Article 35 – Data protection impact assessment
Changes since10 June 2026ST 10426/26, Art 35
Changes Article 35(6a) and (6b). Every change, paragraph by paragraph
Text as printed
Changes since 10 June · Changes since the Commission proposal
Article 35(4) In every text (Article 35(4))
The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
Article 35(5) In every text (Article 35(5))
The Board shall establish and make public a list of the kind of processing operations for which no data protection impact assessment is required.
Article 35(6) In every text (Article 35(6))
The Board shall establish and make public a common template and a common methodology for conducting data protection impact assessments.
Article 35(6a) In every text (Article 35(6a))
The lists referred to in paragraphs 4 and 5 and the template and methodology referred to in paragraph 6 shall be published within [OP date = 9 months of the entry into application of this Regulation].
Article 35(6b) In every text (Article 35(6b))
The lists and the template and methodology referred to in paragraph 6a- shall be reviewed by the Board at least every three years and updated where necessary.
The Commission may adopt the template and any updates referred to in paragraphs 6a and 6b, as established by the Board, by way of an implementing act following the examination procedure set out in Article 93(2).
Article 35(6c) In every text (Article 35(6c))
Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Board establishes and makes public the lists referred to in paragraph 4 and 5.