EUTechRegResearch
MenuClose menu
Digital Omnibus legislative tracker
Texts to 22 Oct 2026

GDPR· Article 35

Analysis in our dossiers
Where the file stands·Breach reporting and practical compliance·Binding criteria and accountable enforcement

Text

Article 35 GDPR as printed in the Council text of 22 October 2026

Data protection impact assessment

Source Council, 22 October 2026. Article 35: ST 14756/26, page 138 · pp. 138–139 · exact text page

Article 35(4)

4.

The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

Article 35(5)

5.

The Board shall establish and make public a list of the kind of processing operations for which no data protection impact assessment is required.

Article 35(6)

6.

The lists referred to in paragraphs 4 and 5 shall be published by [OP date = 9 months from the date of entry into application of this Regulation]. These lists shall be reviewed by the Board at least every three years and updated where necessary.

Article 35(6a)

‘6a.

The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments. The template and methodology shall be submitted to the Commission by [OP date = 9 months from the date of entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Article 35(6b)

6b.

The template and methodology referred to in paragraph 6a shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Article 35(6c)

6c.

Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Board establishes and makes public the lists referred to in paragraph 4 and 5.’

Article 35 in the whole GDPR

How the provision changed

Show the statuses

Each text against the law in forceEach text against the text before it

What each text would do to the law in force
Element Commission19 Nov 2025Art 35 Council21 May 2026Art 35 Council10 Jun 2026Art 35 Council18 Jun 2026Art 35 Council3 Sep 2026Art 35 Council2 Oct 2026Art 35 Council22 Oct 2026Art 35
Compared withlaw in forcethe proposal21 May text10 Jun text18 Jun text3 Sep text2 Oct text
From the Commission’s Article 35
List of processing operations requiring an impact assessment
35(4) Adds Added
35(4) Adds, changed since the proposal Changed
35(4) Adds Unchanged
35(4) Adds Unchanged
35(4) Adds Unchanged
35(4) Adds Unchanged
35(4) Adds Unchanged
List of processing operations not requiring an impact assessment
35(5) Adds Added
35(5) Adds, changed since the proposal Changed
35(5) Adds Unchanged
35(5) Adds Unchanged
35(5) Adds Unchanged
35(5) Adds Unchanged
35(5) Adds Unchanged
Common template and methodology for impact assessments
35(6) Adds Added
35(6) Adds, changed since the proposal Changed
35(6) Adds Unchanged
35(6) Adds Unchanged
35(6a), first sentence Adds, changed since 18 Jun Changed In September this wording is the first sentence of paragraph 6a. The tracker records September paragraph 6 under the part that held the earlier paragraph 6.
Not in the law in force or this text, dropped since 3 Sep Dropped
Not in the law in force or this text In neither text
Deadline for the lists, template and methodology
35(6a) Adds Added
35(6a) Adds, changed since the proposal Changed
35(6a) Adds Unchanged
35(6a) and (6ba) Adds, changed since 10 Jun Changed
35(6a), second sentence Adds, changed since 18 Jun Changed
Not in the law in force or this text, dropped since 3 Sep Dropped
Not in the law in force or this text In neither text
Review of the lists, template and methodology
35(6b) Adds Added
35(6b) Adds, changed since the proposal Changed
35(6b) Adds, changed since 21 May Changed
35(6b) Adds, changed since 10 Jun Changed
Not in the law in force or this text, dropped since 18 Jun Dropped
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Continued validity of supervisory authorities’ lists
35(6c) Adds Added
35(6c) Adds, changed since the proposal Changed
35(6c) Adds Unchanged
35(6c) Adds Unchanged
35(6c) Adds Unchanged
35(6c) Adds Unchanged
35(6c) Adds Unchanged
Added in the Council texts
Review of the template and methodology
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
35(6b) Adds, added since 18 Jun Added
35(6b) Adds Unchanged
35(6b) Adds Unchanged
Deadline and review for the lists
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
35(6) Adds, added since 18 Jun Added
35(6) Adds Unchanged
35(6) Adds Unchanged
“The Board shall prepare and transmit to …”
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
Not in the law in force or this text In neither text
35(6a) Adds, added since 18 Jun Added
35(6a) Adds Unchanged
35(6a) Adds Unchanged

