EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

GDPR· Article 33

Analysis in our dossiers
Where the file stands·Breach reporting and practical compliance·Binding criteria and accountable enforcement

Text

Article 33 GDPR as printed in the Council text of 22 October 2026

Notification of a personal data breach to the supervisory authority

Source Council, 22 October 2026. Article 33: ST 14756/26, page 137 · pp. 137–138 · exact text page

Article 33(1)

1.

In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach with the support of the national entry point established pursuant to Article 23b of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

Article 33(1a)

1a.

Until the establishment of the national entry point pursuant to Article 23b of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56 of this Regulation.

Article 33(6)

6.

The Board shall establish and make public a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person and a list of the circumstances in which it is not likely to result in such a high risk. The lists shall be available by [OP date = nine months from the date of entry into application of this Regulation].

Article 33(7)

7.

The lists referred to in paragraph 6 shall be reviewed by the Board at least every three years and updated where necessary.

Article 33(8)

8.

The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1. That proposal shall be submitted to the Commission by [OP date = nine months from the date of entry into application of this Regulation]. The Commission after due consideration of the proposal reviews it and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Article 33(9)

9.

The template referred to in paragraph 8 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposal reviews it and is empowered to adopt any updates by way of an implementing act in accordance with the examination procedure set out in Article 93(2).’

Article 33 in the whole GDPR

How the provision changed

Show the statuses

Each text against the law in forceEach text against the text before it

What each text would do to the law in force
Element Commission19 Nov 2025Art 33 Council21 May 2026Art 33 Council10 Jun 2026Art 33 Council18 Jun 2026Art 33 Council3 Sep 2026Art 33 Council2 Oct 2026Art 33 Council22 Oct 2026Art 33
Compared withlaw in forcethe proposal21 May text10 Jun text18 Jun text3 Sep text2 Oct text
From the Commission’s Article 33
Notification of breaches likely to result in a high risk
33(1) Adds Added
33(1) Adds, changed since the proposal Changed
33(1) Adds, changed since 21 May Changed
33(1) Adds Unchanged
33(1) Adds, changed since 18 Jun Changed
33(1) Adds Unchanged
33(1) Adds Unchanged
Direct notification until the entry point is established
33(1a) Adds Added
33(1a) Adds, changed since the proposal Changed
33(1a) Adds Unchanged
33(1a) Adds Unchanged
33(1a) Adds Unchanged
33(1a) Adds Unchanged
33(1a) Adds Unchanged
Notification template and lists of high-risk circumstances
33(6) Adds Added
33(6) Adds, changed since the proposal Changed
33(6) Adds Unchanged
33(6) Adds, changed since 10 Jun Changed
33(6) Adds, changed since 18 Jun Changed
33(6) Adds Unchanged
33(6) Adds Unchanged
Review of the template and lists at least every three years
33(7) Adds Added
33(7) Adds, changed since the proposal Changed
33(7) Adds, changed since 21 May Changed
33(7) Adds, changed since 10 Jun Changed
33(7) Adds, changed since 18 Jun Changed
33(7) Adds Unchanged
33(7) Adds Unchanged
Added in the Council texts
Commission adoption of the template and its updates
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
33(7a) Adds, added since 10 Jun Added
Not in the law in force or this text, dropped since 18 Jun Dropped
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
“The Board shall prepare and transmit to …”
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
33(8) Adds, added since 18 Jun Added
33(8) Adds Unchanged
33(8) Adds Unchanged
“The template referred to in paragraph 8 …”
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
33(9) Adds, added since 18 Jun Added
33(9) Adds Unchanged
33(9) Adds Unchanged

Each text against the law in force: +Adds adds a provision the law in force lacks— neither the law in force nor the text has it changed from the text before

Each text against the text before it: +Added in this text, not in the text before~Changed wording changed−Dropped drops a provision the text before added=Unchanged same as the text before— in neither text

Council text of 21 May 2026 · ST 9547/26 ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others.

Council text of 2 October 2026 · ST 13886/26 Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker.

Parliament amendments

42 amendments to this article

3 would delete the wording, 36 propose alternative wording and 3 would add wording.

