1. The Controller shall, without undue delay, inform the DPO whenever the Controller intends to restrict the application of data subjects’ rights, or extends the restriction, in accordance with this Decision. The Controller shall provide the DPO access to the internal note containing the assessment of the necessity and proportionality of the restriction as well as, where applicable, underlying factual and legal elements and document the date of informing the DPO.
2. The DPO may request the Controller in writing to review the application of the restrictions. The Controller shall inform the DPO in writing about the outcome of the requested review.
3. The Controller shall inform the DPO when the restriction has been lifted.
4. The Controller shall document the involvement of the DPO along the different steps of the process, starting with the date of informing the DPO.
5. The internal note, and, where applicable, underlying factual and legal elements shall be made available to the European Data Protection Supervisor on request.