: Si quelqu'un vous demandait de répondre à 100 questions sur votre vie personnelle pour vendre les réponses, seriez-vous d'accord? Probablement pas. Il peut être difficile de garder le contrôle de vos données personnelles et de les garder en sécurité. Des achats en ligne et de la navigation aux médias sociaux, à chaque clic, partage et connexion, vous laissez derrière vous une trace numérique. Le RGPD garantit que vos données ne peuvent être utilisées que d'une manière que vous acceptez et que vous pouvez accéder à toute information vous concernant. Mais les gens savent-ils réellement comment protéger leurs données? Nous avons demandé aux passants dans les rues de Bruxelles. Bonne journée de la protection des données! Sorry, your browser doesn't support embedded
: If someone asked you to answer 100 questions about your personal life to sell the answers, would you agree? Most likely not. It can be difficult to keep in control over your personal data and to keep it safe. From online shopping and browsing to social media, with every click, share and login-in you leave behind a digital trail. The GDPR ensures that your data can only be used in ways you agree to and that you can access any information about yourself. But do people actually know how to protect their data? We asked passers-by on the streets of Brussels. Happy Data Protection Day! Sorry, your browser doesn't support embedded
: Brussels, 13 February - The EDPB published the Coordinated Supervision Committee's (CSC) biannual activity report (July 2022 - December 2024) . Over the last two years, the CSC worked on the integration of the large-scale EU information technology (IT) systems within its scope. During the reporting period, it took over the supervision of the upgraded Schengen Information System (SIS) and the Visa Information System (VIS). In addition, the Committee prepared for the arrival of new systems and for the implementation of interoperability regulations. The Committee has also published a set of recommendations on the Internal Market Information System (IMI) transparency obligations for data controllers . In addition, in July 2023, the CSC published ‘Europol’s information systems - a guide for exercising data subjects’ rights: the right of access, rectification, erasure and restriction’ . Following the 2022 Audit Report of the EDPS on Europol’s processing of personal data of minors under 15 years old, provided to Eu[...]
: Brussels, 05 March - The European Data Protection Board (EDPB) has launched its Coordinated Enforcement Framework (CEF) action for 2025. Following a year-long coordinated action on the right of access in 2024 , the CEF's focus this year will shift to the implementation of another data protection right, namely the right to erasure or the “right to be forgotten” (Art.17 GDPR). The Board selected this topic during its October 2024 plenary as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. Next steps During 2025, 32 Data Protection Authorities (DPAs) across Europe will take part in this initiative. Participating DPAs will soon contact a number of controllers from different sectors across Europe, either by opening new formal investigations or doing fact-finding exercises. In the latter case, they might also decide to undertake additional follow-up actions if needed. DPAs will check how controllers handle and respond to the requests fo[...]
: Bruxelles, le 5 mars - Le comité européen de la protection des données (CEPD) a lancé son action relative au cadre coordonné de mise en œuvre (CEF) pour 2025. À la suite d’une action coordonnée d’un an sur le droit d’accès en 2024, le CEF se concentrera cette année sur la mise en œuvre d’un autre droit à la protection des données, à savoir le droit à l’effacement ou le «droit à l’oubli» (article 17 du RGPD). Le comité a choisi ce sujet lors de sa session plénière d’octobre 2024, car il s’agit de l’un des droits les plus fréquemment exercés au titre du RGPD et au sujet duquel les APD reçoivent fréquemment des plaintes de particuliers. Prochaines étapes En 2025, 32 autorités de protection des données (APD) de toute l’Europe participeront à cette initiative. Les APD participantes contacteront bientôt un certain nombre de contrôleurs de différents secteurs à travers l’Europe, soit en ouvrant de nouvelles enquêtes formelles, soit en effectuant des exercices d’établissement des faits. Dans ce dernier cas, ils pour[...]
: Brussels, 14 March - During its March 2025 plenary meeting, the European Data Protection Board (EDPB) adopted a statement on the implementation of the Passenger Name Record Directive (PNR) in light of the Court of Justice of the EU (CJEU) judgment C-817/19 *. In its second statement on the implementation of the PNR Directive, which follows the one of 15 December 2022 , the Board gives further guidance to the Passenger Information Units (PIUs)** on the necessary adaptions and limitations to the processing of PNR data, following the PNR judgment. PNR data is personal information provided by passengers, and collected and held by air carriers that includes the names of the passengers, travel dates, itineraries, seats, baggage, contact details and means of payment. The statement includes practical recommendations for the national laws transposing the PNR Directive in order to give effect to the findings of the CJEU in the PNR judgment. The recommendations cover some of the key aspects of the PNR judgement such as[...]
