1.
LED
Member States shall provide for the controller or processor to consult the supervisory authority prior to processing which will form part of a new filing system to be created, where: a data protection impact assessment as provided for in Article 27 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk; or the type of processing, in particular, where using new technologies, mechanisms or procedures, involves a high risk to the rights and freedoms of data subjects.
← Article 28 · All articles · art_28__para_1__text_1 →
Source: EUR-Lex (Cellar) · retrieved 2026-09-25 · Text as adopted (Official Journal); later amendments are not incorporated in this text.