[{"source":"EDPB News","description":"Brussels/Frankfurt, 1 July – The EDPB and the Anti-Money Laundering Authority (AMLA) are working together to bring greater clarity to a question of growing importance for industry and authorities alike: how to share information to fight financial crime while protecting personal data. Why information sharing matters The fight against financial crime depends on cooperation, and information sharing can help detect and prevent money laundering and terrorist financing. Art. 75 of the AML Regulation makes this possible, allowing companies and professionals covered by anti-money laundering rules to share information with each other and with public authorities, within clear limits. The new information sharing possibility will apply from 10 July 2027. To provide clarity on this possibility, the EDPB and AMLA will work together on the development of Joint Guidelines.   Clearer rules for industry and authorities Sharing information of this kind means processing personal data, which is why data protection safeguards are essential. The Joint Guidelines, developed by the EDPB and AMLA, will set out in practical terms how partnerships can be built so that effective information sharing and the protection of personal data go hand in hand. This will give everyone involved, from companies and supervisors to FIUs and data protection authorities, more clarity on how to set up successful partnerships. Share your perspective Input from industry and stakeholders will be essential to the success of this work. The EDPB and AMLA will hold an event later this year to gather early views on the elements that would benefit from clarification in the Joint Guidelines. In addition, the EDPB and AMLA are planning to launch a public consultation on the draft Guidelines in the first half of 2027. A joint drafting team with members from both the EDPB and AMLA will lead the work. Further details on the scope and content of the Guidelines will be shared as the work","id":2999895,"url":"https://www.edpb.europa.eu/news/edpb-and-amla-to-develop-joint-guidelines-on-partnerships-for-information-sharing_en","titre":"EDPB and AMLA to develop Joint Guidelines on partnerships for information sharing","pubDate":"Wed, 01 Jul 2026 14:14:11 +0200"},{"pubDate":"Thu, 19 Mar 2026 14:12:59 +0100","titre":"CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations under the GDPR","url":"https://www.edpb.europa.eu/news/news/2026/cef-2026-edpb-launches-coordinated-enforcement-action-transparency-and-information_en","source":"EDPB News","id":2769535,"description":"Brussels, 19 March - The EDPB has launched its Coordinated Enforcement Framework (CEF) action for 2026*. Following a year-long coordinated action on the right to erasure in 2025 , the CEF's focus this year will shift to compliance with the obligations of transparency and information under the GDPR . The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more control over their data. Next steps During 2026, 25 Data Protection Authorities (DPAs) across Europe will take part in this initiative. They will look closely to assess the compliance of controllers with their transparency obligations under the GDPR. Participating DPAs will soon contact controllers from different sectors across Europe, either through enforcement actions or fact-finding exercises. In the latter case, they might also decide to undertake additional follow-up actions if needed. During the second half of the year, participating DPAs will share and discuss their findings together, with a view to aggregate the results of their national actions and generate deeper insight into the topic. A consolidated report will then be drafted and submitted for adoption by the EDPB, allowing for targeted follow-ups on both national and EU levels. Background The CEF is a key action of the EDPB under its 2024-2027 Strategy , aimed at streamlining enforcement and cooperation among DPAs. In 2023, the EDPB published the report on its first coordinated action on the use of cloud-based services by the public sector . In 2024, the EDPB also published the report on the outcome of the second coordinated action on the designation and position of Data Protection Officers . In 2025, the EDPB issued the report on its third coordination action on the implementation of the right of access . In 2026, the EDPB has adopted a report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) .   Note to editors: *The Board selected this topic during its October 2025 plenary"},{"pubDate":"Wed, 18 Feb 2026 15:27:14 +0100","titre":"EDPB identifies challenges hindering the full implementation of the right to erasure","url":"https://www.edpb.europa.eu/news/news/2026/edpb-identifies-challenges-hindering-full-implementation-right-erasure_en","id":2703238,"description":"Brussels, 18 February - The European Data Protection Board (EDPB) has adopted a  report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) .  