: Bruxelles, le 14 mars - Lors de sa réunion plénière de mars 2025, le comité européen de la protection des données (CEPD) a adopté une déclaration sur la mise en œuvre de la directive relative aux données des dossiers passagers (PNR) à la lumière de l’arrêt de la Cour de justice de l’Union européenne (CJUE) dans l’affaire C-817/19*. Dans sa deuxième déclaration sur la mise en œuvre de la directive PNR, qui fait suite à celle du 15 décembre 2022 , le comité donnedes orientations supplémentaires aux unités de renseignements passagers** sur les adaptations et limitations nécessaires au traitement des données des dossiers passagers, à la suite de l’arrêt PNR . Les données des dossiers passagers sont des informations personnelles fournies par les passagers, collectées et conservées par les transporteurs aériens, qui comprennent les noms des passagers, les dates de voyage, les itinéraires, les sièges, les bagages, les coordonnées et les moyens de paiement. La déclaration comprend des recommandations pratiques pour [...]
: Brussels, 14 April - During its April 2025 plenary, the European Data Protection Board (EDPB) has adopted guidelines on processing of personal data through blockchain technologies . A blockchain is a distributed digital ledger system that can confirm transactions and establish who owned a digital asset (such as cryptocurrency) at a given time. Blockchains can also support the secure handling and transfer of data, ensuring its integrity and traceability. As the use of blockchain technologies is expanding, the Board considers it important to help organisations using these technologies to comply with the GDPR. In its guidelines, the EDPB explains how blockchains work, assessing the different possible architectures and their implications for the processing of personal data. The guidelines highlight the importance of implementing technical and organisational measures at the earliest stages of the design of the processing. The EDPB also clarifies that the roles and responsibilities of the different [...]
: Brussels, 23 April - The European Data Protection Board (EDPB) has published its 2024 Annual Report . The report provides an overview of the EDPB work carried out in 2024 and reflects on important milestones, such as the adoption of the 2024-2027 strategy , the increase in Art. 64(2) consistency opinions and the continued efforts to provide guidance and legal advice. EDPB Chair Anu Talus said: “As I look back on the work carried out over the past year, I am proud to present our achievements. In 2024, we reaffirmed our commitment to safeguarding individuals’ fundamental rights to privacy and data protection in a fast-changing digital landscape. We adopted a new strategy and continued to play a central role in providing guidance and ensuring a consistent application of the General Data Protection Regulation (GDPR) across Europe. To support understanding and implementation of data protection rights and duties, we expanded our outreach activities by devoting special attention to businesses and non-expert individ[...]
: Bruxelles, le 23 avril - Le comité européen de la protection des données (CEPD) a publié son rapport annuel 2024. Le rapport donne un aperçu des travaux du comité européen de la protection des données menés en 2024 et examine les étapes importantes, telles que l’adoption de la stratégie 2024-2027, l’augmentation des avis de cohérence au titre de l’article 64, paragraphe 2, et la poursuite des efforts visant à fournir des orientations et des conseils juridiques. Le président ducomité européen de la protection des données, Anu Talus, a déclaré: «En revenant sur le travail accompli au cours de l’année écoulée, je suis fier de présenter nos réalisations. En 2024, nous avons réaffirmé notre engagement à protéger les droits fondamentaux des personnes à la vie privée et à la protection des données dans un paysage numérique en mutation rapide. Nous avons adopté une nouvelle stratégie et avons continué à jouer un rôle central en fournissant des orientations et en assurant une application cohérente du règlement g[...]
: Every year, on 9 May, people across Europe celebrate the anniversary of the Schuman Declaration, which was a milestone to bring peace and solidarity in Europe. This year is particularly special as it marks the 75th anniversary of this historic moment. Let’s celebrate together To celebrate this occasion, the EDPB takes part in the EU Open Day, with an interactive stand hosted by volunteers from the EDPB Secretariat and national Data Protection Authorities (DPAs). Come and visit us to learn more about data protection and the EDPB’s activities. You will find the EDPB and EDPS stands at the European Commission’s headquarters - the Berlaymont building - Village 1 “A Democratic Union”, on Saturday 10 May from 10:00 to 18:00. Do you want to learn more about privacy and data protection — and test your knowledge? Come visit us for fun activities and quizzes designed just for you! Further information about Europe Day 2025
: Bruxelles, le 6 mai – Lors de sa dernière session plénière, le comité européen de la protection des données (CEPD) a adopté un avis sur le projet de décision d’adéquation de la Commission européenne au titre du RGPD concernant l’Organisation européenne des brevets (OEB). En outre, le comité a adopté un avis sur la proposition de la Commission européenne visant à prolonger la validité des décisions d’adéquation du Royaume-Uni au titre du RGPD et de la directive en matière de protection des données dans le domaine répressif . Enfin, l’EDPB a accepté d’accorder le statut d’observateur à l’Agence de Bosnie-Herzégovine pour la protection des données à caractère personnel. Protection adéquate des données à caractère personnel par l'OEB À la demande de la Commission européenne, la chambre de recours a adopté un avis sur le projet de décision d’adéquation de la Commission concernant l’Organisation européenne des brevets (OEB). Une fois formellement adoptée par la Commission, il s’agira de la premièredécision d’a[...]
