EU GDPR Article 36(1) and (3) — Prior consultation
Consult the supervisory authority before processing when a DPIA shows the residual risk stays high despite the mitigations planned
Where this comes from
Provision: Article 36(1) and (3) — Prior consultation
Instrument: EU General Data Protection Regulation (Regulation (EU) 2016/679)
Citation: Article 36, Regulation (EU) 2016/679
Text version: Regulation (EU) 2016/679 (GDPR), OJ L 119, 4.5.2016, p. 1 (CELEX 32016R0679)
Checked against the source: 2 September 2026
Who it applies to
Personal data is processed (GDPR Art. 2(1)) — all of these:
- Service processes personal data
A high-risk screening signal is present (Art. 35(1); WP248 rev.01) — any one of these:
- DPIA screening criteria includes Evaluation or scoring, including profiling and predicting
- DPIA screening criteria includes Automated decision-making with legal or similarly significant effect
- DPIA screening criteria includes Systematic monitoring of people, including in publicly accessible areas
- DPIA screening criteria includes Sensitive data, or data of a highly personal nature
- DPIA screening criteria includes Processing on a large scale
- DPIA screening criteria includes Matching or combining datasets from different processing operations
- DPIA screening criteria includes Data about vulnerable people, such as children, employees or patients
- DPIA screening criteria includes Innovative use of new technological or organisational solutions
- DPIA screening criteria includes Processing that stops people exercising a right, or using a service or contract
- Service makes solely automated decisions with legal or similarly significant effects
- Service deploys AI systems in a professional capacity
…unless:
- Art. 2(2)(c): the Regulation does not apply to processing of personal data 'by a natural person in the course of a purely personal or household activity'. Recital 18 keeps controllers or processors providing the means for such processing in scope. (GDPR Art. 2(2)(c))
- Art. 36(1) is engaged only where the Art. 35 DPIA 'indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk'. (GDPR Art. 36(1))
- Art. 35(10) relief from the DPIA carries through to Art. 36 for the same processing. Separately, Art. 36(4) requires Member States to consult the supervisory authority when preparing legislation, and Art. (GDPR Art. 36(4)-(5) and Art. 35(10))
Scope in the source's own terms
- Art. 3(1)/(2): the processing is carried out in the context of the activities of an establishment in the Union, or relates to offering goods or services to, or monitoring the behaviour of, data subjects in the Union
- Art. 2(1) read with Art. 4(1): the activity is the processing of personal data — any information relating to an identified or identifiable natural person
- Art. 4(7): the duty binds the 'controller' — the person which, alone or jointly with others, determines the purposes and means of the processing (a processor's parallel duties sit in Art. 28/30(2))
- Art. 36(1): a completed Art. 35 DPIA 'indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk'.
What engineering work it implies
- FRIA / DPIA Assessment ScaffoldCovers part of it
An assessment record carrying the Article 27(1)(a)-(f) headings and the WP248 DPIA sections in one artefact, stored with the project and linked to the evidence that...
Sample acceptance criteria Landfall generates for this obligation:
- A residual-high-risk outcome on a DPIA moves the record into a state that blocks processing until consultation completes
- The Art. 36(3) submission is assembled: respective responsibilities, purposes and means, the measures and safeguards, the DPO's contact details, the DPIA itself
- The submission, its date and the authority contacted are stored immutably
- The statutory response window is tracked, including the extension, and its expiry is surfaced
- Any written advice from the authority is recorded and its actions tracked to completion
Evidence an auditor expects
- Process recordDocument reviewRetain duration of the processing plus the applicable limitation period
Prior-consultation correspondence with the supervisory authority
The submission made to the supervisory authority prior to processing, containing the Art. 36(3) items: (a) the respective responsibilities of controller, joint controllers and processors, in particular within a group of undertakings; (b) the purposes and means of the intended processing; (c) the measures and safeguards provided to protect data subjects' rights and freedoms; (d) where applicable, the DPO's contact details; (e) the Art. 35 DPIA; and (f) any other information requested — together with the authority's response and evidence that processing did not begin before it (or before the Art. 36(2) eight-week period, extendable by six weeks, expired)
- Assessment documentDocument review
Residual-risk determination that decides whether Art. 36 is engaged at all
The DPIA section recording residual risk after the controller's mitigations, with an express conclusion on whether the processing would still result in a high risk absent those measures — the fact that triggers or discharges the Art. 36(1) duty. Where the conclusion is "not high", the record itself is the evidence that no consultation was owed
Questions people ask
- Does EU GDPR Article 36(1) and (3) — Prior consultation apply to my service?
- It applies when Service processes personal data; and at least one of: DPIA screening criteria includes Evaluation or scoring, including profiling and predicting; DPIA screening criteria includes Automated decision-making with legal or similarly significant effect; DPIA screening criteria includes Systematic monitoring of people, including in publicly accessible areas; DPIA screening criteria includes Sensitive data, or data of a highly personal nature; DPIA screening criteria includes Processing on a large scale; DPIA screening criteria includes Matching or combining datasets from different processing operations; DPIA screening criteria includes Data about vulnerable people, such as children, employees or patients; DPIA screening criteria includes Innovative use of new technological or organisational solutions; DPIA screening criteria includes Processing that stops people exercising a right, or using a service or contract; Service makes solely automated decisions with legal or similarly significant effects; Service deploys AI systems in a professional capacity. It does not apply where Art. 2(2)(c): the Regulation does not apply to processing of personal data 'by a natural person in the course of a purely personal or household activity'. Recital 18 keeps controllers or processors providing the means for such processing in scope. (GDPR Art. 2(2)(c)).
- When does this become enforceable?
- EU GDPR Article 36(1) and (3) — Prior consultation is enforceable from 25 May 2018. Its current status is: in force.
- What evidence does an auditor expect?
- Prior-consultation correspondence with the supervisory authority; Residual-risk determination that decides whether Art. 36 is engaged at all.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.