Guides GDPR Article 36 prior consultation process when DPIA shows high residual risk. Covers documentation requirements, timelines, submission steps, and outcome handling. Activate for high-risk processing or regulatory prep.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin gdpr-compliance-skillsThis skill uses the workspace's default tool permissions.
Article 36 requires controllers to consult the supervisory authority prior to processing where a DPIA under Art. 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, and the controller is unable to sufficiently mitigate that risk.
Acquire memory dumps from live systems/VMs and analyze with Volatility 3 for processes, networks, DLLs, injections in incident response or malware hunts.
Provides x86-64/ARM disassembly patterns, calling conventions, control flow recognition for static analysis of executables and compiled binaries.
Identifies anti-debugging checks like IsDebuggerPresent, NtQueryInformationProcess in Windows binaries; suggests bypasses via patches/hooks/scripts for malware analysis, CTFs, authorized RE.
Article 36 requires controllers to consult the supervisory authority prior to processing where a DPIA under Art. 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, and the controller is unable to sufficiently mitigate that risk.
Prior consultation is mandatory when all of the following conditions are met:
The controller must provide:
| Phase | Duration | Reference |
|---|---|---|
| Authority initial response period | 8 weeks from receipt | Art. 36(2) |
| Extension for complex cases | Up to 6 additional weeks | Art. 36(2) |
| Maximum total period | 14 weeks | Art. 36(2) |
| Processing commencement | Only after advice received or deadline expired | Art. 36(2) |
| Outcome | Action |
|---|---|
| Authority approves | Proceed subject to any conditions specified |
| Authority provides recommendations | Implement recommendations, document compliance |
| Authority objects or restricts | Do not proceed; revise processing design; resubmit if appropriate |
| No response within deadline | Document that consultation was submitted and deadline expired; may proceed |
Art. 36(5) permits Member State law to require prior consultation for processing in the public interest, including social protection and public health. Controllers must check local implementing legislation.