Skip to content
cccskills
FreePublished on GitHub

gdpr-prior-consultation

Guides the GDPR Article 36 prior consultation process with supervisory authorities when a DPIA indicates high residual risk. Covers timeline requirements, documentation, and outcome handling. Activate when DPIA residual risk remains high or when preparing regulatory submissions. Keywords: prior consultation, Article 36, DPIA, high risk, supervisory authority.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills

Run score Not tested

See how to install

Files included (5)

  • SKILL.md3.9 KB
  • assets/template.md3.7 KB
  • references/standards.md2.2 KB
  • references/workflows.md1.6 KB
  • scripts/process.py4.8 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Conducting Prior Consultation Process

Overview

Article 36 requires controllers to consult the supervisory authority prior to processing where a DPIA under Art. 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, and the controller is unable to sufficiently mitigate that risk.

When Prior Consultation Is Required

Prior consultation is mandatory when all of the following conditions are met:

  1. A DPIA has been conducted under Art. 35.
  2. The DPIA identifies high risks to data subjects' rights and freedoms.
  3. All reasonably available mitigation measures have been applied.
  4. Residual risk remains high despite mitigation efforts.

Required Documentation (Art. 36(3))

The controller must provide:

  1. Respective responsibilities of controller, joint controllers, and processors
  2. Purposes and means of the intended processing
  3. Measures and safeguards to protect data subjects
  4. DPO contact details
  5. The completed DPIA under Art. 35
  6. Any other information the authority requests

Timeline

PhaseDurationReference
Authority initial response period8 weeks from receiptArt. 36(2)
Extension for complex casesUp to 6 additional weeksArt. 36(2)
Maximum total period14 weeksArt. 36(2)
Processing commencementOnly after advice received or deadline expiredArt. 36(2)

Consultation Process

Step 1: Pre-Submission Preparation

  1. Verify the DPIA is complete with all Art. 35(7) mandatory elements.
  2. Confirm all available mitigation measures have been documented.
  3. Document why residual risk remains high despite mitigation.
  4. Obtain DPO review and sign-off.
  5. Prepare the submission package with all Art. 36(3) documents.

Step 2: Submission

  1. Submit to the competent supervisory authority (lead authority for cross-border processing under Art. 56).
  2. Use the authority's prescribed format if available.
  3. Retain proof of submission with date stamp.

Step 3: Authority Engagement

  1. Respond promptly to requests for additional information.
  2. Track the 8-week deadline and any extension notifications.
  3. Do not commence processing until advice is received or deadline expires.

Step 4: Outcome Handling

OutcomeAction
Authority approvesProceed subject to any conditions specified
Authority provides recommendationsImplement recommendations, document compliance
Authority objects or restrictsDo not proceed; revise processing design; resubmit if appropriate
No response within deadlineDocument that consultation was submitted and deadline expired; may proceed

Member State Variations

Art. 36(5) permits Member State law to require prior consultation for processing in the public interest, including social protection and public health. Controllers must check local implementing legislation.

Common Reasons for Triggering Prior Consultation

  • Large-scale biometric identification systems
  • Systematic public area surveillance with facial recognition
  • Processing of genetic data at population scale
  • Automated decision-making with legal or similarly significant effects where mitigation is insufficient
  • Novel technology processing with unpredictable risk profiles

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

42-cfr-part-2

Free

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

adequacy-assessment

Free

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-gating-services

Free

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-verification-methods

Free

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-act-high-risk-docs

Free

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-automated-decisions

Free

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

See all skills by mukul975

Report a problem with this skill