Each text against the law in force: +Adds adds a provision the law in force lacks— neither the law in force nor the text has it changed from the text before

Each text against the text before it: +Added in this text, not in the text before~Changed wording changed−Dropped drops a provision the text before added=Unchanged same as the text before— in neither text

Council text of 21 May 2026 · ST 9547/26 ST 9547/26 reproduces only some of the proposal’s changes, so this comparison applies only those it shows or visibly drops. It says nothing about the others.

Council text of 2 October 2026 · ST 13886/26 Page 126 prints “(9a)” without an instruction or target, so no change can be assigned to that marker.

Parliament amendments

44 amendments to this article

3 would delete the wording, 30 propose alternative wording and 11 would add wording.

By political group; co-sponsored amendments count for each group
TypeThe LeftGreens/EFARenewEPPECRPfENIRapporteur
− Deletion···1···2
~ Alternative22866·24
+ Addition·23·46··

By political group

  • − Deletion EPP 1 Rapporteur 2
  • ~ Alternative The Left 2 Greens/EFA 2 Renew 8 EPP 6 ECR 6 NI 2 Rapporteur 4
  • + Addition Greens/EFA 2 Renew 3 ECR 4 PfE 6

Show

Paragraph (1)1 amendment

  1. 1222 Addition Michael McNamara +5Renew · ITRE–LIBE “Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing…”

    (aa) In Article 35, paragraph 1 is replaced by the following:

    Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. Where children are affected by the processing, the risks and consequences that the processing may have on their specific rights shall be explicitly addressed. A single assessment may address a set of similar processing operations that present similar risks.

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 35 – paragraph 1
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a a (new) / Regulation (EU) 2016/679 / Article 35 – paragraph 1

Paragraph (4)List of processing operations requiring an impact assessment9 amendments

  1. 58 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “(b) a list of the kind of processing operations for which no data protection impact assessment is required; (c) a common template and a common…”

    4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.By …[PO please insert date: nine months from the entry into application of this amending Regulation] the Board shall establish and make public: (a) a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1; (b) a list of the kind of processing operations for which no data protection impact assessment is required; (c) a common template and a common methodology for conducting data protection impact assessments.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 35(4)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 4
  2. 1203 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “The lists referred to in points (a) and (b) shall support the consistent application of this Regulation and shall not prevent supervisory authorities…”

    4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.By … [nine months from the entry into application of this amending Regulation], the Board shall establish and make public: (a) a Union-level list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1; (b) a Union-level list of the kind of processing operations for which no data protection impact assessment is required; (c) a common template and a common methodology for conducting data protection impact assessments. The lists referred to in points (a) and (b) shall support the consistent application of this Regulation and shall not prevent supervisory authorities from establishing and making public additional lists of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1, where such processing operations are likely to result in a high risk in the context of the Member State concerned.

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 35(4)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 4
  3. 1204 Alternative Niels Flemming HansenEPP · ITRE–LIBE “In preparing its proposal, the Board shall take due account of the lists established and made public by supervisory authorities and relevant guidance…”

    4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. In preparing its proposal, the Board shall take due account of the lists established and made public by supervisory authorities and relevant guidance of the Board, and shall ensure that its proposal reflects a consistent and proportionate approximation of the common elements of those lists, focusing on processing operations most likely to result in high risk. Newly identified triggers shall apply prospectively to new processing or materially changed processing.

    Justification

    Reducing fragmentation and legal uncertainty while ensuring that compliance requirements remain proportionate and focused on genuinely high-risk activities should be at the core of the Digital Omnibus, in order to avoid unnecessary burdens for SMEs.

    Tabled by
    Niels Flemming Hansen
    Group
    EPP
    Targets
    GDPR Article 35(4)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 4
  4. 1205 Alternative Krzysztof Hetman +1EPP · ITRE–LIBE “In preparing its proposal, the Board shall take due account the lists of processing operations established and made public by supervisory authorities…”

    4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. In preparing its proposal, the Board shall take due account the lists of processing operations established and made public by supervisory authorities and shall ensure that its proposal reflects a consistent and proportionate approximation of the processing operations identified in those lists, taking into account the principle of legal certainty.

