Consult the competent supervisory authority before: What is the most direct missing control before processing?
High residual risk remaining after safeguards triggers prior consultation with the competent supervisory authority before processing.
The question
Under the GDPR in the European Union, a travel company completes a DPIA for an AI system analyzing detailed traveler histories. After planned safeguards, substantial residual risk to rights and freedoms remains. The lawful basis, documentation, and DPO involvement are otherwise complete. What is the most direct missing control before processing?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Add a voluntary model-card description of system behavior.A model card may improve transparency, but it does not resolve the stated high-residual-risk consultation requirement.
- Repeat the DPIA without changing safeguards or risk assumptions.Reperforming the same assessment does not address the unresolved residual risk or trigger the required external consultation.
- Consult the competent supervisory authority before commencing the processing. ✓GDPR Article 36 requires prior consultation when the controller cannot sufficiently mitigate high residual risk before processing.
- Approve deployment through the company’s privacy committee.Internal approval does not replace the GDPR requirement to consult the supervisory authority when high residual risk remains.
The trap
Separate completing a DPIA from resolving its outcome; high residual risk can require supervisory-authority consultation. How to remember it
High residual risk remaining after safeguards triggers prior consultation with the competent supervisory authority before processing.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How Laws, Standards and Frameworks Apply to AI questions
- Complete and document a GDPR Article 35 DPIA first: Which missing control is required before processing when →
- Empower a qualified reviewer to examine evidence and alter: Which missing control most directly creates →
- Assess the applicable Article 9 exception: What missing control is most direct? →
- All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →
Part of the Certsqill AIGP question bank · Understanding How Laws, Standards and Frameworks Apply to AI ·
Every answer, right and wrong, comes with its own explanation.
