# Prior consultation 36(2) — GDPR — provision context

> Focused context for a single provision (36(2)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-36#par-2
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Prior consultation** (GDPR, full article: https://overview.legal/laws/gdpr/art-36).

## Provision text

### 36(2)

Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58. That period may be extended by six weeks, taking into account the complexity of the intended processing. The supervisory authority shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay. Those periods may be suspended until the supervisory authority has obtained information it has requested for the purposes of the consultation.


## Topics on this provision

- **Processors** — https://overview.legal/topics/processors
  Entities that process data on behalf of controllers
- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Supervision** — https://overview.legal/topics/toezicht
  Oversight and enforcement by supervisory authorities
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Opinion 27/2025 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data by the United Kingdom** (guidance) — https://overview.legal/posts/51407
- **Guidelines 01/2023 on Article 37 Law Enforcement Directive** (guidance) — https://overview.legal/posts/125738
- **EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse** (guidance) — https://overview.legal/posts/125917
- **Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive** (guidance) — https://overview.legal/posts/126065
- **Europol told to hand over personal data to Dutch activist** (news) — https://overview.legal/posts/6280

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-36#par-2 · 2026-08-22