    Tabled by
    Krzysztof Hetman, Adam Jarubas
    Group
    EPP
    Targets
    GDPR Article 35(4)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 4
  5. 1206 Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection…”

    4. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 35(4)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 4
  6. 1207 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “The Board shall prepare and publish a proposal for a list of the kind of processing operations which are subject to the requirement for a data…”

    4. The Board shall prepare and transmit to the Commissionpublish a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    GDPR Article 35(4)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 4
  7. 1208 Alternative Irena Joveva +5Renew · ITRE–LIBE “The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection…”

    4. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 35(4)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 4
  8. 1209 Alternative Oliver Schenk +12EPP · ITRE–LIBE “The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection…”

    4. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

    Tabled by
    Oliver Schenk, Axel Voss, Marie-Sophie Lanig, Marion Walsmann, Lena Düpont, Ana Miguel Pedro, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Romana Tomc, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 35(4)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 4
  9. 1210 Alternative Sibylle Berg +1NI · ITRE–LIBE “The Board shall prepare and publish a proposal for a list of the kind of processing operations which are subject to the requirement for a data…”

    4. The Board shall prepare and transmit to the Commissionpublish a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    GDPR Article 35(4)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 4

Paragraph (5)List of processing operations not requiring an impact assessment6 amendments

  1. 59 Deletion Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE Deletes the Commission’s wording

    5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 35(5)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 5
  2. 1211 Alternative Markéta GregorováGreens/EFA · ITRE–LIBE “The Board shall establish and make public a list of the kind of processing operations for which no data protection impact assessment is required.”

    5. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a list of the kind of processing operations for which no data protection impact assessment is required.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 35(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 5
  3. 1212 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “The Board shall prepare and publish a proposal for a list of the kind of processing operations for which no data protection impact assessment is…”

    5. The Board shall prepare and transmit to the Commissionpublish a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    GDPR Article 35(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 4
  4. 1213 Alternative Irena Joveva +5Renew · ITRE–LIBE “The Board shall establish and make public a list of the kind of processing operations for which no data protection impact assessment is required.”

    5. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a list of the kind of processing operations for which no data protection impact assessment is required.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 35(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 5
  5. 1214 Alternative Oliver Schenk +12EPP · ITRE–LIBE “operations not covered by the list in paragraph 4”

    5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.Processing operations not covered by the list in paragraph 4 shall not be subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

    Tabled by
    Oliver Schenk, Axel Voss, Marie-Sophie Lanig, Ana Miguel Pedro, Lena Düpont, Marion Walsmann, Romana Tomc, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 35(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 5
  6. 1215 Alternative Sibylle Berg +1NI · ITRE–LIBE “The Board shall prepare and publish a proposal for a list of the kind of processing operations for which no data protection impact assessment is…”

    5. The Board shall prepare and transmit to the Commissionpublish a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

    Tabled by
    Sibylle Berg, Martin Sonneborn
    Group
    NI
    Targets
    GDPR Article 35(5)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 5

Paragraph (6)Common template and methodology for impact assessments6 amendments

  1. 60 Deletion Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE Deletes the Commission’s wording

    6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 35(6)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 6
  2. 390 Alternative Morten Løkkegaard +3Renew · IMCO “The template and methodology shall be proportionate, risk-based and easily usable by SMEs and small mid-cap enterprises, including in cross-border…”

    6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments. The template and methodology shall be proportionate, risk-based and easily usable by SMEs and small mid-cap enterprises, including in cross-border processing activities.

    Justification

    Keeps the simplification agenda credible for smaller businesses and not only for large compliance departments.

    Tabled by
    Morten Løkkegaard, Svenja Hahn, Jeannette Baljeu, Sandro Gozi
    Group
    Renew
    Targets
    GDPR Article 35(6)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / xx / xx
  3. 1217 Alternative Oliver Schenk +13EPP · ITRE–LIBE “The Board shall establish a common template and a common methodology for conducting data protection impact assessments.”

