Article 35

4. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.By …[PO please insert date: nine months from the entry into application of this amending Regulation] the Board shall establish and make public: (a) a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1; (b) a list of the kind of processing operations for which no data protection impact assessment is required; (c) a common template and a common methodology for conducting data protection impact assessments.

5. The Board shall prepare and transmit to the Commission a proposal for a list of the kind of processing operations for which no data protection impact assessment is required.

6. The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments.

6a. The proposals for the lists referred to in paragraphs 4 and 5 and for the template and methodology referred to in paragraph 6 shall be submitted to the Commission within [OP date = 9 months of the entry into application of this Regulation]. The Commission aftermay dueadopt considerationthe reviews them,template as necessary,established andby isthe empowered to adopt themBoard by way of an implementing act in accordance with the examination procedure set out in Article 93(2) of this Regulation.

6b. The lists and the template and methodology referred to in paragraph 6a-shall4 shall be reviewed by the Board at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates following the procedure in paragraph 6a.The Commission may adopt any updates of the template by way of an implementing act in accordance with the procedure referred to in paragraph 6a.

6c. Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the CommissionBoard adoptsestablishes and makes public the implementing actlists referred to in paragraph 6a4, points (a) and (b).