Regulator Consultation

The Regulator consultation card on the Closure tab of an assessment records what was sent to the regulator and what came back. It appears when the questionnaire has a rule for providing the assessment to the regulator, when it configures a regulator consultation, or once one is recorded. It is part of the DPIA validation work.

The Three Kinds of Consultation

• Prior consultation. The regulator answers within a period set by law and can order changes (GDPR Art. 36: 8 weeks, extendable by 6).
• Review and comment. The regulator reviews and comments, with no deadline (for example Alberta's s. 64 submission to the Commissioner).
• Notification (a copy for information). A copy sent after the decision, recorded as concluded when it is submitted (for example the federal copies of an approved PIA to the Privacy Commissioner and to the Treasury Board of Canada Secretariat).

Recording a Submission

Choose Record submission. It asks for:

• the regime (the questionnaire's, or Review and comment with no deadline when none is configured);
• the ground (High residual risk, Required by law, Required by policy, Voluntary);
• the authority and the authority's reference;
• the dates it was submitted and received;
• the submission package.

For a prior consultation the card then shows Reply due … and How the reply date was computed: the start date, the reply period, an extension, and the days paused while the regulator waited for information. Recording the submission also fills the Submitted to regulator date in the sidebar.

Following It Up

Under More the card offers:

• Record acknowledgement: Admitted for review, or Closed without review when the regulator says no consultation was needed, which concludes it.
• Authority extended the period: once. A notice given later than the law allows is flagged, not refused.
• Authority asked for information and Information provided: the reply date pauses meanwhile where the law says so.
• Record outcome: concludes the consultation (see below).
• Withdraw: ends a consultation the organization withdrew.

Every action also appears in the regulator log below the card. One consultation is open at a time, and earlier ones are listed. A new consultation cannot be started once the assessment is in effect, but an existing one can still be updated, for example to record the regulator's answer when it arrives.

Recording the Outcome

Record outcome offers: No objection; Written advice (with its position: favourable, favourable with reservations or unfavourable); Warning; Order to comply; Limitation or ban on the processing (with the date it ends, or none for a definitive one); Authorised or Authorisation refused where the regime has an authorisation; Closed without review; Withdrawn; or No reply within the period (only once the reply period has ended).

Attach the authority's letter and a summary, then choose Add the authority's recommendations as commitments. Each becomes a recommendation from the regulator on the Commitments card, which you accept or decline there.

What a Consultation Changes for the Approval

• An order in force stops it. While a limitation or ban is in force, or after an authorisation is refused, the assessment cannot take effect. No one can override this.
• A reply period still running warns. If a follow-up rule warns on approval (for example Supervisory authority's reply to a prior consultation), Mark in effect asks Approve inside a waiting period? and so does Approve on the last step of a review that puts the assessment in effect. Approve anyway goes ahead, and the choice is recorded in the audit ledger.
• The decision comes after the answer. The regulator's answer to a prior consultation or a review must come before the decision; record the decision again if the answer arrives later. A notification never counts here, because it is not advice, and a later copy never hides an earlier unfavourable written advice.

Some regimes require the submission before the assessment takes effect; see When the Regulator Must Have the Assessment on the DPIA Validation page, which also lists the packs that configure a consultation. The regimes are a starting point built from public information, not legal advice.

Related Pages

• DPIA Validation — the Validation tab, the decision and the filing rules.
• Commitments — where the regulator's recommendations are tracked.
• Assessment Details — the assessment panel and its tabs.