Article 35

4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.By … [nine months from the entry into application of this amending Regulation], the Board shall establish and make public: (a) a Union-level list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1; (b) a Union-level list of the kind of processing operations for which no data protection impact assessment is required; (c) a common template and a common methodology for conducting data protection impact assessments. The lists referred to in points (a) and (b) shall support the consistent application of this Regulation and shall not prevent supervisory authorities from establishing and making public additional lists of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1, where such processing operations are likely to result in a high risk in the context of the Member State concerned.

4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. In preparing its proposal, the Board shall take due account of the lists established and made public by supervisory authorities and relevant guidance of the Board, and shall ensure that its proposal reflects a consistent and proportionate approximation of the common elements of those lists, focusing on processing operations most likely to result in high risk. Newly identified triggers shall apply prospectively to new processing or materially changed processing.

Justification

Reducing fragmentation and legal uncertainty while ensuring that compliance requirements remain proportionate and focused on genuinely high-risk activities should be at the core of the Digital Omnibus, in order to avoid unnecessary burdens for SMEs.

4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. In preparing its proposal, the Board shall take due account the lists of processing operations established and made public by supervisory authorities and shall ensure that its proposal reflects a consistent and proportionate approximation of the processing operations identified in those lists, taking into account the principle of legal certainty.

4. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

4. The Board shall prepare and transmit to the Commissionpublish a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

4. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

4. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

4. The Board shall prepare and transmit to the Commissionpublish a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

5. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a list of the kind of processing operations for which no data protection impact assessment is required.

5. The Board shall prepare and transmit to the Commissionpublish a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

5. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a list of the kind of processing operations for which no data protection impact assessment is required.

5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.Processing operations not covered by the list in paragraph 4 shall not be subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

5. The Board shall prepare and transmit to the Commissionpublish a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

5a. In Article 35, the following paragraph is inserted:

Justification

To clarify that both lists combined cannot possibly cover the whole universe, but contain the clear edge cases.

6. The Board shall prepare and transmit to the Commission a proposal forestablish a common template and a common methodology for conducting data protection impact assessments.

6. The Board shall prepareestablish and transmitmake to the Commission a proposal forpublic a common template and a common methodology for conducting data protection impact assessments.

6. The Board shall prepare and transmitmake to the Commissionpublic a proposal for a common template and a common methodology for conducting data protection impact assessments.

6a. In Article 35, the following paragraph is inserted:

(aa) In Article 35, the following paragraphs 6a, 6b, 6c are inserted:

Justification

modeled after Article 40(9) GDPR on Codes of Conduct

(aa) In Article 35, paragraph 1 is replaced by the following:

(aa) In Article 35, the following paragraph is inserted:

Justification

The preparation by the Board of common templates, a common methodology and common lists relating to data protection impact assessments contributes to a consistent application of this Regulation. However, this harmonisation of form should not deprive the competent authorities and supervisory authorities of the Member States of their power — recognised in particular in Article 35(4) and (5) — to develop their own guidance, standards and lists reflecting national circumstances. This amendment confirms that the proposals referred to in paragraphs 4, 5 and 6 are without prejudice to that power, and provides that the Board shall take such national guidance, standards and lists into account when preparing the common instruments. This ensures a bottom-up articulation between the national and Union levels, preserving both consistency and the ability of national authorities to address specific national risks.

6a. The proposalsproposal for the listslist referred to in paragraphsparagraph 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2). That list shall be based on convergence area from national authorities and shall not introduce new categories of processing operations that go beyond existing obligations under this Regulation. Processing operations lawfully in place at the time of their initiation shall not be subject to a retroactive obligation to carry out a data protection impact assessment as a result of the adoption of the harmonised list.

6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commissionpublished within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submittedmade public to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission aftermay dueadopt considerationthe reviewscommon them,template asestablished necessary,by andthe isBoard empoweredpursuant to adoptparagraph them4, point (c), by way of an implementing act in accordance with the examination procedure set out in Article 93(2). The Commission shall not modify the substance of the common methodology or of the lists established by the Board pursuant to paragraph 4, points (a) and (b).

6b. The lists and the template and methodology referred to in paragraph 6a-shall6a shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6a.

6b. The lists and the template and methodology referred to in paragraph 6a-shall be reviewed by the Board at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6a.

In Article 35, the following paragraph 6ba is inserted

6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 6a.The lists and the template and methodology referred to in paragraph 6a-shall be reviewed by the Board at least every three years and updated where necessary.

6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 6a.

6ca. In Article 35, the following paragraph is inserted:

(ba) In paragraph 7 of Article 35, points c and d are replaced by the following

9a. In Article 35, the following paragraph 7a is inserted:

Justification

Where, for the same processing operation, a controller must carry out a data protection impact assessment under Article 35 and a fundamental rights impact assessment under Article 27 of Regulation (EU) 2024/1689, or a reporting obligation in respect of automated monitoring systems, those obligations may be satisfied by a single integrated assessment. The assessment satisfies each obligation only where it covers all the elements required by each provision; the substantive requirements, thresholds and triggering conditions remain unaffected. The assessment is made available to each competent authority within its respective competences and is not submitted to a single authority: the documentary instrument is mutualised, not the supervisory competence.

9. Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations.