In draft new guidance (44-page / 413KB PDF) the ICO confirmed that where the DPIA reveals that the planned data processing activities present a high risk to individuals’ interests, and businesses cannot mitigate those risks, they will be obliged to consult with the ICO before proceeding with the data processing.
In those circumstances, the ICO could take up to 14 weeks to provide a response to the business, according to the draft guidance. The watchdog said that, in some cases, it could stop businesses proceeding with the planned data processing.