Although Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (General Data Protection Regulation), better known as GDPR, has been in force since 25 May 2018, some of its provisions still require a closer interpretation, in particular by supervisory authorities. One of such provisions is Article 35 of the GDPR, which contains the controller’s duty to carry out an impact assessment on the processing of personal data. For more information on its current interpretation, see an article by colleagues Adam Novák and Eva Radová attached hereto.