Artifact GuideEU

EU GDPR DPIA and prior consultation workflow

A concrete workflow for deciding whether a DPIA is required, completing the Article 35 assessment, and escalating only when residual high risk triggers Article 36 prior consultation.

Use it for new or materially changed processing that may affect individuals through profiling, large-scale sensitive data, systematic monitoring, vulnerable groups, combined datasets, new technology, or difficult-to-avoid services.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

This workflow turns GDPR Articles 35 and 36 into an operating record: screen the processing, document the DPIA, choose measures, reassess residual risk, and keep the evidence needed if supervisory consultation becomes mandatory.

Section 1

1. Screen whether Article 35 requires a DPIA

Start before the processing begins or before a material change is released. Record the processing operation, controller role, purposes, data categories, affected people, systems, suppliers, recipients, storage periods, and countries involved.

A DPIA is required where the nature, scope, context, and purposes of processing, especially when using new technologies, are likely to create high risk for natural persons. Treat the screening as a written decision: either open a DPIA, rely on a recent similar DPIA with the same risk profile, or document why the threshold is not met.

Automatic Article 35(3) checks: systematic and extensive automated evaluation or profiling with legal or similarly significant effects; large-scale special-category or criminal-offence data; large-scale systematic monitoring of a publicly accessible area.
Additional high-risk indicators from DPC/WP29 guidance: evaluation or scoring, systematic monitoring, sensitive data, large-scale processing, matched or combined datasets, vulnerable data subjects, innovative technology, non-EU transfers, or processing that prevents people from exercising a right or using a service.
Large-scale assessment evidence: number or proportion of data subjects, volume and variety of data, duration or permanence of processing, and geographic extent.
If the processing meets at least two high-risk indicators but the team decides not to run a DPIA, record the reasons, approver, DPO advice where designated, and the facts that would reopen the screening.

Sources for this answer

Regulation (EU) 2016/679 (GDPR), Articles 35 and 36

Article 35 defines when a DPIA is required and lists examples that trigger the assessment.

Data Protection Commission - Guide to Data Protection Impact Assessments

DPC guidance expands the screening criteria, including scoring, monitoring, sensitive data, scale, vulnerable groups, combined datasets, new technology, transfers, and unavoidable service access.

Section 2

2. Build the DPIA record around Article 35 content

The DPIA should be a project record, not a generic privacy memo. Tie it to the processing operation and keep enough detail for an auditor, DPO, or supervisory authority to understand the decision without reconstructing the project history.

Use the CNIL structure to keep the assessment complete: context, fundamental principles, security risks, and validation. Use the DPC template prompts to capture scope, consultation, necessity and proportionality, risks, mitigation, residual risk, sign-off, and review ownership.

Context: describe the processing operations, purposes, controller and processor roles, data subjects, data categories, recipients, storage durations, data flows, supporting assets, applicable standards, and intended benefits.
Necessity and proportionality: explain lawful basis, purpose limitation, data minimisation, accuracy, retention, transparency, rights handling, processor arrangements, and international-transfer safeguards.
Consultation evidence: document DPO advice where a DPO is designated, processor input where processors support the processing, internal stakeholder input, and data-subject or representative views where appropriate.
Risk assessment: identify effects on individuals, estimate severity and likelihood, and distinguish confidentiality, integrity, availability, fairness, discrimination, loss of control, financial, physical, reputational, and distress impacts where relevant.

Sources for this answer

Regulation (EU) 2016/679 (GDPR), Article 35(7)

Article 35(7) sets minimum DPIA content: processing description, necessity and proportionality, risks, and measures.

CNIL Privacy Impact Assessment Methodology

CNIL structures a PIA around context, fundamental principles, data-security risks, and formal validation.

CNIL Privacy Impact Assessment Templates

CNIL templates identify concrete fields for data, recipients, storage durations, controls, risk mapping, action plans, DPO advice, data-subject views, and validation.

Section 3

3. Choose measures and reassess residual risk

For each identified risk, record the initial likelihood and severity, the specific measure proposed, the owner, the expected effect on risk, and the residual risk after the measure. Do not close the DPIA on a list of broad controls without showing which individual risk each measure reduces.

Measures can change the processing design as well as the security layer. If a risk is created by unnecessary data, avoid it by removing the data. If the risk comes from access, retention, supplier handling, user information, or international transfer, the measure should address that exact cause.

Possible design measures: remove a data category, shorten retention, narrow recipients, avoid a combined dataset, drop an automated-decision feature, or let people use the service without the high-risk processing where feasible.
Possible governance measures: improve privacy notices, rights workflows, processor contracts, transfer controls, staff training, approval gates, incident handling, and evidence retention.
Possible security measures: access control, encryption, pseudonymisation, anonymisation where suitable, logging, backup, partitioning, vulnerability management, and operational controls around supporting assets.
Record accepted residual risks explicitly. If a residual high risk remains after measures, do not treat management acceptance as a substitute for Article 36 consultation.

