# Standards and Regulatory References

## GDPR Art. 36 — Prior Consultation
- **Art. 36(1)**: Consultation required when DPIA indicates high residual risk.
- **Art. 36(2)**: SA has 8 weeks to respond, extendable by 6 weeks for complex cases.
- **Art. 36(3)**: Required documentation: (a) controller/processor responsibilities and measures; (b) DPO contact details; (c) the DPIA; (d) any other information requested.
- **Art. 83(4)(a)**: Fine up to EUR 10 million or 2% turnover for failure to consult.

## EDPB Guidance
- **WP248rev.01**: Section III.E covers prior consultation requirements and when it is triggered.
- **EDPB Guidelines on one-stop-shop mechanism**: Clarifies which SA is competent for prior consultation in cross-border cases.

## National SA Procedures
- **ICO**: Prior consultation guidance published 2023. Online form available.
- **CNIL**: Consultation procedure detailed on cnil.fr. Online teleservice portal.
- **BfDI**: Federal and state DPA submission procedures vary by Land.