Request prior consultation
Do an impact assessment first
If you are planning a personal data processing that poses a high risk to the rights and freedoms of individuals, you must first do an impact assessment. This will guide you whether you should request prior consultation with us.
EDPB's Guidelines on Data Protection Impact Assessment (DPIA)
Checklist
Before prior consultation
-
1
Impact assessment
Do a thorough impact assessment and carefully document how you will ensure safety in the processing of personal data.
-
2
Take action
Take measures to limit the risks.
-
3
Are there remaining high risks with the processing of personal data?
In this case, you should request a prior consultation with IMY before you start processing personal data. Explain the risks to individuals' rights and freedoms and why you have not been able to address them. For example, it may be that the risks cannot be sufficiently mitigated by measures that are reasonable considering the available technology and costs.
Do the following
- Save the form to your computer.
- Open it in Adobe Reader.
- Fill in all the fields of the form and save it
- Submit the form to imy@imy.se.
Please note that the form is only available in Swedish.
What happens next?
IMY have eight weeks to respond to your request for prior consultation under the General Data Protection Regulation (GDPR). However, we have the right to extend the time by six weeks if the request concerns a complex processing of personal data. We will inform you of an extension within one month of receiving the request. If we need more information from you about the planned data processing, the time count is paused while we wait for your response.
If we assess that your planned processing of personal data is in breach of the GDPR, we can
- provide written advice on how to proceed
- prohibit the processing.