    6. The Board shall prepare and transmit to the Commission a proposal forestablish a common template and a common methodology for conducting data protection impact assessments.

    Tabled by
    Oliver Schenk, Eva Maydell, Andrea Wechsler, Angelika Niebler, Monika Hohlmeier, Dimitris Tsiodras, Christian Doleschal, Marie-Sophie Lanig, Axel Voss, Ana Miguel Pedro, Romana Tomc, Marion Walsmann, Lena Düpont, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 35(6)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 6
  4. 1218 Alternative Irena Joveva +5Renew · ITRE–LIBE “The Board shall establish and make public a common template and a common methodology for conducting data protection impact assessments.”

    6. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a common template and a common methodology for conducting data protection impact assessments.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 35(6)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 paragraph 6
  5. 1219 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “The Board shall prepare and make public a proposal for a common template and a common methodology for conducting data protection impact assessments.”

    6. The Board shall prepare and transmitmake to the Commissionpublic a proposal for a common template and a common methodology for conducting data protection impact assessments.

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    GDPR Article 35(6)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 6
  6. 1228 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “The lists and the template and methodology referred to in paragraph 6a shall be reviewed at least every three years and updated where necessary.”

    6b. The lists and the template and methodology referred to in paragraph 6a-shall6a shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6a.

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    GDPR Article 35(6)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6

Paragraph (6a)Deadline for the lists, template and methodology8 amendments

  1. 61 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “The Commission may adopt the template as established by the Board by way of an implementing act in accordance with the examination procedure set out…”

    6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission aftermay dueadopt considerationthe reviews them,template as necessary,established andby isthe empowered to adopt themBoard by way of an implementing act in accordance with the examination procedure set out in Article 93(2) of this Regulation.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 35(6a)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6 a
  2. 391 Addition Virginie JoronPfE · IMCO “The common template and methodology for conducting data protection impact assessments shall require the controller to evaluate the following: (a) the…” numbered 6a

    6a.The common template and methodology for conducting data protection impact assessments shall require the controller to evaluate the following:

    (a)the risk of reidentification, including using algorithms, and taking into account the means reasonably likely to be used;

    (b)the availability and suitability of state-of-the-art privacy-preserving and privacy-strengthening methods to remove or mitigate this risk, including pseudonymisation, encryption, aggregation, synthetic data, federated analytics and secure processing environments; and

    (c)the risk remaining after applying such techniques.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 35(6a)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 6 a (new)
  3. 392 Alternative Morten Løkkegaard +3Renew · IMCO “which shall be directly applicable across the Union. Supervisory authorities shall not require controllers to use additional national templates…”

    6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act, which shall be directly applicable across the Union. Supervisory authorities shall not require controllers to use additional national templates, methodologies or lists for the same processing operations covered by that implementing act. in accordance with the examination procedure set out in Article 93(2).

    Justification

    A common DPIA template only reduces burden if it prevents 27 additional national variants.

    Tabled by
    Morten Løkkegaard, Svenja Hahn, Jeannette Baljeu, Sandro Gozi
    Group
    Renew
    Targets
    GDPR Article 35(6a)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / xx / xx
  4. 1220 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “The common template and methodology for data protection impact assessments shall require the controller to assess: (a) the risk of re-identification…”

    6a. In Article 35, the following paragraph is inserted:

    The common template and methodology for data protection impact assessments shall require the controller to assess:

    (a)the risk of re-identification, including by algorithmic means and taking into account the means reasonably likely to be used;

    (b)the availability and suitability of state-of-the-art privacy-preserving and privacy-enhancing techniques to remove or mitigate that risk, including pseudonymisation, encryption, aggregation, synthetic data, federated analysis and secure processing environments; and

    (c)the residual risk after application of such techniques.'

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 35(6a)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – Paragraph 6a (new)
  5. 1224 Alternative Oliver Schenk +12EPP · ITRE–LIBE “That list shall be based on convergence area from national authorities and shall not introduce new categories of processing operations that go beyond…”

    6a. The proposalsproposal for the listslist referred to in paragraphsparagraph 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). That list shall be based on convergence area from national authorities and shall not introduce new categories of processing operations that go beyond existing obligations under this Regulation. Processing operations lawfully in place at the time of their initiation shall not be subject to a retroactive obligation to carry out a data protection impact assessment as a result of the adoption of the harmonised list.

    Tabled by
    Oliver Schenk, Andrea Wechsler, Monika Hohlmeier, Angelika Niebler, Dimitris Tsiodras, Christian Doleschal, Axel Voss, Ana Miguel Pedro, Marion Walsmann, Lena Düpont, Romana Tomc, Marie-Sophie Lanig, François-Xavier Bellamy
    Group
    EPP
    Targets
    GDPR Article 35(6a)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6a
  6. 1225 Alternative Irena Joveva +5Renew · ITRE–LIBE “The lists referred to in paragraphs 4 and 5 and the template and methodology referred to in paragraph 6 shall be published within [OP date = 9 months…”

    6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commissionpublished within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 35(6a)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6a
  7. 1226 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “The lists referred to in paragraphs 4 and 5 and the template and methodology referred to in paragraph 6 shall be made public to the Commission within…”

    6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submittedmade public to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    GDPR Article 35(6a)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6
  8. 1227 Alternative Pernando Barrena ArzaThe Left · ITRE–LIBE “The Commission shall not modify the substance of the common methodology or of the lists established by the Board pursuant to paragraph 4, points (a)…”

    6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission aftermay dueadopt considerationthe reviewscommon them,template asestablished necessary,by andthe isBoard empoweredpursuant to adoptparagraph them4, point (c), by way of an implementing act in accordance with the examination procedure set out in Article 93(2). The Commission shall not modify the substance of the common methodology or of the lists established by the Board pursuant to paragraph 4, points (a) and (b).

    Tabled by
    Pernando Barrena Arza
    Group
    The Left
    Targets
    GDPR Article 35(6a)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6

Paragraph (6b)Review of the lists, template and methodology3 amendments

  1. 62 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “of the template by way of an implementing act in accordance with”

    6b. The lists and the template and methodology referred to in paragraph 6a-shall4 shall be reviewed by the Board at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6a.The Commission may adopt any updates of the template by way of an implementing act in accordance with the procedure referred to in paragraph 6a.

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 35(6b)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6 b
  2. 1223 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “The proposals referred to in paragraphs 4, 5 and 6 shall be without prejudice to the right of the competent authorities and supervisory authorities…”

    (aa) In Article 35, the following paragraph is inserted:

    The proposals referred to in paragraphs 4, 5 and 6 shall be without prejudice to the right of the competent authorities and supervisory authorities of the Member States to develop their own guidance, standards and lists, in particular the lists referred to in Article 35(4) and (5). The Board shall take such national guidance, standards and lists into account when preparing the common templates, methodology and lists referred to in those paragraphs.'

    Justification

    The preparation by the Board of common templates, a common methodology and common lists relating to data protection impact assessments contributes to a consistent application of this Regulation. However, this harmonisation of form should not deprive the competent authorities and supervisory authorities of the Member States of their power — recognised in particular in Article 35(4) and (5) — to develop their own guidance, standards and lists reflecting national circumstances. This amendment confirms that the proposals referred to in paragraphs 4, 5 and 6 are without prejudice to that power, and provides that the Board shall take such national guidance, standards and lists into account when preparing the common instruments. This ensures a bottom-up articulation between the national and Union levels, preserving both consistency and the ability of national authorities to address specific national risks.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 35(6b)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a a (new) / Regulation (EU) 2016/679 / Article 35 – Paragraph 6b
  3. 1229 Alternative Irena Joveva +5Renew · ITRE–LIBE “The lists and the template and methodology referred to in paragraph 6a-shall be reviewed by the Board at least every three years and updated where…”

    6b. The lists and the template and methodology referred to in paragraph 6a-shall be reviewed by the Board at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6a.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 35(6b)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6b

Paragraph (6c)Continued validity of supervisory authorities’ lists4 amendments

  1. 63 Alternative Aura Salla and Marina Kaljurand (rapporteurs)Rapporteurs · ITRE–LIBE “establishes and makes public”

    6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the CommissionBoard adoptsestablishes and makes public the implementing actlists referred to in paragraph 6a4, points (a) and (b).

