Article 35 – Data protection impact assessment
Changes since18 June 2026ST 10677/26, Art 35
Changes Article 35(6), (6a) and (6b). Every change, paragraph by paragraph
Text as printed
Changes since 18 June · Changes since the Commission proposal
9. Article 35 is amended as follows:
Article 35(4) In every text (Article 35(4))
The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.
Article 35(5) In every text (Article 35(5))
The Board shall establish and make public a list of the kind of processing operations for which no data protection impact assessment is required.
Article 35(6) In every text (Article 35(6))
The lists referred to in paragraphs 4 and 5 shall be published by [OP date = 9 months from the date of entry into application of this Regulation]. These lists shall be reviewed by the Board at least every three years and updated where necessary.
Article 35(6a) In every text (Article 35(6a))
The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments. The template and methodology shall be submitted to the Commission by [OP date = 9 months from the date of entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).
Article 35(6b) In every text (Article 35(6b))
The template and methodology referred to in paragraph 6a shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates by way of an implementing act in accordance with the examination procedure set out in Article 93(2).
Article 35(6c) In every text (Article 35(6c))
Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Board establishes and makes public the lists referred to in paragraph 4 and 5.