Article 27

Prior checking 1. Processing operations likely to present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes shall be subject to prior checking by the European Data Protection Supervisor. 2. The following processing operations are likely to present such risks: processing of data relating to health and to suspected offences, offences, criminal convictions or security measures; processing operations intended to evaluate personal aspects relating to the data subject, including his or her ability, efficiency and conduct; processing operations allowing linkages not provided for pursuant to national or Community legislation between data processed for different purposes; processing operations for the purpose of excluding individuals from a right, benefit or contract. 3. The prior checks shall be carried out by the European Data Protection Supervisor following receipt of a notification from the Data Protection Officer who, in case of doubt as to the need for prior checking, shall consult the European Data Protection Supervisor. 4. The European Data Protection Supervisor shall deliver his or her opinion within two months following receipt of the notification. This period may be suspended until the European Data Protection Supervisor has obtained any further information that he or she may have requested. When the complexity of the matter so requires, this period may also be extended for a further two months, by decision of the European Data Protection Supervisor. This decision shall be notified to the controller prior to expiry of the initial two-month period. If the opinion has not been delivered by the end of the two-month period, or any extension thereof, it shall be deemed to be favourable. If the opinion of the European Data Protection Supervisor is that the notified processing may involve a breach of any provision of this Regulation, he or she shall where appropriate make proposals to avoid such breach. Where the controller does not modify the processing operation accordingly, the European Data Protection Supervisor may exercise the powers granted to him or her under Article 47(1). 5. The European Data Protection Supervisor shall keep a register of all processing operations that have been notified to him or her pursuant to paragraph 2. The register shall contain the information referred to in Article 25 and shall be open to public inspection.

← art_26__para · All articles · art_27__para →

Source: EUR-Lex (Cellar) · retrieved 2026-10-27 · Text as adopted (Official Journal); later amendments are not incorporated in this text.