Sources for this answer

Data Protection Commission - Guide to Data Protection Impact Assessments

DPC guidance describes identifying solutions, recording accepted risks, and using a risk register to track likelihood, impact, measures, and residual risk.

CNIL Privacy Impact Assessment Methodology

CNIL recommends mapping initial and residual risks by severity and likelihood and preparing an action plan with responsible persons, cost, and timeframe.

ENISA Handbook on Security of Personal Data Processing

ENISA provides supporting security-control context for selecting technical and organisational measures for personal-data processing.

Section 4

4. Trigger prior consultation only for unmitigated high risk

Article 36 prior consultation is a specific escalation point. The trigger is not simply that a DPIA was required; it is that the DPIA indicates the processing would result in high risk in the absence of measures taken by the controller to mitigate the risk.

Before consulting, assemble the package Article 36 expects. Keep the workflow jurisdiction-neutral unless a specific supervisory authority and national procedure have been verified from current official sources.

Consultation trigger: the controller has completed the DPIA, applied or selected measures, and residual high risk still remains or the risk has been insufficiently identified or mitigated.
Consultation package: controller, joint-controller, and processor responsibilities; purposes and means; safeguards and measures; DPO contact details where applicable; the DPIA; and any further information the authority requests.
GDPR response period: the supervisory authority provides written advice within up to eight weeks of receiving the request, may extend by six weeks for complexity, and may suspend the period while waiting for requested information.
Do not invent local forms, portals, fee rules, or mandatory publication steps. Use the competent authority's current official materials before operationalising a national filing process.

Sources for this answer

Regulation (EU) 2016/679 (GDPR), Article 36

Article 36 defines the prior-consultation trigger, expected information package, and GDPR response periods.

Data Protection Commission - Guide to Data Protection Impact Assessments

DPC guidance states that consultation is required when identified risks cannot be managed and residual risk remains high.

Section 5

5. Evidence checklist for closing or reopening the workflow

Close the workflow only when the screening decision, DPIA contents, measures, residual-risk decision, and consultation assessment are all traceable to the same processing operation. If the product, data, threat environment, provider model, or affected population changes, reopen the screen and decide whether the DPIA needs review.

Keep the evidence concise but durable. The goal is to prove the controller knew the risks, selected measures, considered affected people and DPO advice where required, and escalated when Article 36 required it.

Screening record: Article 35(3) checks, DPC/WP29 high-risk indicators, national DPIA list checked where applicable, and reason for DPIA/no-DPIA decision.
DPIA record: processing description, purposes, necessity and proportionality assessment, stakeholder views, data-subject views or reason not sought, DPO advice, risk register, measures, residual-risk map, and sign-off.
Implementation proof: completed action plan, system changes, retention settings, access rules, processor evidence, notices, rights workflows, transfer safeguards, training, and security-control verification.
Reopen triggers: new technology, new purpose, changed dataset or matching logic, expanded scale or geography, new vulnerable population, changed transfer destination, new threat or vulnerability, incident findings, or residual-risk measures that did not work.

Sources for this answer

Regulation (EU) 2016/679 (GDPR), Article 35(11)

Article 35(11) requires review where necessary, at least when the risk represented by processing operations changes.

Data Protection Commission - Guide to Data Protection Impact Assessments

DPC guidance emphasises good record keeping, integration of DPIA outcomes into project plans, and review when processing changes.

CNIL Privacy Impact Assessment Methodology

CNIL describes the PIA as a continuous improvement process updated when significant change occurs.

Recommended next step

Use this workflow to screen, assess, mitigate, and escalate residual high risk

Sorena can help turn your DPIA screening, risk register, mitigation plan, DPO advice, and prior-consultation package into a source-linked operating record.

Research workflow

Open Research Copilot for EU GDPR

Ask source-linked questions about DPIA triggers, Article 35 content, residual high risk, and Article 36 prior consultation.

Explore next step

Talk to Sorena

Talk through implementation

Review your DPIA workflow, evidence gaps, mitigation plan, and prior-consultation decision with Sorena.

Explore next step

Primary sources

References and citations

CNIL Privacy Impact Assessment Methodology

cnil.fr

Referenced sections

CNIL describes the PIA as a continuous improvement process updated when significant change occurs.

"continuous improvement process"

CNIL Privacy Impact Assessment Templates

cnil.fr

Referenced sections

CNIL templates identify concrete fields for data, recipients, storage durations, controls, risk mapping, action plans, DPO advice, data-subject views, and validation.