A DPIA concludes that residual risk to data subjects remains high after all planned measures. The controller wants to start processing immediately. What must the controller do first under GDPR?
Select an answer to reveal the explanation.
Short Explanation
If the safety check still screams 'danger' after you bolted on every fix, you don't just open the ride—you call the inspector. Same idea: high residual risk after a DPIA means talk to the supervisory authority before you go live.
Full Explanation
When a DPIA shows that residual risk to data subjects remains high after all planned measures, the controller must consult the competent supervisory authority before commencing that high-risk processing rather than going live immediately. Prior consultation exists so a public inspector can weigh risks that still threaten people’s rights—such as large-scale monitoring or sensitive civic datasets—before irreversible processing starts. Filing a criminal complaint against the processor for failing to eliminate all residual risk fails by concept: residual high risk after mitigation triggers Article 36 consultation duties, not an automatic criminal case against a processor as the first step. Waiting three years and then relying on legitimate interests without documenting the DPIA fails both timing and accountability—delay and basis-swapping do not replace consultation or the DPIA record. Deleting the DPIA so the authority cannot review residual high risk fails as destruction of evidence and accountability sabotage. Exam caveat: consultation is required where residual risk remains high despite measures; if measures reduce risk below the high-risk threshold, processing may proceed without that prior consultation, but the DPIA must still support that conclusion. Operational check: freeze go-live, complete the consultation package (DPIA, measures, residual risks, views of the DPO), engage the competent SA, implement any required additional measures, and only then start processing while retaining the full audit trail.