In Which Case Would a Controller Who Has Undertaken a DPIA

In which case would a controller who has undertaken a DPIA most likely need to consult with a supervisory authority?

A) Where the DPIA identifies that personal data needs to be transferred to other countries outside of the EEA.
B) Where the DPIA identifies high risks to individuals' rights and freedoms that the controller can take steps to reduce.
C) Where the DPIA identifies that the processing being proposed collects the sensitive data of EU citizens.
D) Where the DPIA identifies risks that will require insurance for protecting its business interests.