If, while carrying out your DPIA, you identify any risks with a high overall (residual) risk level and you cannot mitigate these risks, you must consult with the ICO. You cannot proceed with your processing of the data until after you have done this. The ICO will generally give written advice within 8 weeks, but this timeframe may be extended. Read Data protection impact assessments for more information.