: Brussels, 12 September - During its September plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR) . These are the first set of EDPB guidelines on the interplay between the GDPR and the EU’s recently adopted digital laws. The DSA aims to complement the rules of the GDPR to ensure the highest level of protection of fundamental rights in the digital space. Its main goal is to create a safer online environment in which the fundamental rights of all users, including the right to freedom of expression, are protected. It applies to online intermediary services , such as search engines and platforms. Several provisions included in the DSA entail the processing of personal data by intermediary service providers. The EDPB guidelines contribute to the consistent application of the DSA and of the GDPR, insofar as some provisions of the DSA concern the processing of personal data by inte[...]
: Bruxelles, le 12 septembre - Lors de sa réunion plénière de septembre, le comité européen de la protection des données (CEPD) a adopté des lignes directrices sur l'interaction entre la législation sur les services numériques (DSA) et le règlement général sur la protection des données (RGPD) . Il s’agit de la première série de lignes directrices du comité européen de la protection des données sur l’interaction entre le RGPD et la législation numérique récemment adoptée par l’UE. Le règlement sur les services numériques vise à compléter les règles du RGPD afin de garantir le plus haut niveau de protection des droits fondamentaux dans l’espace numérique. Son objectif principal est de créer un environnement en ligne plus sûr dans lequel les droits fondamentaux de tous les utilisateurs, y compris le droit à la liberté d’expression, sont protégés. Elle s’applique aux services intermédiaires en ligne, tels que les moteurs de recherche et les plateformes. Plusieurs dispositions du règlement sur les services numériqu[...]
: Background information Date of final decision: 15 May 2025 National case Controller: SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months Key words: administrative fine, consent, unsolicited communication Summary of the Decision Origin of the case As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the cha[...]
: Brussels, 06 June - During its latest plenary, the European Data Protection Board (EDPB) adopted the final version of its guidelines on Art.48 GDPR about data transfers to third country authorities , after public consultation. In addition, the Board presented two new Support Pool of Experts (SPE) projects providing training material on artificial intelligence and data protection. Finally, the Board discussed the European Commission’s request for a joint EDPB-EDPS opinion on the draft proposal on the simplification of record-keeping obligation under the GDPR. Data transfers to third country authorities Following public consultation, the EDPB has adopted the final version of the guidelines on data transfers to third country authorities. In its guidelines, the EDPB zooms in on Art. 48 GDPR and clarifies how organisations can best assess under which conditions they can lawfully respond to requests for a transfer of personal data from third country authorities (i.e. authorities from non-European countries). T[...]
: Background information Date of final decision: 15 May 2025 National case Controller: SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent, unsolicited communication Summary of the Decision Origin of the case As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chai[...]
: A fundamental rights approach to innovation and competitiveness Helsinki, 3 July 2025 – At a high-level meeting in Helsinki on 1–2 July 2025, the European Data Protection Board (EDPB) adopted a landmark Statement on enhanced clarity, support and engagement . The Statement outlines new initiatives to make GDPR compliance easier, in particular for micro, small and medium organisations, strengthen consistency and boost cross-regulatory cooperation. EDPB Chair Anu Talus said: “The EDPB aims to ensure that compliance with the GDPR can be more easily achieved. By placing fundamental rights into the core of their digital transformation, organisations can ensure that technological advancements and the respect for European values go hand in hand, ultimately building a stronger and more resilient digital economy.” Across its efforts, the EDPB will strengthen its dialogue with stakeholders, holding proactive and early engagement to identify areas where further support and clarification is required, and providing the o[...]
: Une approche de l’innovation et de la compétitivité fondée sur les droits fondamentaux Helsinki, le 3 juillet 2025 – Lors d’une réunion à haut niveau qui s’est tenue à Helsinki les 1er et 2 juillet 2025, le comité européen de la protection des données (CEPD) a adopté une déclaration historique sur le renforcement de la clarté, du soutien et de l’engagement. La déclaration décrit de nouvelles initiatives visant à faciliter la conformité au RGPD, en particulier pour les micro, petites et moyennes organisations, à renforcer la cohérence et à stimuler la coopération entre les réglementations. Le président du comité européen de la protection des données, Anu Talus, a déclaré: «Le comité européen de la protection des données vise à faire en sorte que le respect du RGPD puisse être réalisé plus facilement. En plaçant les droits fondamentaux au cœur de leur transformation numérique, les organisations peuvent veiller à ce que les progrès technologiques et le respect des valeurs européennes aillent de pair, en con[...]
: Brussels, 9 July 2025 - The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) issued today a Joint Opinion on the European Commission’s Proposal for a Regulation amending certain regulations, including the GDPR . The Proposal, part of the fourth simplification Omnibus, aims to simplify EU rules and reduce administrative burden, extending certain mitigating measures available for small and medium sized enterprises (SMEs) to small mid-cap enterprises (SMCs), and includes further simplification measures. The Proposal aims to modify Art.30 (5) GDPR, providing a derogation to the obligation to keep a record of data processing operations. Currently, this derogation only applies to enterprises and organisation under 250 employees, except in certain cases. Under the Proposal, the derogation would apply to an enterprise or organisation employing fewer than 750 people, unless the processing operation carried out is likely to result in a high risk to individuals’ rights and freedom[...]
