All, I spotted a few more inconsistencies. Sorry there are no line numbers in the work sheet section. Best, Thomas APA 3 Change „transfer“ to „disclosure" Certain data elements (domain name and nameservers) would be required to be disclosed. The lawful basis would be 6(1)b, should personal data be involved, for Registrars and 6 (1)(f) of the GDPR for Registries. 6(1)(f) BPA 4 - does not list a legal basis. The rationale does not really fit in here as the life of registration +35 days would be superseded by the retention according to purpose 1. Also, it seems like the retention to restore the domain name is more a purpose 1 issue that would be justified with 6 I b than a SSR issue. Being able to restore a domain name is more a purpose 1 issue than a purpose 2 issue. My suggestion is to delete this or make it TBD. CPA 3 If CPA3 is TBD, the same should logically apply to BPA3 or both should be treated as BPA3. Just mentioning the inconsistency. I think we should not change it as this was a most controversial joint, but BPA3 does not really fit. CPA 4 covered by APA 4 EPA 1 for registrars: lawful basis missing. Add 6 I f) EPA 1 for registries - lawful basis missing. Add 6 I f) MPA 5 and MPA 6 independent controller - DRPs could also be independent controllers- at least we have not really discussed whether they just follow orders or whether they pursue their own purposes of data processing. I would add „processor or independent controller" NPA 1 Lawful basis: 6 I b add _for registrars_ NPA 5 - should rather be N/A Please note that sometimes we use singular and sometimes plural in the tables. Also, the changes in the work sheets would need to be synced with the summary. Thanks, Thomas