Requests for an investigation shall be addressed to the DPO in writing by using a specific form made available by him/her. In the case of obvious misuse of the right to request an investigation, for example where the same individual has made an identical request only recently, the DPO is not obliged to report back to the requester.

Within 15 days upon receipt, the DPO shall send acknowledgement of receipt to the Appointing Authority or the person who commissioned the investigation and verify whether the request is to be treated as confidential.

The DPO shall request from the controller who is responsible for the data processing operation in question a written statement on the issue. The controller shall provide his/her response to the DPO within 15 days. The DPO may wish to receive complementary information from other parties, such as the Security Office and Security of Information (Infosec) Office of the GSC. If appropriate, he/she may request an opinion on the issue from the Council Legal Service. The DPO shall be provided with the information or opinion within 30 days.

The DPO shall report back to the Appointing Authority or the person who made the request no later than three months following its receipt.