The  Board selected this topic  as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. The main objectives of this coordinated action are to ensure that the right to erasure is effectively exercised by individuals in Europe and understand how controllers comply with this right in practice. In addition, the EDPB identified good practices and the most important related challenges, with the aim of providing further guidance on this topic.  Throughout 2025, 32 DPAs across Europe took part in this initiative. More specifically, 9 DPAs have initiated new formal investigations or have continued ongoing ones, and 23 DPAs carried out a fact-finding exercise. A total of 764 controllers across Europe responded to the action, ranging from small and medium-sized enterprises (SMEs) to big companies active in many different industries and fields, as well as various types of public entities. The results of these national actions have been aggregated and analysed together allowing for targeted follow-up on both national and EU level.   Areas of improvement and main challenges The report lists the issues that were identified, along with a series of recommendations addressed to controllers, to help them implement the right to erasure. Seven recurring main challenges were identified by DPAs. The results confirmed some of the findings of the 2024 coordinated action on the right of access , for example when it comes to the lack of appropriate internal procedures to handle requests, or the lack of sufficient information provided to individuals. In addition, participating DPAs reported specific findings related to the reliance by some controllers on inefficient anonymisation techniques to handle erasure requests as an alternative to deletion. DPAs also noted inconsistent practices, and the difficulties faced by controllers regarding the determination of retention periods and the deletion of personal data in the context of back-ups. In addition, as the right to erasure is not an absolute right, some controllers face difficulties in assessing and applying the conditions for the exercise of this right, including in carrying out the different balancing tests between the right to erasure and other rights and freedoms.   Follow-up to help organisations comply  Extensive guidance, documents and templates exist at national level to help controllers comply with the right of erasure and help individuals exercise this right. In line with the Helsinki Statement’s objectives of making GDPR compliance easier and ensuring consistent interpretation and enforcement across Europe, the extensive guidance and templates already available at national level will be leveraged at EDPB level where appropriate.   Background and next steps The CEF is a key action of the EDPB under its 2024-2027 Strategy , aimed at streamlining enforcement and cooperation among DPAs.  In 2023, the EDPB published the report on its first coordinated action on the  use of cloud-based services by the public sector . In 2024, the EDPB also published the report on the outcome of the second coordinated action on the  designation and position of Data Protection Officers . In 2025, the EDPB issued the report on its third coordination action on the  implementation of the right of access . The CEF 2026 action will be on the  obligations of transparency and information under the GDPR .   For further information: DA DPA:   EDPB vedtager rapport om dataansvarliges overholdelse af retten til sletning EL DPA: Ολοκλήρωση της συντονισμένης δράσης του","source":"EDPB News"},{"url":"https://www.edpb.europa.eu/news/news/2025/stakeholder-event-anonymisation-and-pseudonymisation-express-your-interest_en","titre":"Stakeholder event on anonymisation and pseudonymisation: express your interest","pubDate":"Wed, 03 Dec 2025 15:56:01 +0100","description":"Brussels, 17 November - The EDPB organises a remote event to collect  stakeholders’ input on anonymisation and pseudonymisation on implications of the judgement of the Court of Justice of the European Union (CJEU) in EDPS v Single Resolution Board (SRB) . The event will take place on 12 December 2025 (time to be confirmed). This will be an opportunity to inform and support the EDPB’s ongoing work on these topics as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakeholder engagement, as outlined in the recent Helsinki statement .   