: Bruxelles, le 9 juillet 2025 – Le comité européen de la protection des données (CEPD) et le Contrôleur européen de la protection des données (CEPD) ont publié aujourd’hui un avis conjoint sur la proposition de règlement de la Commission européenne modifiant certains règlements, dont le RGPD . La proposition, qui fait partie du quatrième règlement omnibus sur la simplification, vise à simplifier les règles de l’UE et à réduire la charge administrative, en étendant certaines mesures d’atténuation disponibles pour les petites et moyennes entreprises (PME) aux petites entreprises à moyenne capitalisation (PME), et comprend de nouvelles mesures de simplification. La proposition vise à modifier l’article 30, paragraphe 5, du RGPD, en prévoyant une dérogation à l’obligation de tenir un registre des opérations de traitement des données. Actuellement, cette dérogation ne s'applique qu'aux entreprises et organisations de moins de 250 salariés, sauf dans certains cas. En vertu de la proposition, la dérogation s’appl[...]
: Brussels, 18 December - The European Data Protection Board (EDPB) has adopted an opinion* on the use of personal data for the development and deployment of AI models . This opinion looks at 1) when and how AI models can be considered anonymous, 2) whether and how legitimate interest can be used as a legal basis for developing or using AI models, and 3) what happens if an AI model is developed using personal data that was processed unlawfully. It also considers the use of first and third party data. The opinion was requested by the Irish Data Protection Authority (DPA) with a view to seeking Europe-wide regulatory harmonisation. To gather input for this opinion, which deals with fast-moving technologies that have an important impact on society, the EDPB organised a stakeholders’ event and had an exchange with the EU AI Office. EDPB Chair Talus said: “AI technologies may bring many opportunities and benefits to different industries and areas of life. We need to ensure these innovations are done ethically, safe[...]
: Bruxelles, le 18 décembre – Le comité européen de la protection des données (CEPD) a adopté un avis* sur l’utilisation des données à caractère personnel pour le développement et le déploiement de modèles d’IA . Le présent avis examine 1) quand et comment les modèles d’IA peuvent être considérés comme anonymes, 2) si et comment l’intérêt légitime peut être utilisé comme base juridique pour développer ou utiliser des modèles d’IA, et 3) ce qui se passe si un modèle d’IA est développé à l’aide de données à caractère personnel qui ont été traitées illégalement. Il prend également en compte l'utilisation de données de première et de tierce partie. L'avis a été demandé par l'autorité irlandaise de protection des données (DPA) en vue d'une harmonisation réglementaire à l'échelle européenne. Afin de recueillir des contributions pour le présent avis, qui traite des technologies en évolution rapide qui ont une incidence importante sur la société, l’EDPB a organisé une manifestation des parties prenantes et a eu un éch[...]
: Brussels, 17 January - During its January 2025 plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on pseudonymisation , as well as a statement on the interplay of competition law and data protection . EDPB clarifies the use of pseudonymisation for GDPR compliance The GDPR introduces the term ‘pseudonymisation’* and refers to it as a safeguard that may be appropriate and effective to meet data protection obligations. In its guidelines, the EDPB clarifies the definition and applicability of pseudonymisation and pseudonymised data, and the advantages of pseudonymisation. The guidelines provide two important legal clarifications: Pseudonymised data, which could be attributed to an individual by the use of additional information, remains information related to an identifiable natural person and is therefore still personal data. Indeed, if the data can be linked back to an individual by the data controller or someone else, it remains personal data. Pseudonymisation can reduce risks[...]
: Bruxelles, le 17 janvier – Lors de sa réunion plénière de janvier 2025, le comité européen de la protection des données (CEPD) a adopté des lignes directrices sur la pseudonymisation , ainsi qu’une déclaration sur l’interaction entre le droit de la concurrence et la protection des données . L’EDPB clarifie l’utilisation de la pseudonymisation pour se conformer au RGPD Le RGPD introduit le terme «pseudonymisation»* et le désigne comme une garantie qui peut être appropriée et efficace pour satisfaire aux obligations en matière de protection des données. Dans ses lignes directrices, l’EDPB clarifie la définition et l’applicabilité de la pseudonymisation et des données pseudonymisées, ainsi que les avantages de la pseudonymisation. Les lignes directrices apportent deux clarifications juridiques importantes: Les données pseudonymisées, qui pourraient être attribuées à une personne par l'utilisation d'informations supplémentaires, restent des informations relatives à une personne physique identifiable et restent d[...]
: Brussels, 20 January - The European Data Protection Board (EDPB) has adopted a report on the implementation of the right of access by controllers . The report summarises the outcome of a series of coordinated national actions carried out in 2024 under the Coordinated Enforcement Framework (CEF). It lists the issues that were observed for some controllers, along with a series of recommendations to help them implement the right of access. A central element is controllers’ awareness of the EDPB Guidelines 01/2022 on data subjects rights – Right of access and whether these guidelines were followed in practice. EDPB Deputy Chair Zdravko Vukíc said: “The CEF is a valuable initiative that helps strengthen the cooperation among Data Protection Authorities (DPAs): by tackling selected topics in a coordinated fashion, they achieve greater efficiency and more consistency. How controllers implement the right of access lies at the heart of data protection and it is one of the most frequently exercised data subject rights[...]
