Amendment 393· Digital Omnibus proposal Recital 40a (new)

(40a)Where, in respect of the same processing operation, a controller is required to carry out a data protection impact assessment under Article 35 of Regulation (EU) 2016/679 and is also subject to an obligation to carry out a fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689, or to a reporting obligation in respect of automated monitoring or decision-making systems under other Union law, those obligations may be satisfied by means of a single integrated assessment. Such an assessment satisfies each of those obligations only where it covers all the elements required by each applicable provision; the substantive requirements, thresholds and triggering conditions laid down in those provisions remain unaffected. The integrated assessment should be made available to each competent authority within the framework of its respective competences and should not be required to be submitted to a single authority. The single Union list of processing operations subject to a data protection impact assessment should reflect processing operations presenting genuinely high risks to the rights and freedoms of natural persons, and should not consist of the accumulation of the requirements laid down in national lists.