Who can participate? Individuals representing sector associations, organisations or NGOs and individual companies, law firms or academics are invited to express their interest to participate in this event (one participant per organisation). The EDPB encourages all organisations interested in this matter to delegate a representative with technical knowledge of these topics. As a general rule, participants will be registered on a first-come first-served basis. Nonetheless, the EDPB reserves the right to give precedence to specific stakeholders among those who expressed their interest, based on their relevance to the topics of the event, and to ensure diversity of views and a balanced representation of areas of interest, as well as geographical balance. How to take part? You can find further information and the instructions on how to register (link not available). The call will be closed as soon as a sufficiently high number of applicants is reached with a view to ensuring the participation of a maximum number of stakeholders. If you have technical problems submitting the application, we invite you to refresh the page or open the form in a different browser.    Update on 17/11/2025, 12:57 pm: The call is now closed. Thank you to all those who expressed their interest in taking part in the EDPB stakeholder event on ‘anonymisation and pseudonymisation’. We will carefully review all applications and communicate the results of the process to those who applied in the coming weeks.","id":2548822,"source":"EDPB News"},{"pubDate":"Wed, 03 Dec 2025 15:56:01 +0100","titre":"Support the EDPB’s work as an expert","url":"https://www.edpb.europa.eu/news/news/2025/support-edpbs-work-expert_en","id":2548823,"description":"Brussels, 28 November - The EDPB launched a call for expression of interest to establish a new reserve list for the Support Pool of Experts (SPE) programme . The objective is set up a reserve list of legal and technical experts. The legal expertise sought includes a wide range of fields, such as data protection, policy monitoring, technology, cybersecurity, competition, healthcare, online intermediary services and content moderation . As for the technical expertise , the relevant areas include IT auditing, website security, mobile OS and apps, Internet of Things, cloud-computing, behavioural advertising, anonymisation techniques, cryptology, artificial intelligence, User experience (UX) design, fintech , data science, social science (incl. economics, sociology, psychology), and development of applications and software . Bring your expertise to the table Don’t miss this opportunity to participate in this EDPB’s key strategic initiative. Your work will help Data Protection Authorities (DPAs) across Europe increase their capacity to supervise and enforce data protection rules and strengthen the protection of individuals’ fundamental rights. In 2022, the EDPB issued a call for expression of interest, which led to the establishment of a first SPE reserve list. As this list is set to expire in February 2026, the EDPB is inviting experts who were included in this first SPE reserve list to submit their application in response to the new call for expression of interest. The call will be open until August 2030. Learn how to submit your application . Apply now Background The SPE was developed as part of the EDPB Strategy 2021-2023 to help DPAs increase their enforcement capacity by developing common tools and giving them access to a wide pool of experts.   The EDPB aims to carry out approximately ten projects per year with pre-eminent external experts in a given field.  Projects are coordinated either by individual DPAs or by the EDPB. More information on the SPE and on completed project is available here . ","source":"EDPB News"},{"pubDate":"Thu, 09 Oct 2025 15:53:21 +0200","url":"https://www.edpb.europa.eu/news/news/2025/dma-and-gdpr-edpb-and-european-commission-endorse-joint-guidelines-clarify-common_en","titre":"DMA and GDPR: EDPB and European Commission endorse joint guidelines to clarify common touchpoints","source":"EDPB News","id":2425502,"description":"Brussels, 09 October - The European Data Protection Board (EDPB) and the European Commission endorsed joint guidelines on the interplay between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR) . These are the first joint guidelines by the Board and the European Commission. In line with its 2024-2027 Strategy and the recent Helsinki Statement’s objectives to make GDPR compliance easier and strengthen consistency, the EDPB has cooperated with the European Commission, each within their respective mandates, to facilitate the coherent application of the DMA*and GDPR and to increase legal certainty for gatekeepers, business users, beneficiaries and individuals. EDPB Chair Anu Talus said:   “These joint guidelines are the result of a fruitful cooperation between the EDPB and the European Commission. This is the first time that the EDPB and the European Commission prepare guidelines jointly. This approach maximises usefulness of the guidance by simplifying compliance for businesses and bringing enhanced legal certainty to them.  The guidelines will help gatekeepers, business users and individuals to better understand their obligations and rights under the DMA, and ensure a consistent, effective and complementary application of the DMA and EU data protection law.” How the DMA and the GDPR interact The DMA and the GDPR both protect individuals in the digital landscape , but their goals are complementary as they address interconnected challenges: individual rights and privacy in case of the GDPR and fairness and contestability of digital markets under the DMA.    