    Rapporteurs
    Aura Salla and Marina Kaljurand
    Group
    Rapporteurs
    Targets
    GDPR Article 35(6c)
    Document
    ITRE–LIBE draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6 c
  2. 1231 Alternative Irena Joveva +5Renew · ITRE–LIBE “6a-shall be reviewed by the Board at least every three years and updated where necessary”

    6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 6a.The lists and the template and methodology referred to in paragraph 6a-shall be reviewed by the Board at least every three years and updated where necessary.

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 35(6c)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6c
  3. 1232 Alternative Sebastian Tynkkynen +1ECR · ITRE–LIBE “Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing…”

    6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 6a.

    Tabled by
    Sebastian Tynkkynen, Diego Solier
    Group
    ECR
    Targets
    GDPR Article 35(6c)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6c
  4. 1233 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “A data protection impact assessment shall not be required, on the sole basis of the Union list referred to in Article 35(4), for processing…”

    6ca. In Article 35, the following paragraph is inserted:

    A data protection impact assessment shall not be required, on the sole basis of the Union list referred to in Article 35(4), for processing operations that were already underway before [the date of application of that list], provided that those operations have not since been subject to substantial modification. This is without prejudice to the obligation to carry out an assessment where processing is likely to result in a high risk on other grounds under Article 35(1).'

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 35(6c)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6c

Paragraph (7)(c)1 amendment

  1. 1234 Addition Michael McNamara +5Renew · ITRE–LIBE “an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1, taking particular account where the personal data…”

    (ba) In paragraph 7 of Article 35, points c and d are replaced by the following

    (c)an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1, taking particular account where the personal data of a child is concerned; and

    (d)the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned, in particular children.

    Tabled by
    Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller, Christophe Grudler
    Group
    Renew
    Targets
    GDPR Article 35 – paragraph 7 – points c and d
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b a (new) / Regulation (EU) 2016/679 / Article 35 – paragraph 7 – points c and d

Paragraph (9)1 amendment

  1. 1236 Deletion Henrik DahlEPP · ITRE–LIBE Deletes the Commission’s wording

    9. Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations.

    Tabled by
    Henrik Dahl
    Group
    EPP
    Targets
    GDPR Article 35 – paragraph 9
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 a (new) / Regulation (EU) 2016/679 / Article 35 – paragraph 9

New paragraphs5 amendments

  1. 393 Addition Virginie JoronPfE · IMCO “The proposals referred to in paragraphs 4, 5 and 6 shall be without prejudice to the right of the competent authorities and the supervisory…” numbered 6a

    6a.The proposals referred to in paragraphs 4, 5 and 6 shall be without prejudice to the right of the competent authorities and the supervisory authorities of the Member States to draw up their own guidance, standards and lists, in particular the lists referred to in Article 35(4) and (5). The Board shall take into account this national guidance and these national standards and lists when developing the common templates, methodology and lists referred to in these paragraphs.

    Tabled by
    Virginie Joron
    Group
    PfE
    Targets
    GDPR Article 35 – paragraph 6a (new)
    Document
    IMCO amendments 329–532 to the draft opinion
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph 6
  2. 1216 Addition Markéta GregorováGreens/EFA · ITRE–LIBE “For processing operations that are on none of the lists in paragraph 4 and 5, the controller is required to assess the need for a data protection…”

    5a. In Article 35, the following paragraph is inserted:

    For processing operations that are on none of the lists in paragraph 4 and 5, the controller is required to assess the need for a data protection impact assessment.'

    Justification

    To clarify that both lists combined cannot possibly cover the whole universe, but contain the clear edge cases.