: Bruxelles, le 20 janvier - Le comité européen de la protection des données (CEPD) a adopté un rapport sur la mise en œuvre du droit d'accès des responsables du traitement. Le rapport résume les résultats d’une série d’actions nationales coordonnées menées en 2024 au titre du cadre de mise en œuvre coordonnée (CEF). Il énumère les problèmes qui ont été observés pour certains contrôleurs, ainsi qu'une série de recommandations pour les aider à mettre en œuvre le droit d'accès. Un élément central est la connaissance, par les responsables du traitement, des lignes directrices 01/2022 du comité européen de la protection des données sur les droits des personnes concernées – Droit d’accès et si ces lignes directrices ont été suivies dans la pratique. Zdravko Vukíc, vice-président du comité européen de la protection des données, a déclaré: «Le MIE est une initiative précieuse qui contribue à renforcer la coopération entre les autorités chargées de la protection des données : en abordant des thèmes sélectionnés de [...]
: If someone asked you to answer 100 questions about your personal life to sell the answers, would you agree? Most likely not. It can be difficult to keep in control over your personal data and to keep it safe. From online shopping and browsing to social media, with every click, share and login-in you leave behind a digital trail. The GDPR ensures that your data can only be used in ways you agree to and that you can access any information about yourself. But do people actually know how to protect their data? We asked passers-by on the streets of Brussels. Happy Data Protection Day! Sorry, your browser doesn't support embedded
: Brussels, 12 February - During its February 2025 plenary meeting, the European Data Protection Board (EDPB) adopted a statement on age assurance and decided to create a taskforce on AI enforcement. In addition, the Board also adopted recommendations on the 2027 World Anti-Doping Agency (WADA) World Anti-Doping Code. In a statement on age assurance, the EDPB lists ten principles for the compliant processing of personal data when determining the age or age range of an individual. The statement aims to ensure a consistent European approach to age assurance, to protect minors while complying with data protection principles. EDPB Chair Anu Talus said: “Age assurance is essential to ensure that children do not access content that is not appropriate for their age. At the same time, the method to verify age must be the least intrusive possible and the personal data of children must be protected. The principles put forward by the EDPB will help the industry to assess an individual’s age in a way that is compliant w[...]
: Bruxelles, le 12 février - Lors de sa réunion plénière de février 2025, le comité européen de la protection des données (CEPD) a adopté une déclaration sur l’assurance de l’'ge et a décidé de créer un groupe de travail sur l’application de l’IA. En outre, le Conseil a également adopté des recommandations sur le Code mondial antidopage de l'Agence mondiale antidopage (AMA) de 2027. Dans une déclaration sur la garantie de l’'ge, l’EDPB énumère dix principes pour le traitement conforme des données à caractère personnel lors de la détermination de l’'ge ou de la tranche d’'ge d’une personne. La déclaration vise à garantir une approche européenne cohérente de la garantie de l''ge, afin de protéger les mineurs tout en respectant les principes de protection des données. Le président du comité européen de la protection des données, Anu Talus, a déclaré: «L’assurance de l’'ge est essentielle pour garantir que les enfants n’ont pas accès à des contenus qui ne sont pas adaptés à leur 'ge. Dans le même temps, la méth[...]
: Brussels, 13 February - The EDPB published the Coordinated Supervision Committee's (CSC) biannual activity report (July 2022 - December 2024) . Over the last two years, the CSC worked on the integration of the large-scale EU information technology (IT) systems within its scope. During the reporting period, it took over the supervision of the upgraded Schengen Information System (SIS) and the Visa Information System (VIS). In addition, the Committee prepared for the arrival of new systems and for the implementation of interoperability regulations. The Committee has also published a set of recommendations on the Internal Market Information System (IMI) transparency obligations for data controllers . In addition, in July 2023, the CSC published ‘Europol’s information systems - a guide for exercising data subjects’ rights: the right of access, rectification, erasure and restriction’ . Following the 2022 Audit Report of the EDPS on Europol’s processing of personal data of minors under 15 years old, provided to Eu[...]
: Brussels, 14 October - During its October plenary, the European Data Protection Board (EDPB) picked the topic for its fifth coordinated enforcement action, which will concern compliance with the obligations of transparency and information under the General Data Protection Regulation (GDPR) . The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more control over their data. In a coordinated action, the EDPB prioritises a certain topic for Data Protection Authorities (DPAs) to work on at national level. The results of these national actions are then aggregated and analysed to generate deeper insight into the topic and allowing for targeted follow-up at both national and European level if needed. Participating DPAs will join this new action on a voluntary basis in the coming weeks and the action itself will be launched over the course of 2026. CEF achievements s[...]
