# Prior consultation — GDPR — context bundle > Focused context for a single provision, curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/laws/gdpr/art-36 > Every item cites its source. Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it. ## Provision ### Prior consultation — Prior consultation *GDPR, gdpr-art-36-en — https://overview.legal/laws/gdpr/art-36* 1. The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk. 2. Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58. That period may be extended by six weeks, taking into account the complexity of the intended processing. The supervisory authority shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay. Those periods may be suspended until the supervisory authority has obtained information it has requested for the purposes of the consultation. 3. When consulting the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory authority with: a) where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings; b) the purposes and means of the intended processing; c) the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation; d) where applicable, the contact details of the data protection officer; e) the data protection impact assessment provided for in Article 35; and f) any other information requested by the supervisory authority. 4. Member States shall consult the supervisory authority during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing. 5. Notwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior authorisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health. ## Enforcement 4 decision(s) on record cite Article 36, totalling approximately €44,830 in fines (median €18,630). Top fines: - **Gnosjö Municipality: Insufficient legal basis for data processing** (SWEDEN, €19,500) — https://overview.legal/posts/46571 - **School in Skellefteå: Insufficient legal basis for data processing** (SWEDEN, €18,630) — https://overview.legal/posts/46182 - **Danish National Genome Center: Insufficient technical and organisational measures to ensure information security** (DENMARK, €6,700) — https://overview.legal/posts/47221 ## Guidance ### Guidelines on processing of personal data through blockchain technologies *EDPB — https://overview.legal/posts/125668* Guidelines 02/2025 on processing of personal data through blockchain technologies Version 2.0 Adopted on 07 July 2026 1 | Adopted Version history Version Date Adoption information version 1.1 08 April 2025 adoption of the guidelines before public consultation version 2.0 07 July 2026 adoption of the guidelines after public consultation 3 | Adopted 4 | Adopted The European Data Protection Board Having regard to Article 70 (1)(e) of the Regulation 2016/679/EU of the European Parliament and of the… ### Opinion 15/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR *EDPB — https://overview.legal/posts/125681* Opinion 15 / 2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR Adopted on 15 April 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(2), Article 42 and Article 46 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to… ### Opinion 14/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 GDPR *EDPB — https://overview.legal/posts/125682* Opinion 14 / 2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 GDPR Adopted on 15 April 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64 (2) and Article 42 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free… ### EDPB Annual Report 2025 *EDPB — https://overview.legal/posts/125683* Clarity in action: Supporting stakeholders through guidance and dialogue Annual Report 2025 Foreword 3 Highlights 4 1. The EDPB Secretariat 6 1.1 Mission And Activities 8 2. European Data Protection Board – Activities in 2025 12 2.1 Bridging Fundamental Rights and Digital Innovation Through GDPR Compliance 12 2.1.1 Helsinki high-level meeting: enhanced clarity, support and engagement 12 2.1.2 Regulation on procedural rules and Omnibus regulation on the record of processing 14 2.1.3 Cross… ### EDPB-werkprogramma: vier pijlers met plannen voor richtsnoeren over AI, anonimisering en *EDPB — https://overview.legal/posts/53737* Het werkprogramma is opgebouwd rond vier pijlers: Pijler I: richt zich op harmonisatie en compliance: praktische guidance, templates (voor o.a. DPIA's, dataleknotificaties, privacy notices) en specifieke ondersteuning voor het mkb. Pijler II: draait om handhaving en samenwerking tussen toezichtho... ## Related topics - **Prior Consultation** — https://overview.legal/topics/prior-consultation ## Legal Framework - **DPIA** — https://overview.legal/topics/dpia ## Legal Framework - **Privacy Impact Assessment** — https://overview.legal/topics/privacy-impact-assessment ## Legal Framework --- Generated by overview.legal · https://overview.legal/laws/gdpr/art-36 · 2026-08-22