By political group; co-sponsored amendments count for each group
TypeThe LeftS&DGreens/EFARenewEPPECRPfEESNRapporteur
− Deletion·····23··
~ Alternative143484816
+ Addition··11····1

By political group

  • − Deletion ECR 2 PfE 3
  • ~ Alternative The Left 1 S&D 4 Greens/EFA 3 Renew 4 EPP 8 ECR 4 PfE 8 ESN 1 Rapporteur 6
  • + Addition Greens/EFA 1 Renew 1 Rapporteur 1

Show

Paragraph (1)Notification of breaches likely to result in a high risk17 amendments

  1. 54 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  2. 251 Alternative Daniel BudaEPP · JURI “electronic channel made available by the competent supervisory authority or, if the competent Member State has so decided, via a national contact”

    (1) In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entryelectronic channel made available by the competent supervisory authority or, if the competent Member State has so decided, via a national contact point establishedor pursuantan tointerface interoperable with the framework provided for in Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.’

    Tabled by
    Daniel Buda
    Group
    EPP
    Targets
    GDPR Article 33(1)
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 (GDPR) / Article 33 – paragraph 1
  3. 252 Alternative Ton Diepeveen +1PfE · JURI “In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entrysingle pointintegrated establishednational pursuantreporting to Article 23a of Directive (EU) 2022/2555portal to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Ton Diepeveen, Pascale Piera
    Group
    PfE
    Targets
    GDPR Article 33(1)
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 3 – paragraph 1 – point 8 – point a
  4. 384 Alternative Virginie JoronPfE · IMCO “Controllers shall continue to document breaches which are not notified, including the facts relating to the personal data breach, its effects and the…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via theits single-entrynational point of entry established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.; Controllers shall continue to document breaches which are not notified, including the facts relating to the personal data breach, its effects and the remedial action taken.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 33(1)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  5. 1176 Alternative Markus BuchheitESN · ITRE–LIBE “data breach has occurred. The use of any Union-level technical reporting tools or single-entry points shall remain voluntary and”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach viato the single-entrycompetent pointsupervisory establishedauthority. Notifications pursuant to this Article 23ashall ofbe Directive (EU) 2022/2555made to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority of the Member State in which the controller is notestablished madeor withinwhere 96the hours,personal itdata breach has occurred. The use of any Union-level technical reporting tools or single-entry points shall remain voluntary and shall be accompaniedlimited byto reasonspersonal fordata thebreaches delaywith clear cross-border or Union-wide systemic relevance, without prejudice to national notification channels.

    Tabled by
    Markus Buchheit
    Group
    ESN
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  6. 1177 Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “Controllers shall continue to document non-notified breaches, including the facts relating to the personal data breach, its effects and the remedial…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via thetheir national single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay. Controllers shall continue to document non-notified breaches, including the facts relating to the personal data breach, its effects and the remedial action taken.

    Justification

    The controller documents every personal data breach, including those which are not notified. The documentation comprises the facts relating to the breach, its effects and the remedial action taken, and enables the supervisory authority to verify compliance in the course of an inspection.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 (GDPR) / Article 33 – Paragraph 1
  7. 1178 Alternative Michael McNamara +5Renew · ITRE–LIBE “in which case particular consideration shall be given to the risk to children”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, in which case particular consideration shall be given to the risk to children, the controller shall without undue delay and, where feasible, not later than 9672 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 9672 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  8. 1179 Alternative Alice Teodorescu Måwe +1EPP · ITRE–LIBE “In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entrynational entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Alice Teodorescu Måwe, Henrik Dahl
    Group
    EPP
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  9. 1180 Alternative Niels Flemming HansenEPP · ITRE–LIBE “In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entrynational entry point established pursuant to Article 23a23b of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Niels Flemming Hansen
    Group
    EPP
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 paragraph 1
  10. 1181 Alternative Henrik DahlEPP · ITRE–LIBE “In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entrynational entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Henrik Dahl
    Group
    EPP
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
Show 7 more amendments
  1. 1182 Alternative Francesco TorselliECR · ITRE–LIBE “(We do not intend to propose to change the timing which remains exactly the same, but only to express it in working days, therefore starting from…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96four hoursworking days after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96four hoursworking days, it shall be accompanied by reasons for the delay. (We do not intend to propose to change the timing which remains exactly the same, but only to express it in working days, therefore starting from Monday in the event that an accident occurs on Saturday or Sunday.)

    Tabled by
    Francesco Torselli
    Group
    ECR
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  2. 1183 Alternative Marina Kaljurand +8S&D · ITRE–LIBE “In the case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the controller shall without…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 9672 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56 of this Regulation. Where the notification to the supervisory authority is not made within 9672 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  3. 1184 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “In the case of a personal data breach that is likely to result in an increased risk to the rights and freedoms of natural persons, the controller…”

    1. In the case of a personal data breach that is likely to result in aan highincreased risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.

