[{"pubDate":"Thu, 16 Apr 2026 14:15:11 +0200","titre":"EDPB brings clarity to data processing for scientific research, speeds up the finalisation of the anonymisation guidelines and approves first European data protection seal as a tool for transfers","url":"https://www.edpb.europa.eu/news/news/2026/edpb-brings-clarity-data-processing-scientific-research-speeds-finalisation_en","source":"EDPB News","id":2829942,"description":"Brussels, 16 April – During its latest plenary, the EDPB has adopted Guidelines on processing of personal data for scientific research purposes . In addition, the Board has created a team to speed up the finalisation of the guidelines on anonymisation. The EDPB has also adopted two opinions on the two sets of the Europrivacy certification criteria for approval as European Data Protection Seals, one of which to be used as a tool for transfers. Many areas of scientific research rely on the processing of individuals’ personal data, and this has driven significant scientific breakthroughs that benefit society. The rise of new technologies, such as artificial intelligence, also contributes to scientific progress by enabling researchers to use and analyse data in innovative ways. The main objective of the EDPB guidelines on scientific research is to provide more clarity for researchers and make GDPR compliance easier , while ensuring the protection of individuals’ fundamental rights . “Scientific research can drive societal progress and improve our daily lives.  Our guidelines facilitate innovative research by helping researchers to navigate the GDPR. The EDPB is committed to supporting the scientific community and unlocking the full potential of scientific research in the EU while upholding data protection rights.\" EDPB Chair, Anu Talus In its guidelines, the Board provides clarifications on the concept of ‘scientific research’ . To determine if the processing takes place for scientific research purposes in the meaning of the GDPR, the Board provides six key-indicative factors that should be considered, in addition to the nature, scope, context and purposes of processing. These are: 1) methodical and systematic approach, 2) adherence to ethical standard, 3) verifiability and transparency, 4) autonomy and independence, 5) objectives of the research, and 6) potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways. If the research activities meet these six factors, they can be presumed to constitute scientific research. Otherwise, the controller should justify and be able to demonstrate why the activities should be considered scientific research, within the meaning of the GDPR. Further processing for scientific research purposes is presumed to be compatible with the initial purpose for collecting individuals’ personal data. Therefore, controllers are not obliged to do the purpose compatibility test under the GDPR to determine if the new processing is compatible with the original purpose of collection. However, controllers must still make sure that the legal basis of the initial processing is also suitable for the further processing of personal data for scientific research purposes. Controllers can rely on “broad consent” where the purposes of research are not fully known at the time of collecting the personal data. In this case, researchers should respect ethical standards for scientific research and put additional safeguards in place to compensate for the lack of purpose specification. Controllers can also ask individuals to consent to different individual research projects separately, as soon as the purposes of those projects become known (dynamic consent). A combination of both broad and dynamic consent is also possible. In addition, the EDPB clarifies rights of individuals when their personal data are processed for scientific purposes. This includes the rights to erasure and object for which limitations may apply when personal data are processed for scientific research purposes. The Board provides examples to explain when the right to erasure can be considered likely to render impossible or seriously impair the objective of conducting scientific research. The EDPB also explains when controllers may reject an individuals’ objection to the processing of their personal data for scientific research purposes. This can be the case when processing is necessary for the performance of a task carried out for reasons of"},{"source":"EDPB News","description":"Brussels, 09 April - The European Data Protection Board (EDPB) has published its  2025 Annual Report . The report provides an overview of the EDPB work carried out in 2025 and reflects on important milestones, such as the adoption of the  Helsinki Statement on Enhanced Clarity, Support, and Engagement . “In 2025, we saw the data protection landscape change significantly. The rapid expansion of the EU’s digital regulatory framework has added complexity to the data protection ecosystem. To help organisations navigate this complexity and support compliance, the EDPB focused on enhancing legal certainty, making compliance more achievable in practice, and strengthening cooperation, both among Data Protection Authorities and with other regulators.  