Several activities regulated by the DMA entail the processing of personal data by gatekeepers and, in several provisions, the DMA explicitly refers to definitions and concepts included in the GDPR. The joint guidelines clarify how gatekeepers can implement these DMA provisions in accordance with EU data protection law . For example, the EDPB and the Commission specify which elements gatekeepers should consider in order to comply with the requirements of specific choice and valid consent under Art. 5(2) DMA and the GDPR, and thus to lawfully combine or cross-use personal data in core platform services. The EDPB and the Commission also address other provisions including those related to the distribution of third party apps and stores, data portability, data access requests and interoperability of messaging services.   Next steps The Board and the Commission have just launched a joint public consultation on the first version of the guidelines which will be open until 4 December 2025 .  This will be an opportunity for stakeholders to comment and provide feedback. All submissions will be published on the DMA website to which a link will be included on the EDPB website, after the consultation period has closed. The final text, incorporating input received during the consultation, will be prepared jointly by the Board and the Commission, and will be adopted by the EDPB and European Commission.   More guidelines on the way Following these first joint guidelines with the Commission, further work is underway to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working with the Commission, specifically with the AI Office, on joint guidelines on the interplay between the AI Act and EU data protection laws. Note to editors: The Digital Markets Act is one of the first regulatory tools that aims to tackle unfair practices of gatekeepers in digital markets. Gatekeepers are large digital platforms providing core platform services, such as online search engines, app stores, and messenger services. The main objective of the DMA is to make the markets in the digital sector fairer and more contestable. "},{"source":"EDPB News","id":2368407,"description":"Brussels, 12 September - During its September plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR) . These are the first set of EDPB guidelines on the interplay between the GDPR and the EU’s recently adopted digital laws. The DSA aims to complement the rules of the GDPR to ensure the highest level of protection of fundamental rights in the digital space. Its main goal is to create a safer online environment in which the fundamental rights of all users, including the right to freedom of expression, are protected. It applies to online intermediary services , such as search engines and platforms. Several provisions included in the DSA entail the processing of personal data by intermediary service providers. The EDPB guidelines contribute to the consistent application of the DSA and of the GDPR, insofar as some provisions of the DSA concern the processing of personal data by intermediary service providers and include references to GDPR concepts and definitions. While it is up to the competent authorities under the DSA - with the support of the European Board for Digital Services and EU courts - to interpret the DSA, there are a number of provisions which relate to the GDPR. These include: notice-and-action systems that help individuals or entities report illegal content recommender systems used by online platforms to automatically present specific content to the users of the platform with a certain relative order or prominence the provisions to ensure a high level of privacy, safety, and security of minors and prohibiting that profile-based advertising using their data is presented to them transparency of advertising by online platforms prohibition of profiling-based advertising using special categories of data  The EDPB guidelines help to understand how the GDPR should be applied in the context of DSA obligations. The EDPB also provides practical guidance relating to the cross-regulatory cooperation between authorities to coordinate enforcement which will provide more legal certainty for intermediary service providers and ultimately to protect the rights and freedoms of individuals. The guidelines will be subject to public consultation, providing stakeholders with the opportunity to comment and provide feedback. EDPB Chair Anu Talus said: “By clarifying the interplay between the DSA and the GDPR, these guidelines mark a significant step towards ensuring a coherent and effective EU digital rulebook, and they will help uphold the fundamental rights and freedoms of individuals. I hope that stakeholders, including the competent