    Justification

    The threshold for the obligation to notify the supervisory authority should be lower that the threshold to communicate a personal data breach to the data subject, since controllers generally are incentivised to avoid the communication of a personal data breach to the affected data subject. This tendency to avoid such communication could influence the respective assessment by the controller. While it makes sense to increase the threshold and avoid that supervisory authorities are swamped with personal data breach notifications regarding every incident, it is important that the supervisory authority is informed about the more severe incidents and can also re-asses the controllers risk assessment. In such cases, the supervisory authority could require the controller to communicate the personal data breach to the affected data subjects even if the controller’s initial assessment result in no high risk. This process is stipulated in Article 33(4) GDPR which would basically lose its purpose in case the threshold of Article 33 (notification of a personal data breach to the supervisory authority) would be increased to the threshold of Article 34 GDPR (communication of a personal data breach to the data subjects).

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  4. 1185 Alternative Elena Sancho Murillo +6S&D · ITRE–LIBE “In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 9672 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 9672 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Elena Sancho Murillo, Marina Kaljurand, Brando Benifei, José Cepeda, Lina Gálvez, Francisco Assis, Alex Agius Saliba
    Group
    S&D
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  5. 1186 Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 9672 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 9672 hours, it shall be accompanied by reasons for the delay.

    Justification

    NIS2, where the single-entry point is established, also only has 72 hours. One aim of simplification is to have harmonised rules.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  6. 1187 Alternative Alex Agius SalibaS&D · ITRE–LIBE “In the case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the controller shall without…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 9672 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 9672 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Alex Agius Saliba
    Group
    S&D
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1
  7. 1188 Alternative Irena Joveva +5Renew · ITRE–LIBE “In the case of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, the controller shall without…”

    1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 9672 hours after having become aware of it, notify the personal data breach via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555 to the supervisory authority competent in accordance with Article 55 and Article 56. Where the notification to the supervisory authority is not made within 9672 hours, it shall be accompanied by reasons for the delay.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 33(1)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point a / Regulation (EU) 2016/679 / Article 33 – paragraph 1

Paragraph (1a)Direct notification until the entry point is established6 amendments

  1. 55 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal…”

    1a. Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56 of this Regulation.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 33(1a)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point b / Regulation (EU) 2016/679 / Article 33 – paragraph 1 a
  2. 253 Alternative Daniel BudaEPP · JURI “and until the applicable channel is designated by the competent Member State”

    1a. Until the establishment and testing of the single-entryinteroperable pointframework pursuantprovided tofor in Article 23a of Directive (EU) 2022/2555 and until the applicable channel is designated by the competent Member State, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56.’

    Tabled by
    Daniel Buda
    Group
    EPP
    Targets
    GDPR Article 33(1a)
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point b / 2016/679 (GDPR) / Article 33 – paragraph 1 a
  3. 254 Alternative Ton Diepeveen +1PfE · JURI “controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article…”

    1a. Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56.

    Tabled by
    Ton Diepeveen, Pascale Piera
    Group
    PfE
    Targets
    GDPR Article 33(1a)
    Document
    JURI amendments 69–296 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point b / Regulation (EU) 2016/679 / Article 3 – paragraph 1 – point 8 – point b
  4. 385 Deletion Virginie JoronPfE · IMCO Deletes the Commission’s wording

    (b) the following paragraph is added: 1a. Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56.’

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 33(1a)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point b / Regulation (EU) 2016/679 / Article 33 – paragraphe 1 a
  5. 1189 Deletion Julie Rechagneux +8ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    (b) the following paragraph is added: 1a. Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56.’

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 33(1a)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point b / Regulation (EU) 2016/679 / Article 33 – Paragraph 1a
  6. 1190 Deletion Julie Rechagneux +8ECR, PfE · ITRE–LIBE Deletes the Commission’s wording

    1a. Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 33(1a)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point b / Regulation (EU) 2016/679 / Article 33 – Paragraph 1a

Paragraph (6)Notification template and lists of high-risk circumstances10 amendments

  1. 56 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “By …[PO please insert date: nine months from the entry into application of this amending Regulation] the”