We also prioritised meaningful dialogue with stakeholders to ensure our work reflected real-world needs. Our achievements support economic growth while continuing to protect individuals’ fundamental rights to privacy and data protection.” EDPB Chair, Anu Talus   The Helsinki’s statement initiatives leading the way In 2025, the EDPB worked actively to address the demand for regulatory simplification to support innovation and economic growth, while ensuring the protection of individuals’ personal data.  With this in mind, the Board adopted the  Helsinki Statement on Enhanced Clarity, Support, and Engagement , which outlines new initiatives to  make GDPR compliance easier, strengthen consistency, enhance the dialogue and improve transparency with stakeholders and boost cross-regulatory cooperation .   For example, the Board launched a public consultation to ask organisations which templates would be most useful, organised several stakeholder events to consult organisations on upcoming guidelines and systematically published reports on stakeholder input.    Easing compliance for organisations and providing legal advice In the context of ongoing discussions on regulatory simplification at EU level, the EDPB actively contributed to legislative initiatives aimed at reducing administrative burden and streamlining requirements. The Board adopted a  joint opinion with the European Data Protection Supervisor (EDPS) on the Commission’s Proposal for a Regulation amending certain regulations, including the GDPR.  In addition, the Board held important discussions on this matter during plenary meetings, which subsequently informed the  EPDB/EDPS joint opinions on the Commission’s proposals on the  Digital Omnibus and on the  Digital Omnibus on AI adopted at the beginning of 2026. The Board also delivered five adequacy-related opinions concerning United Kingdom, Brazil and the European Patent Organisation (EPO).  In addition, the Board adopted  Recommendations on the legal basis for requiring the creation of user accounts on e-commerce websites , and  Recommendations on the 2027 WADA World Anti-Doping Code  upon request from the Commission.   Strengthening cross-regulatory cooperation Cross-regulatory cooperation was a key focus for the EDPB last year. The EDPB worked together with the European Commission to clarify how data protection and digital laws interact and to address legal and practical challenges in cross-sectoral cases. In 2025, the EDPB adopted its first set of  joint guidelines with the Commission on the interplay between the Digital Markets Act (DMA) and the GDPR . The Board also worked with the Commission on joint guidelines on the interplay between the AI act and EU data protection laws for adoption in 2026.  In addition, the EDPB adopted  guidelines on the interplay between the Digital Services Act (DSA) and the GDPR .   Placing stakeholders at the heart of the EDPB work In 2025, a public consultation was launched on the  joint guidelines with the Commission on the DMA and the GDPR . The Board has also organised public consultations on the EDPB guidelines on  DSA and GDPR","id":2816021,"titre":"EDPB annual report 2025: supporting stakeholders through guidance and dialogue","url":"https://www.edpb.europa.eu/news/news/2026/edpb-annual-report-2025-supporting-stakeholders-through-guidance-and-dialogue_en","pubDate":"Thu, 09 Apr 2026 14:14:02 +0200"},{"url":"https://www.edpb.europa.eu/news/news/2025/dma-and-gdpr-edpb-and-european-commission-endorse-joint-guidelines-clarify-common_en","titre":"DMA and GDPR: EDPB and European Commission endorse joint guidelines to clarify common touchpoints","pubDate":"Thu, 09 Oct 2025 15:53:21 +0200","source":"EDPB News","description":"Brussels, 09 October - The European Data Protection Board (EDPB) and the European Commission endorsed joint guidelines on the interplay between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR) . These are the first joint guidelines by the Board and the European Commission. In line with its 2024-2027 Strategy and the recent Helsinki Statement’s objectives to make GDPR compliance easier and strengthen consistency, the EDPB has cooperated with the European Commission, each within their respective mandates, to facilitate the coherent application of the DMA*and GDPR and to increase legal certainty for gatekeepers, business users, beneficiaries and individuals. EDPB Chair Anu Talus said:   “These joint guidelines are the result of a fruitful cooperation between the EDPB and the European Commission. This is the first time that the EDPB and the European Commission prepare guidelines jointly. This approach maximises usefulness of the guidance by simplifying compliance for businesses and bringing enhanced legal certainty to them.  