Article 35 – Data protection impact assessment

The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

The Board shall establish and make public a list of the kind of processing operations for which no data protection impact assessment is required.

The Board shall establish and make public a common template and a common methodology for conducting data protection impact assessments.

The lists referred to in paragraphs 4 and 5 and the template and methodology referred to in paragraph 6 shall be published within [OP date = 9 months of the entry into application of this Regulation]. The Commission may adopt the template as established by the Board by way of an implementing act, in accordance with the examination procedure set out in Article 93(2).

The lists and the template and methodology referred to in paragraph 6a- shall be reviewed by the Board at least every three years and updated where necessary. Where the the Commission has adopted the previous version of the template by way of an implementing act, it shall adopt any updates of the template by way of an implementing act following the procedure referred to in paragraph 6a.

Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Board establishes and makes public the lists referred to in paragraph 4 and 5.