Recital 94

(94) If the data protection impact assessment shows that, in the absence of safeguards, security measures and risk minimization mechanisms, the processing would result in a high risk of infringement of the rights or freedoms of individuals, and the controller is of the opinion that this risk cannot be minimized by means that are reasonable in terms of available technologies and implementation costs, then the supervisory authority must be consulted before the processing activity begins. Such high risks may result in certain types of processing and the extent and frequency of processing that may also result in harm or interference with an individual's rights and freedoms. The supervisory authority should respond to a request for consultation within a certain period of time. However, the failure of the supervisory authority to respond within this timeframe should not preclude the supervisory authority from intervening in accordance with its tasks and powers established by this Regulation, including the power to prohibit processing operations. As part of the consultation, the results of the data protection impact assessment carried out for the processing in question, and in particular the measures planned to minimize the risk of violation of the rights or freedoms of natural persons, may be submitted to the supervisory authority.

Receive a free package of 4 tutorials and 4 e-learning trainings
The controller of your data is ODO 24 sp. z o. o.
Recital 94 of the preamble to the GDPR | ODO 24