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 35 – paragraph 5a (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a / Regulation (EU) 2016/679 / Article 35 – paragraph 5a (new)
  3. 1221 Addition Markéta GregorováGreens/EFA · ITRE–LIBE “The lists referred to in paragraphs 4 and 5 and the template and methodology referred to in paragraph 6 shall be published within [PO insert date: 9…” numbered 6a

    (aa)In Article 35, the following paragraphs 6a, 6b, 6c are inserted:

    6a.The lists referred to in paragraphs 4 and 5 and the template and methodology referred to in paragraph 6 shall be published within [PO insert date: 9 months after the entry into application of this amending Regulation]. The Commission is empowered to decide that the lists, the template and the methodology as established by the Board have general validity within the Union by way of implementing acts in accordance with the examination procedure set out in Article 93(2).

    6b.The lists and the template and methodology referred to in paragraph 6a shall be reviewed by the Board and updated where necessary. The Commission is empowered to decide that the updated list, template and methodology have general validity within the Union by way of an implementing act following the procedure referred to in paragraph 6a.

    6c.Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Board establishes and makes public the lists referred to in paragraphs 4 and 5.

    Justification

    modeled after Article 40(9) GDPR on Codes of Conduct

    Tabled by
    Markéta Gregorová on behalf of the Verts/ALE Group
    Group
    Greens/EFA
    Targets
    GDPR Article 35 – paragraphs 6a, 6b, 6c (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point a a (new) / Regulation (EU) 2016/679 / Article 35 – paragraphs 6a, 6b, 6c (new)
  4. 1230 Addition Irena Joveva +5Renew · ITRE–LIBE “6ba. The Commission may adopt the template and any updates referred to in paragraphs 6a and 6b, as established by the Board, by way of an…”

    In Article 35, the following paragraph 6ba is inserted

    6ba. The Commission may adopt the template and any updates referred to in paragraphs 6a and 6b, as established by the Board, by way of an implementing act following the examination procedure set out in Article 93(2).

    Tabled by
    Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller
    Group
    Renew
    Targets
    GDPR Article 35 – paragraph ba (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 – point b / Regulation (EU) 2016/679 / Article 35 – paragraph ba (new)
  5. 1235 Addition Julie Rechagneux +7ECR, PfE · ITRE–LIBE “Where, in respect of the same processing operation or activity, the controller is required to carry out a data protection impact assessment under…”

    9a. In Article 35, the following paragraph 7a is inserted:

    Where, in respect of the same processing operation or activity, the controller is required to carry out a data protection impact assessment under this Article and is also subject to an obligation to carry out a fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689, or to a reporting obligation in respect of automated monitoring or decision-making systems under other Union law, those obligations may be satisfied by means of a single integrated assessment.

    The integrated assessment shall be deemed to satisfy each of those obligations only where it covers all the elements required by each applicable provision. The substantive requirements, thresholds and triggering conditions laid down in those provisions remain unaffected.

    A data protection impact assessment carried out under this Article that addresses the elements required for the fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689 shall be relied upon in accordance with Article 27(4) of that Regulation, without duplication.

    The integrated assessment shall be made available to each competent authority within the framework of its respective competences. This paragraph does not modify the allocation of supervisory competences under the acts referred to in the first subparagraph, nor does it require submission of the assessment to a single authority.'

    Justification

    Where, for the same processing operation, a controller must carry out a data protection impact assessment under Article 35 and a fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689, or a reporting obligation in respect of automated monitoring systems, those obligations may be satisfied by a single integrated assessment. The assessment satisfies each obligation only where it covers all the elements required by each provision; the substantive requirements, thresholds and triggering conditions remain unaffected. The assessment is made available to each competent authority within its respective competences and is not submitted to a single authority: the documentary instrument is mutualised, not the supervisory competence.

    Tabled by
    Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay
    Group
    ECR, PfE
    Targets
    GDPR Article 35 – paragraph 7a (new)
    Document
    ITRE–LIBE amendments 1053–1260 to the draft report
    Printed header
    Article 3 – paragraph 1 – point 9 a (new) / Regulation (EU) 2016/679 / Article 35 – paragraph 7a (new)