: Bruxelles, le 20 octobre – Au cours de sa dernière session plénière, le comité européen de la protection des données a adopté deux avis sur les projets de décisions de la Commission européenne concernant la prorogation de la validité des décisions d’adéquation du Royaume-Uni au titre du règlement général sur la protection des données (RGPD) et de la directive en matière de protection des données dans le domaine répressif (DEL) jusqu’en décembre 2031.* Les avis de l'EDPB, demandés par la Commission conformément à l’article 70, paragraphe 1, point s), du RGPD et à l’article 51, paragraphe 1, point g), de la directive en matière de protection des données dans le domaine répressif , portent sur la proposition de prolongation de six ans des deux décisions d’adéquation du Royaume-Uni qui doivent expirer en décembre 2025. La prolongation de la validité des décisions d’adéquation prises au Royaume-Uni permettra aux organisations et aux autorités compétentes établies en Europe de continuer à transférer des données au[...]
: Brussels, 20 October - During its latest plenary, the EDPB adopted two opinions on the European Commission’s draft decisions on the extension of the validity of the UK adequacy decisions under the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) until December 2031.* The EDPB opinions, requested by the Commission as per Art. 70(1) (s) GDPR and Art. 51(1) (g) LED, address the proposed six-year extension of the two UK adequacy decisions which are set to expire in December 2025. The extension of the validity of the UK adequacy decisions will allow organisations and competent authorities based in Europe to continue transferring data to UK-based organisations and authorities without implementing additional guarantees.** “The EDPB welcomes the continuing alignment between the UK and Europe’s data protection framework, despite the recent changes in the UK legal framework. I call on the European Commission to address the points highlighted by the Board and to ensure an effective moni[...]
: Bruxelles, le 5 novembre – Lors de sa dernière session plénière, le comité européen de la protection des données a adopté un avis sur le projet de décision de la Commission européenne sur le niveau adéquat de protection des données à caractère personnel au Brésil *. Une fois adoptée, la décision garantira que les données à caractère personnel peuvent circuler librement d’Europe vers le Brésil et que les personnes physiques peuvent conserver le contrôle de leurs données. Dans son avis, demandé par la Commission, l’EDPB évalue si le cadre brésilien de protection des données et les règles relatives à l’accès des pouvoirs publics aux données à caractère personnel transférées depuis l’Europe offrent des garanties essentiellement équivalentes à celles prévues par la législation de l’UE. Le comité prend acte avec satisfaction de l’alignement étroit sur la législation de l’UE et la jurisprudence de la Cour de justice de l’UE. L’EDPB examine également si les garanties prévues par le cadre juridique brésilien sont en [...]
: Brussels, 5 November - During its latest plenary, the EDPB adopted an opinion on the European Commission’s draft decision on the adequate level of protection of personal data in Brazil .* Once adopted, the decision will ensure that personal data can flow freely from Europe to Brazil and that individuals can retain control over their data. In its opinion, requested by the Commission, the EDPB assesses whether the Brazilian data protection framework and the rules on government access to personal data transferred from Europe provide safeguards essentially equivalent to the ones in EU legislation. The Board positively notes the close alignment with EU legislation and the case law of the Court of Justice of the EU. The EDPB also examines whether the safeguards provided under the legal framework in Brazil are in place and effective. “The EDPB welcomes the alignment between Brazil and Europe’s data protection frameworks. This is a pivotal moment that will strengthen legal certainty for organisations and competent a[...]
: Brussels, 5 November - The European Data Protection Board (EDPB) is taking an important step towards facilitating GDPR compliance for organisations by developing a series of ready-to-use templates. This initiative, announced following the Helsinki Statement on enhanced clarity, support, and engagement , aims to provide practical tools that organisations can readily implement to meet their data protection obligations. To ensure these templates address the needs of organisations, the EDPB has launched a public consultation inviting stakeholders to share their suggestions. The consultation specifically seeks feedback on which types of templates would be most beneficial (for example, a template for privacy notices or a template for records of processing activities). The EDPB will already work on templates for key GDPR requirements such as Data Protection Impact Assessments (DPIAs) and data breach notifications. Contributions can be submitted here until 3 December 2025 . The EDPB encourages all interested parties[...]
: Brussels, 17 November - The EDPB organises a remote event to collect stakeholders’ input on anonymisation and pseudonymisation on implications of the judgement of the Court of Justice of the European Union (CJEU) in EDPS v Single Resolution Board (SRB) . The event will take place on 12 December 2025 (time to be confirmed). This will be an opportunity to inform and support the EDPB’s ongoing work on these topics as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakeholder engagement, as outlined in the recent Helsinki statement . Who can participate? Individuals representing sector associations, organisations or NGOs and individual companies, law firms or academics are invited to express their interest to participate in this event (one participant per organisation). The EDPB encourages all organisations interested in this matter to delegate a representative with technical knowledge of these topics. As a general rule, participants will be registered on a first-come first-served b[...]
