Article 35 – Data protection impact assessment

The Board shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1.

The Board shall establish and make public a list of the kind of processing operations for which no data protection impact assessment is required.

The lists referred to in paragraphs 4 and 5 shall be published by [OP date = 9 months from the date of entry into application of this Regulation]. These lists shall be reviewed by the Board at least every three years and updated where necessary.

The Board shall prepare and transmit to the Commission a proposal for a common template and a common methodology for conducting data protection impact assessments. The template and methodology shall be submitted to the Commission by [OP date = 9 months from the date of entry into application of this Regulation]. The Commission after due consideration reviews them, as necessary, and is empowered to adopt them by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

The template and methodology referred to in paragraph 6a shall be reviewed at least every three years and updated where necessary. The Board shall submit its assessment and possible proposals for updates to the Commission in due time. The Commission after due consideration of the proposals reviews them and is empowered to adopt any updates by way of an implementing act in accordance with the examination procedure set out in Article 93(2).

Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Board establishes and makes public the lists referred to in paragraph 4 and 5.’