    6. TheBy …[PO please insert date: nine months from the entry into application of this amending Regulation] the Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).The Commission may adopt the template as established by the Board by way of an implementing act in accordance with the examination procedure set out in Article 93(2) of this Regulation.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 33(6)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 6
  2. 108 Alternative Alex Agius Saliba (rapporteur)Rapporteur · IMCO “The Board shall prepare, make public and transmit to the Commission a proposal for a common template for notifying a personal data breach to the…”

    6. The Board shall prepare, make public and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 33(6)
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 6
  3. 386 Alternative Virginie JoronPfE · IMCO “If the Commission departs from the proposal submitted by the Board, it shall set out the reasons for doing so. These reasons shall be made public at…”

    6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviewsrefers itthem to the Board so that the latter can review them, as necessary, and is empowered to adopt itthem by way of an implementing act in accordance with the examination procedure set out in Article 93(2). If the Commission departs from the proposal submitted by the Board, it shall set out the reasons for doing so. These reasons shall be made public at the same time as the implementing act.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 33(6)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 6
  4. 387 Alternative Arba KokalariEPP · IMCO “This shall not go beyond existing obligations under this Regulation or mandate any retroactive obligations.”

    6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). This shall not go beyond existing obligations under this Regulation or mandate any retroactive obligations.

    Tabled by
    Arba Kokalari
    Group
    EPP
    Targets
    GDPR Article 33(6)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 35 – paragraph 6a
  5. 1191 Alternative Julie Rechagneux +9ECR, PfE · ITRE–LIBE “common template shall include fields enabling the controller to describe any privacy-enhancing measures relevant to the breach, including encryption…”

    6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The common template shall include fields enabling the controller to describe any privacy-enhancing measures relevant to the breach, including encryption, pseudonymisation, federated or local processing, confidential computing, access controls, logging, and measures taken to prevent model memorisation, regurgitation, or unauthorised disclosure. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). Where the Commission departs from the proposal submitted by the Board, it shall state the reasons for doing so. Those reasons shall be made publicly available together with the implementing act.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 33(6)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – Paragraph 6
  6. 1192 Alternative Oliver Schenk +13EPP · ITRE–LIBE “7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall…”

    6. The Board shall prepareestablish and transmitmake to the Commission a proposal for apublic common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person and a list of the circumstances in which it is not likely to result in such a high risk.. The proposalstemplate and lists shall be submittedavailable to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). 7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.’

    Tabled by
    Oliver Schenk, Axel Voss, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, Marie-Sophie Lanig, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Eva Maydell, Dimitris Tsiodras, Christian Doleschal, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 33(6)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 6
  7. 1193 Alternative Irena Joveva +5Renew · ITRE–LIBE “6. 6. The Board shall establish and make public common template for notifying a personal data breach to the competent supervisory authority referred…”

    6. 6. The Board shall prepareestablish and transmitmake to the Commission a proposal for apublic common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposalstemplate and the list shall be submitted to the Commission withinavailable [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 33(6)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 6
  8. 1194 Alternative Tomas Tobé +2EPP · ITRE–LIBE “This shall not go beyond existing obligations under this Regulation or mandate any retroactive obligations.”

    6. The Board shall prepare and transmit to the Commission a proposal for a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adopt it by way of an implementing act in accordance with the examination procedure set out in Article 93(2). This shall not go beyond existing obligations under this Regulation or mandate any retroactive obligations.

    Tabled by
    Tomas Tobé, Arba Kokalari, Jörgen Warborn
    Group
    EPP
    Targets
    GDPR Article 33(6)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 6
  9. 1195 Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “By …[PO please insert date: nine months from the entry into application of this amending Regulation] the”

    6. TheBy …[PO please insert date: nine months from the entry into application of this amending Regulation] the Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person. The proposals shall be submitted to the Commission within [OP date = nine months of the entry into application of this Regulation]. The Commission after due consideration reviews it, as necessary, and is empowered to adoptdecide itthat the template and the list have general validity within the Union by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

    Justification

    modeled after Article 40(9) GDPR on the Codes of Conduct

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 33(6)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 6
  10. 1196 Alternative Marina Kaljurand +8S&D · ITRE–LIBE “The Board shall establish and make public a common template for notifying a personal data breach to the competent supervisory authority referred to…”

    6. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a common template for notifying a personal data breach to the competent supervisory authority referred to in paragraph 1 as well as for a list of the circumstances in which a personal data breach is not likely to result in a high risk to the rights and freedoms of a natural person under paragraph 1. The proposalstemplate and list shall be submitted to the Commissionpublished within [OP date = nine months of the entry into application of this Regulation]. The Commission aftermay dueadopt considerationthe reviews it,template as necessary,established andby isthe empowered to adopt itBoard by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

