Prior consultations are required when a planned data processing operation is likely to result in a high risk to individuals’ rights and freedoms, even after mitigation measures have been identified. In such cases, the controller (i.e. the organisation responsible for the data processing) must consult the competent supervisory authority before proceeding.
The obligation to conduct prior consultations is grounded in EU data protection law, particularly the General Data Protection Regulation (GDPR) and Regulation (EU) 2018/1725, which governs data processing by EU institutions, bodies, offices and agencies. For agencies such as Europol and Eurojust, this framework is further specified in their sector-specific regulations.
Across all these instruments, the underlying logic is the same: accountability and prevention rather than reaction. Prior consultations create a structured dialogue between organisations and supervisory authorities at an early stage, before problems arise.
Prior consultations therefore have several important benefits:
- They enhance legal certainty for organisations, who receive guidance before launching complex or high-risk processing activities.
- They prevent harm as the risks to individuals can be addressed proactively.
- They facilitate a consistent, harmonised interpretation of data protection principles through the involvement of supervisory authorities.
- They encourage innovation with safeguards, so that new technologies and operational models can be developed within a clear legal framework.
Prior consultations are particularly significant in the field of law enforcement and judicial cooperation in criminal matters, where data processing can have far-reaching consequences for individuals. Agencies operating in this domain often handle sensitive data, deploy advanced analytical tools, and engage in cross-border cooperation.
In this context, the co-legislators – through the Law Enforcement Directive (Directive (EU) 2016/680) and Chapter IX of Regulation (EU) 2018/1725 – chose to apply the mechanism of prior consultation more broadly within the Area of Freedom, Security and Justice (the EU policy area covering, inter alia, police cooperation and judicial cooperation in criminal matters).
As a result, prior consultation is required either where a Data Protection Impact Assessment indicates a high risk, or where the processing – in particular through the use of new technologies, mechanisms or procedures – involves per se a high risk to the rights and freedoms of individuals.
Within this framework, the role of supervisory authorities such as the European Data Protection Supervisor (EDPS) is pivotal. By assessing proposed processing operations before they are implemented, the EDPS ensures that fundamental rights remain at the centre of operational developments.
In practice, the EDPS conducts a detailed examination of the proposed operation and issues a written opinion within the applicable deadline. The opinion may recommend modifications or additional safeguards, providing the controller with concrete and actionable guidance before the processing begins.
The legal framework also recognises that operational work in the field of law enforcement does not always unfold at a measured pace. In certain situations, action must be taken quickly to address immediate threats. For this reason, the legal framework of Europol includes a specific urgency procedure.
Occasionally, a planned processing operation is particularly urgent and necessary to prevent or combat an immediate threat of crime, or to protect the vital interests of a person. In these instances, Europol may initiate processing after the prior consultation has been launched, but before the standard deadline has expired (six weeks, extended by one additional month where necessary).
Where it does so, Europol must notify the EDPS before starting the processing, and the EDPS’s advice must subsequently be taken into account, with the processing adjusted where necessary.
This built-in flexibility ensures that urgent operational needs can be addressed without bypassing oversight. Even in time-critical situations, safeguards remain in place and independent supervision is preserved, without sacrificing Europol’s ability to effectively fight crime.
A particularly noteworthy example of effective prior consultation practice can be seen in 2025, in the handling of ten consultations submitted by Europol and Eurojust (the European Union Agency for Criminal Justice Cooperation).
All ten prior consultations were assessed and concluded by the EDPS within the applicable legal deadlines — six weeks under the Europol Regulation (extendable by one additional month) and two months under the Eurojust Regulation.
Meeting these deadlines in complex and sensitive cases reflects:
- Strong internal coordination
- Careful legal and technical analysis
- Constructive dialogue with the consulting agency
- A clear commitment to delivering timely and practical guidance
Timeliness is itself an essential component of legal certainty. Delayed decisions can stall important operational projects or create uncertainty around compliance. By delivering well-reasoned opinions within the prescribed timeframe, the EDPS ensured that Europol and Eurojust could maintain high data protection standards while moving forward with clarity and confidence.
These ten cases illustrate how prior consultations are not merely procedural formalities. They are meaningful instruments that help shape lawful and proportionate data processing operations in areas of significant public interest.
Ten cases illustrating timely and effective prior consultation in practice in 2025
- Europol's technical solution to process data for the purpose of strategic and operational analysis in the context of cybercrime – 7 April 2025
- Europol's 'Machine Learning Toolbox' – 2 May 2025
- Europol's solution to retrieve, store, trace, and analyse cryptocurrencies – 2 May 2025
- Europol's information alerts in the Schengen Information System (SIS) – 27 May 2025
- Europol's querying and retrieving information from the Entry-Exit System (EES) – 3 October 2025
- Europol's tool assisting analysis of CSAM material – 4 December 2025
- Eurojust's Core International Crime Evidence Database (CICED) – 9 December 2025
- Europol's environment for the retrieval and processing of online data – 13 January 2026
- Europol's solution enabling the receipt of Threat To Life or Safety (TTLS) reports – 12 March 2026
- Europol's instant messaging solution – 16 March 2026