The Controller must consult the national supervisory authority prior to processing, if the impact assessment referred to in Article 35 reveals that the processing itself would pose a high risk in the absence of proper measures adopted by the Controller to mitigate the risk (Article 36).

Violation of the prior consultation obligation is sanctioned with administrative fines of «up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher» (Article 83.4).