    Tabled by
    Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec
    Group
    S&D
    Targets
    GDPR Article 33(6)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 6

Paragraph (7)Review of the template and lists at least every three years6 amendments

  1. 57 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Commission may…”

    7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.The Commission may adopt necessary updates of the template by way of an implementing act following the procedure referred to in paragraph 6.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 33(7)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 7
  2. 109 Alternative Alex Agius Saliba (rapporteur)Rapporteur · IMCO “The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit…”

    7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.The Commission shall take utmost account of the Board’s assessment.

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 33(7)
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 7
  3. 388 Alternative Virginie JoronPfE · IMCO “If the Commission departs from the Board’s proposed updates, it shall set out the reasons for doing so, and these reasons shall be made public at the…”

    7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6. If the Commission departs from the Board’s proposed updates, it shall set out the reasons for doing so, and these reasons shall be made public at the same time as the adopted updates.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 33(7)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 7
  4. 1197 Alternative Irena Joveva +5Renew · ITRE–LIBE “The template and the list referred to in paragraph 6 shall be reviewed by the Board at least every three years and updated where necessary.”

    7. The template and the list referred to in paragraph 6 shall be reviewed by the Board at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 33(7)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 7
  5. 1198 Alternative Julie Rechagneux +8ECR, PfE · ITRE–LIBE “Where the Commission departs from the Board’s proposals for updates, it shall state the reasons for doing so, and those reasons shall be made…”

    7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6. Where the Commission departs from the Board’s proposals for updates, it shall state the reasons for doing so, and those reasons shall be made publicly available together with the adopted updates.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Ewa Zajączkowska-Hernik, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 33(7)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – Paragraph 7
  6. 1199 Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “the updated template and list have general validity within the Union”

    7. The template and the list referred to in paragraph 6 shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time.The Board shall publish, where necessary, any updates of the template and the list in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6.The Commission is empowered to decide that the updated template and list have general validity within the Union following the procedure in paragraph 6.

    Justification

    modeled after Article 40(9) GDPR on Codes of Conduct

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 33(7)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 7

New paragraphs2 amendments

  1. 110 Addition Alex Agius Saliba (rapporteur)Rapporteur · IMCO “The submission of notifications, reports or other information provided for in this provision shall not reduce or otherwise affect the scope…” numbered 7a

    7a.The submission of notifications, reports or other information provided for in this provision shall not reduce or otherwise affect the scope, frequency or level of detail of the reporting obligations laid down in this Regulation or other applicable Union Law. The establishment of a single-entry point in this Article shall serve solely to simplify procedural aspects and guarantee coordination between competent authorities. It shall not result in lowering the level of security, privacy, consumer and data protection nor limit the power of supervisory authorities to request additional information, conduct investigations or require further reporting where necessary to guarantee compliance with the law.’

    Rapporteur
    Alex Agius Saliba
    Group
    Rapporteur
    Targets
    GDPR Article 33 – paragraph 7a (new)
    Document
    IMCO draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 7 a (new)
  2. 1200 Addition Irena Joveva +5Renew · ITRE–LIBE “The Commission may adopt the template and any updates as referred to in paragraph 6 and 7, as established by the Board, by way of an implementing act…”

    7a. In Article 33, the following paragraph 7a is inserted:

    The Commission may adopt the template and any updates as referred to in paragraph 6 and 7, as established by the Board, by way of an implementing act following the examination procedure set out in Article 93(2).'

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 33 – paragraph 7a (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33 – paragraph 7a (new)

New points1 amendment

  1. 389 Addition David CormandGreens/EFA · IMCO “The submission of notifications, reports or other information provided for in this provision shall not reduce the scope, frequency or level of detail…” numbered 7a

    7a.The submission of notifications, reports or other information provided for in this provision shall not reduce the scope, frequency or level of detail of the reporting obligations laid down in this Regulation or other applicable Union Law. The establishment of a single point of entry under this Article shall serve solely to simplify procedural aspects and ensure better coordination between competent authorities. It shall not result in lowering the level of data protection nor limit the power of supervisory authorities to request additional information, conduct investigations or require further reporting where necessary to guarantee compliance with this Regulation.

    Tabled by
    David Cormand on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 33 – point 7a (new)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 8 – point c / Regulation (EU) 2016/679 / Article 33