Review by the DPO
Article 8
1. Where the controller restricts the application of a data subject’s rights, it shall continuously involve the DPO. In particular, the following shall apply: (a) the controller shall, without undue delay, consult the DPO; (b) on the DPO’s request, the controller shall provide the DPO with access to any documents containing underlying factual and legal elements, including the internal assessment note referred to in Article 3(3); (c) the controller shall document how the DPO was involved including relevant information that was shared, in particular the date of its first consultation as referred to in point (a); (d) the DPO may request the controller to review the restriction; (e) the controller shall inform the DPO in writing of the outcome of the review requested without undue delay and in any case before any restriction is applied. 2. The controller shall inform the DPO when the restriction has been reassessed in accordance with Article 6(3) or when it has been lifted.