: Brussels, 28 November - The EDPB launched a call for expression of interest to establish a new reserve list for the Support Pool of Experts (SPE) programme . The objective is set up a reserve list of legal and technical experts. The legal expertise sought includes a wide range of fields, such as data protection, policy monitoring, technology, cybersecurity, competition, healthcare, online intermediary services and content moderation . As for the technical expertise , the relevant areas include IT auditing, website security, mobile OS and apps, Internet of Things, cloud-computing, behavioural advertising, anonymisation techniques, cryptology, artificial intelligence, User experience (UX) design, fintech , data science, social science (incl. economics, sociology, psychology), and development of applications and software . Bring your expertise to the table Don’t miss this opportunity to participate in this EDPB’s key strategic initiative. Your work will help Data Protection Authorities (DPAs) across Europe incr[...]
: Brussels, 3 December - As part of its December’s plenary meeting, the European Data Protection Board (EDPB) held yesterday an online meeting with Commissioners and representatives of Data Protection Authorities (DPAs) from the countries and the organisation with an EU adequacy decision. This meeting marked the second of its kind, following the first gathering in October 2024 . An adequacy decision is a key-mechanism in EU data protection legislation which allows free flow of personal data from Europe to third countries or an international organisation offering an adequate level of data protection.* To date, the following countries and organisation benefit from this: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, United Kingdom, Uruguay, United States, and the European Patent Organisation . Data Protection Authorities from those countries and the European Patent Organisation are key partners for the EDPB, playing a key ro[...]
: Brussels, 4 December - During its latest plenary, the EDPB adopted recommendations on the legal basis for requiring the creation of user accounts on e-commerce websites . In addition, the Board had a preliminary discussion on the Digital Omnibus proposal and appointed the new EDPB Deputy Chair. Internet users visit e-commerce websites for a variety of reasons, including making online purchases, taking advantage of promotions, or simply browsing products. When interacting with these websites, they may be asked to create an account, which can result in the collection and processing of personal data, as well as increased privacy and security risks. The EDPB adopted recommendations to clarify when e-commerce websites can require their users to create an account. As a general rule, users should have the option to engage with e-commerce websites, including the ability to make purchases, without creating an account. In such cases, the EDPB recommends that e-commerce websites offer a choice: either a 'guest' mode, a[...]
: Bruxelles, le 4 décembre – Lors de sa dernière session plénière, l'EDPB a adopté des recommandations sur la base juridique permettant d’exiger la création de comptes d’utilisateurs sur les sites web de commerce électronique . En outre, le comité a eu une discussion préliminaire sur la proposition d’omnibus numérique et a nommé la nouvelle vice-présidente de l'EDPB. Les internautes visitent les sites Web de commerce électronique pour diverses raisons, notamment pour effectuer des achats en ligne, profiter de promotions ou simplement naviguer sur des produits. Lors de l'interaction avec ces sites Web, il peut leur être demandé de créer un compte, ce qui peut entraîner la collecte et le traitement de données personnelles, ainsi que des risques accrus pour la vie privée et la sécurité. L’EDPB a adopté des recommandations visant à préciser quand les sites web de commerce électronique peuvent exiger de leurs utilisateurs qu’ils créent un compte. En règle générale, les utilisateurs devraient avoir la possibilité de[...]
: Brussels, 09 October - The European Data Protection Board (EDPB) and the European Commission endorsed joint guidelines on the interplay between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR) . These are the first joint guidelines by the Board and the European Commission. In line with its 2024-2027 Strategy and the recent Helsinki Statement’s objectives to make GDPR compliance easier and strengthen consistency, the EDPB has cooperated with the European Commission, each within their respective mandates, to facilitate the coherent application of the DMA*and GDPR and to increase legal certainty for gatekeepers, business users, beneficiaries and individuals. EDPB Chair Anu Talus said: “These joint guidelines are the result of a fruitful cooperation between the EDPB and the European Commission. This is the first time that the EDPB and the European Commission prepare guidelines jointly. This approach maximises usefulness of the guidance by simplifying compliance for businesses and[...]
: Bruxelles, le 9 octobre - Le comité européen de la protection des données (CEPD) et la Commission européenne ont approuvé des lignes directrices communes sur l'interaction entre la législation sur les marchés numériques et le règlement général sur la protection des données (RGPD) . Il s’agit des premières lignes directrices conjointes du conseil d’administration et de la Commission européenne. Conformément à sa stratégie 2024-2027 et auxobjectifs de la récente déclaration d’Helsinki visant à faciliter la conformité au RGPD et à renforcer la cohérence, l’EDPB a coopéré avec la Commission européenne, chacun dans le cadre de ses mandats respectifs, afin de faciliter l’application cohérente du règlement sur les marchés numériques* et du RGPD et d’accroître la sécurité juridique pour les contrôleurs d’accès, les entreprises utilisatrices, les bénéficiaires et les particuliers. Le président du comité européen de la protection des données, Anu Talus, a déclaré: «Ces lignes directrices communes sont le fruit d[...]
