EU GDPR DPIA and prior consultation workflow

Start before the processing begins or before a material change is released. Record the processing operation, controller role, purposes, data categories, affected people, systems, suppliers, recipients, storage periods, and countries involved.

A DPIA is required where the nature, scope, context, and purposes of processing, especially when using new technologies, are likely to create high risk for natural persons. Treat the screening as a written decision: either open a DPIA, rely on a single assessment covering a set of similar operations with similar high risks, or document why the threshold is not met. Check the competent supervisory authority's published Article 35(4) list of processing that requires a DPIA and any Article 35(5) list of processing for which a DPIA is not required.

Article 35(10) can remove the Article 35(1)-(7) DPIA duty where processing under Article 6(1)(c) or (e) has a legal basis in Union or Member State law, that law regulates the specific processing operation or set of operations, and a general impact assessment was already performed when that legal basis was adopted. The exception does not apply where Member State law requires a DPIA before processing.

Tie the DPIA to the processing operation and keep enough detail for an auditor, DPO, or supervisory authority to understand the decision without reconstructing the project history. A generic privacy memo does not supply that project record.

Use the CNIL structure to keep the assessment complete: context, fundamental principles, security risks, and validation. Use the DPC template prompts to capture scope, consultation, necessity and proportionality, risks, mitigation, residual risk, sign-off, and review ownership.

For each identified risk, record the initial likelihood and severity, the specific measure proposed, the owner, the expected effect on risk, and the residual risk after the measure. Do not close the DPIA on a list of broad controls without showing which individual risk each measure reduces.

Measures can change the processing design as well as the security layer. If a risk is created by unnecessary data, avoid it by removing the data. If the risk comes from access, retention, supplier handling, user information, or international transfer, the measure should address that exact cause.

Article 36 prior consultation is required when the DPIA indicates that the processing would result in high risk without measures that sufficiently mitigate it. Requiring a DPIA does not by itself trigger consultation.

Before consulting, assemble the package Article 36 expects and verify the competent authority's filing procedure. The intended processing should remain on hold while consultation is pending because Article 36 requires consultation before processing.

Close the workflow only when the screening decision, DPIA contents, measures, residual-risk decision, and consultation assessment are all traceable to the same processing operation. If the product, data, threat environment, provider model, or affected population changes, reopen the screen and decide whether the DPIA needs review.

Keep the evidence concise but durable. The goal is to prove the controller knew the risks, selected measures, considered affected people and DPO advice where required, and escalated when Article 36 required it.