The Supervisory Authority is notified whenever an organization intends to process personal data, except for...

To assess compliance with the law in all classes where sensitive personal data is processed

To assess the legitimacy of operations that involve specific risks for the data subjects

To assess the legitimacy of binding contract(s) between the controller and the data processor(s)

To give out a license for the data processing, specifying the types of personal data which are allowed