: Brussels, 9 October - The EDPB is organising a remote stakeholder event to collect stakeholders’ input on anonymisation and pseudonymisation following the clarification on the scope of the concept of personal data provided by the Court of Justice of the European Union (CJEU) in its judgement in EDPS v Single Resolution Board (SRB) . The event will take place by the end of the year. The event will inform and support the EDPB’s ongoing work on these topics as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakeholder engagement, as outlined in the recent Helsinki statement . Do you wish to participate to have your say? The EDPB will launch a call for expression of interest to participate in the stakeholder event in the following weeks. More details about the date and format will follow soon on the EDPB website
: Brussels, 10 October - On the occasion of the upcoming entry into operation of the EU Entry Exit System (EES) on 12 October 2025, the Coordinated Supervision Committee (CSC) will include the EES system under its scope. This system registers non-Schengen nationals travelling with a short stay visa or travellers who are visa exempt. The EES is a large scale IT systems developed by the EU to prevent irregular migration and enhance security in the Schengen area. How it works The EES gradually replaces passport stamping at the external borders of the Schengen area, with the aim of making the border process more efficient. The system records which travellers from third countries, with or without a visa, enter and exit the Schengen area. The implementation of the EES will happen gradually. European countries will have the option to progressively start using this system over a period of six months, starting with the registration of third country nationals at 10% of border crossings. By the end of the six mont[...]
: Brussels, 23 April – The EDPB is organising a remote stakeholder event in the context of its joint work with the European Commission on upcoming guidelines on the interplay between competition and data protection . The event will take place on 29 June 2026 and is an opportunity for stakeholders to inform and support the ongoing work on this topic. The event reflects the EDPB’s commitment to stakeholder engagement and cross-regulatory cooperation, as outlined in the Helsinki statement and in the EDPB Strategy 2024-2027 . Join the event to have your say This is your chance to contribute directly to an evolving and highly relevant policy area. The EDPB will launch a call for expression of interest to participate in the stakeholder event in the following weeks. More details about the date and format will follow soon on the EDPB website
: Brussels, 27 April – Today marks the 10th anniversary of the GDPR’s adoption, the first comprehensive data protection framework spanning an entire continent, establishing clear rights for individuals and obligations for organisations across Europe. The moment that led to the creation of the EDPB The GDPR led to the establishment of the European Data Protection Board (EDPB) on 25 May 2018, replacing the Article 29 Working Party that was previously in charge of dealing with issues relating to the protection of personal data. The GDPR gave the Data Protection Authorities (DPAs) stronger enforcement powers and expanded the scope of their work from focusing mainly on national compliance complaints to routinely dealing with cross-border cases. In the past 10 years, the 31 European DPAs comprising the EDPB have worked together to ensure the consistent enforcement of the GDPR and a harmonised data protection approach across Europe. A key role in an evolving digital landscape Today, the GDPR is part of a broader an[...]
: Brussels, 23 April – The EDPB is organising a remote stakeholder event in the context of its joint work with the European Commission on upcoming guidelines on the interplay between competition and data protection . The event is an opportunity for stakeholders to inform and support the ongoing work on this topic. It also reflects the EDPB’s commitment to stakeholder engagement and cross-regulatory cooperation, as outlined in the Helsinki statement and in the EDPB Strategy 2024-2027 . Join the event to have your say This is your chance to contribute directly to a fast-evolving and highly relevant policy area. The EDPB will launch a call for expressions of interest to participate in the stakeholder event. Further details on the date and format will be published on the EDPB website
: Brussels, 5 May – On 9 May each year, Europeans celebrate the anniversary of the Schuman Declaration, the key moment which led to the creation of the EU as we know it today. To mark this special occasion, the European institutions will open their doors to the public on 9 May 2026 , and we would be delighted to welcome you. Come and visit us We invite you to our interactive booth to discover and enjoy the activities we have prepared together with the European Data Protection Supervisor (EDPS). • When: 9 May 2026, from 10:00 to 18:00 (CET) • Where: European Parliament (Rue Wiertz 60, Brussels) You will find us on the ground floor, in the cybersecurity area. Test your skills and discover more During your visit, you will get the chance to enjoy fun activities tailored just for you. This includes a: • EU Survey Quiz to test your knowledge of EU institutions • Roulette that will test your skills with fun data protection-related challenges This year, we are also bringing along a new friend: our mascot[...]
: The European Data Protection Board (EDPB) invites you to register for its conference, “Cross-regulatory interplay and cooperation in the EU: a data protection perspective” , taking place on 17 March 2026 in Brussels . This event will offer a high-level overview of the EDPB’s work in the EU’s cross-regulatory landscape, focusing in particular on how regulatory frameworks interact and how cooperation between authorities is ensured. Registration is open until 26 February 2026 and can be completed by filling out the EU Survey ( link ). There will also be a possibility to follow the event remotely.
: Bruxelles, le 11 février - Le comité européen de la protection des données (CEPD) et le Contrôleur européen de la protection des données (CEPD) ont adopté un avis conjoint sur la proposition de règlement omnibus numérique*. