§ 40 NDSG
Prior consultation of the supervisory authority
(1)1Prior to the commissioning of newly created data processing systems, the controller shall consult the authority headed by the Land Commissioner for Data Protection where
(2)a data protection impact assessment pursuant to § 39 indicates that the processing would result in a high risk to the rights and freedoms of natural persons and the controller does not take measures to mitigate the risk, or
(3)the type of processing, in particular when using new technologies and procedures, given the nature, scope, circumstances and purposes of the processing, would be likely to result in a high risk to the rights and freedoms of natural persons.
(4)2The authority headed by the Land Commissioner for Data Protection may draw up a list of the processing operations subject to the obligation of consultation pursuant to sentence 1.
(5)The authority headed by the Land Commissioner for Data Protection shall be consulted in the drafting of legal and administrative provisions relating to the processing of personal data.
(6)The authority headed by the Land Commissioner for Data Protection shall be provided with the information referred to in Article 36(3) of the General Data Protection Regulation and, upon request, with further information it requires to assess the lawfulness of the processing and in particular the risks to the protection of personal data of the data subjects and the related safeguards.
(7)1Where the authority headed by the Land Commissioner for Data Protection is of the opinion that the planned processing would be in breach of statutory requirements, in particular because the controller has not sufficiently identified or mitigated the risk, it may, within a period of up to six weeks after the initiation of the consultation, submit written recommendations to the controller and, where applicable, to the processor as to which measures should still be taken. 2The authority headed by the Land Commissioner for Data Protection may extend this period by one month where the planned processing is particularly complex. 3In that case, it shall inform the controller or, where applicable, the processor of the extension within one month of the initiation of the consultation and state the reasons for the delay.
(8)1Where the intended processing is of considerable importance for the performance of the tasks of the controller and is therefore particularly urgent, the controller may commence processing after the initiation of the consultation but before the expiry of the period referred to in paragraph 4. 2In that case, the recommendations of the authority headed by the Land Commissioner for Data Protection shall be taken into account retroactively, and the nature and manner of the processing shall be adapted accordingly where necessary.