Article 36. Prior consultation.

1. The controller shall consult the supervisory authority prior to processing where a data

protection and impact assessment under Article 35 indicates that the processing would result

in a high risk in the absence of measures taken by the controller to mitigate the

risk. 2. Where the supervisory authority is of the opinion that the intended processing

referred to in paragraph 1 would infringe this regulation, in particular where the controller

has insufficiently identified or mitigated the risk, the supervisory authority shall, within

period of up to 8 weeks of receipt of the

request for consultation, provide written advice to the controller and, where applicable to the processor,

and may use any of its powers referred to in Article 58. That period may be extended by six

weeks, taking into account the complexity of the intended processing. The supervisory authority

shall inform the controller and, where applicable, the processor, of any such extension within one

month of receipt of the request for consultation together with the reasons for the delay.

Those periods may be suspended until the supervisory authority has obtained information it has

requested for the purposes

of the consultation.

3. When consulting the supervisory authority pursuant to paragraph 1, the controller shall

provide the supervisory authority with. A, where applicable, the respective responsibilities

of the controller, joint controllers and processors involved in the processing,

in particular for processing within a group of undertakings. B, the purposes and means of the intended

processing. C, the measures and safeguards provided to protect the rights and freedoms of data

subjects pursuant to this regulation. D, where applicable, the contact details of the data

...