The guidelines will help gatekeepers, business users and individuals to better understand their obligations and rights under the DMA, and ensure a consistent, effective and complementary application of the DMA and EU data protection law.” How the DMA and the GDPR interact The DMA and the GDPR both protect individuals in the digital landscape , but their goals are complementary as they address interconnected challenges: individual rights and privacy in case of the GDPR and fairness and contestability of digital markets under the DMA.    Several activities regulated by the DMA entail the processing of personal data by gatekeepers and, in several provisions, the DMA explicitly refers to definitions and concepts included in the GDPR. The joint guidelines clarify how gatekeepers can implement these DMA provisions in accordance with EU data protection law . For example, the EDPB and the Commission specify which elements gatekeepers should consider in order to comply with the requirements of specific choice and valid consent under Art. 5(2) DMA and the GDPR, and thus to lawfully combine or cross-use personal data in core platform services. The EDPB and the Commission also address other provisions including those related to the distribution of third party apps and stores, data portability, data access requests and interoperability of messaging services.   Next steps The Board and the Commission have just launched a joint public consultation on the first version of the guidelines which will be open until 4 December 2025 .  This will be an opportunity for stakeholders to comment and provide feedback. All submissions will be published on the DMA website to which a link will be included on the EDPB website, after the consultation period has closed. The final text, incorporating input received during the consultation, will be prepared jointly by the Board and the Commission, and will be adopted by the EDPB and European Commission.   More guidelines on the way Following these first joint guidelines with the Commission, further work is underway to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working with the Commission, specifically with the AI Office, on joint guidelines on the interplay between the AI Act and EU data protection laws. Note to editors: The Digital Markets Act is one of the first regulatory tools that aims to tackle unfair practices of gatekeepers in digital markets. Gatekeepers are large digital platforms providing core platform services, such as online search engines, app stores, and messenger services. The main objective of the DMA is to make the markets in the digital sector fairer and more contestable. ","id":2425502},{"pubDate":"Fri, 12 Sep 2025 15:51:31 +0200","titre":"Interplay between the DSA and the GDPR: EDPB adopts guidelines","url":"https://www.edpb.europa.eu/news/news/2025/interplay-between-dsa-and-gdpr-edpb-adopts-guidelines_en","id":2368407,"description":"Brussels, 12 September - During its September plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR) . These are the first set of EDPB guidelines on the interplay between the GDPR and the EU’s recently adopted digital laws. The DSA aims to complement the rules of the GDPR to ensure the highest level of protection of fundamental rights in the digital space. Its main goal is to create a safer online environment in which the fundamental rights of all users, including the right to freedom of expression, are protected. It applies to online intermediary services , such as search engines and platforms. Several provisions included in the DSA entail the processing of personal data by intermediary service providers. The EDPB guidelines contribute to the consistent application of the DSA and of the GDPR, insofar as some provisions of the DSA concern the processing of personal data by intermediary service providers and include references to GDPR concepts and definitions. While it is up to the competent authorities under the DSA - with the support of the European Board for Digital Services and EU courts - to interpret the DSA, there are a number of provisions which relate to the GDPR. These include: notice-and-action systems that help individuals or entities report illegal content recommender systems used by online platforms to automatically present specific content to the users of the platform with a certain relative order or prominence the provisions to ensure a high level of privacy, safety, and security of minors and prohibiting that profile-based advertising using their data is presented to them transparency of advertising by online platforms prohibition of profiling-based advertising using special categories of data  The EDPB guidelines help to understand how the GDPR should be applied in the context of DSA obligations. The EDPB also provides practical guidance relating to the cross-regulatory cooperation between authorities to coordinate enforcement which will provide more legal certainty for intermediary service providers and ultimately to protect the rights and freedoms of individuals. The guidelines will be subject to public consultation, providing stakeholders with the opportunity to comment and provide feedback. EDPB Chair Anu Talus said: “By clarifying the interplay between the DSA and the GDPR, these guidelines mark a significant step towards ensuring a coherent and effective EU digital rulebook, and they will help uphold the fundamental rights and freedoms of individuals. I hope that stakeholders, including the competent authorities under the DSA, will make the most of the opportunity to contribute to the public consultation\". More work in the pipeline Following these first guidelines on the interplay between the GDPR and the DSA, further work is underway with other regulators to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working on joint guidelines with the European Commission on the interplay between the Digital Markets Act (DMA) and the GDPR, as well as on joint guidelines on the interplay between the AI Act and EU data protection laws.","source":"EDPB News"},{"pubDate":"Wed, 18 Dec 2024 15:47:16 +0100","url":"https://www.edpb.europa.eu/news/news/2024/edpb-opinion-ai-models-gdpr-principles-support-responsible-ai_en","titre":"EDPB opinion on AI models: GDPR principles support responsible AI","id":1792119,"description":"Brussels, 18 December - The European Data Protection Board (EDPB) has adopted an opinion* on the use of personal data for the development and deployment of AI models . This opinion looks at 1) when and how AI models can be considered anonymous, 2) whether and how legitimate interest can be used as a legal basis for developing or using AI models, and 3) what happens if an AI model is developed using personal data that was processed unlawfully. It also considers the use of first and third party data. The opinion was requested by the Irish Data Protection Authority (DPA) with a view to seeking Europe-wide regulatory harmonisation. To gather input for this opinion, which deals with fast-moving technologies that have an important impact on society, the EDPB organised a stakeholders’ event and had an exchange with the EU AI Office. EDPB Chair Talus said: “AI technologies may bring many opportunities and benefits to different industries and areas of life. We need to ensure these innovations are done ethically, safely, and in a way that benefits everyone. The EDPB wants to support responsible AI innovation by ensuring personal data are protected and in full respect of the General Data Protection Regulation (GDPR).” Regarding anonymity , the opinion says that whether an AI model is anonymous should be assessed  on a case by case basis by the DPAs. For a model to be anonymous, it should be very unlikely (1) to directly or indirectly identify individuals whose data was used to create the model, and (2) to extract such personal data from the model through queries. The opinion provides a non-prescriptive and non-exhaustive list of methods to demonstrate anonymity. With respect to legitimate interest , the opinion provides general considerations that DPAs should take into account when they assess if legitimate interest is an appropriate legal basis for processing personal data for the development and the deployment of AI models. A three-step test helps assess the use of legitimate interest as a legal basis. The EDPB gives the examples of a conversational agent to assist users, and the use of AI to improve cybersecurity. These services can be beneficial for individuals and can rely on legitimate interest as a legal basis, but only if the processing is shown to be strictly necessary and the balancing of rights is respected. The opinion also includes a number of criteria to help DPAs assess if individuals may reasonably expect certain uses of their personal data. These criteria include: whether or not the personal data was publicly available, the nature of the relationship between the individual and the controller, the nature of the service, the context in which the personal data was collected, the source from which the data was collected, the potential further uses of the model, and whether individuals are actually aware that their personal data is online. If the balancing test shows that the processing should not take place because of the negative impact on individuals, mitigating measures may limit this negative impact. The opinion includes a non-exhaustive list of examples of such mitigating measures, which can be technical in nature, or make it easier for individuals to exercise their rights or increase transparency. Finally, when an AI model was developed with unlawfully processed personal data, this could have an impact on the lawfulness of its deployment, unless the model has been duly anonymised. Considering the scope of the request from the Irish DPA, the vast diversity of AI models and their rapid evolution, the opinion aims to give guidance on various elements that can be used for conducting a case by case analysis. In addition, the EDPB is currently developing guidelines covering more specific questions, such as web scraping. Note to editors: *An Article 64(2) opinion addresses a matter of general application or produces effects in more than one Member","source":"EDPB News"}]