CNIL online portal.
- **ICO (UK)**: Online submission form with guidance on required content and expected timelines.
- **BfDI (Germany)**: Accepts submissions via official postal address with specific formatting requirements.

## Enforcement Precedents
- **Slovenian DPA (2020)**: Issued corrective measures after a government entity proceeded with biometric processing without completing required prior consultation.
- **Norwegian DPA (Datatilsynet, 2021)**: Emphasised that prior consultation must be genuine with sufficient detail for meaningful authority review.