Section 3 – Data protection impact assessment and prior consultation