authorities under the DSA, will make the most of the opportunity to contribute to the public consultation\". More work in the pipeline Following these first guidelines on the interplay between the GDPR and the DSA, further work is underway with other regulators to clarify the new cross-regulatory landscape and maintain coherent and consistent safeguards for the protection of personal data. In this regard, the EDPB is working on joint guidelines with the European Commission on the interplay between the Digital Markets Act (DMA) and the GDPR, as well as on joint guidelines on the interplay between the AI Act and EU data protection laws.","pubDate":"Fri, 12 Sep 2025 15:51:31 +0200","url":"https://www.edpb.europa.eu/news/news/2025/interplay-between-dsa-and-gdpr-edpb-adopts-guidelines_en","titre":"Interplay between the DSA and the GDPR: EDPB adopts guidelines"},{"titre":"European Patent Organisation and extension of adequacy decisions for the UK: EDPB adopts opinions","url":"https://www.edpb.europa.eu/news/news/2025/european-patent-organisation-and-extension-adequacy-decisions-uk-edpb-adopts_en","pubDate":"Tue, 06 May 2025 15:51:59 +0200","description":"Brussels, 06 May - During its latest plenary, the European Data Protection Board (EDPB) adopted an opinion on the European Commission’s draft adequacy decision under the GDPR concerning the European Patent Organisation (EPO) . In addition, the Board adopted an opinion on the European Commission’s proposal to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED) . Finally, the EDPB agreed to grant the status of observer to the Personal Data Protection Agency of Bosnia and Herzegovina.   Adequate protection of personal data by the EPO At the European Commission’s request, the Board adopted an opinion on the Commission’s draft adequacy decision regarding the European Patent Organisation (EPO). Once formally adopted by the Commission, this will be the first adequacy decision concerning an international organisation and not a country or a region. An adequacy decision is a key-mechanism in EU data protection legislation which allows the European Commission to determine whether a third country or an international organisation offers an adequate level of data protection. The effect of such a decision is that personal data can flow freely from Europe to that third country or international organisation. EDPB Chair, Anu Talus, said: “The EDPB welcomes the Commission’s initiative to work on the first adequacy decision concerning an international organisation. This decision shows how the legal framework of such organisations can be recognised as ensuring an adequate level of protection on the basis of Art.45 GDPR. The EDPB underlines the importance of ongoing dialogue between the Commission and international organisations, with a view to developing this category of adequacy decisions in addition to those relating to third countries.” In its opinion, the Board positively notes that the EPO data protection framework is largely aligned with the European Union data protection framework, including on data protection rights and principles. This shows that the GDPR and, in particular, its transfer provisions, can facilitate safe data flows from Europe to international organisations, while taking into account their status.   Six-month extension of the UK adequacy decisions The EDPB opinion, requested by the European Commission, addresses the proposed extension of the two UK adequacy decisions under the GDPR and the LED, which are set to expire on 27 June 2025. The opinion only concerns the proposed 6-month extension of these adequacy decisions and does not address the level of protection for personal data afforded in the UK, which will be examined by the EDPB following the Commission’s assessment, and if the renewal of the UK adequacy decisions is proposed. Since the UK‘s data protection reform is still pending in the UK parliament, the EDPB recognises the need for a technical and time-limited extension of the adequacy decisions until 27 December 2025.This will give the European Commission sufficient time to evaluate the updated UK legal framework once it has been adopted.   The EDPB stresses that this extension is exceptional and is due to the ongoing legislative developments in the UK. It should not, in principle, be further prolonged. The Board recalls the validity of its opinions 14/2021 and 15/2021 on the two UK adequacy decisions, adopted in April 2021, and invites the European Commission to take them into account in its future assessments.  The Board also recalls the Commission’s obligation to monitor all relevant developments in the UK during the extension period.   New observer to the EDPB’s activities Finally, EDPB members agreed to grant observer status to the EDPB’s activities to the Bosnia and Herzegovina Data Protection Authority, in line with Art. 8 EDPB Rules of Procedure .","id":2099053,"source":"EDPB News"}]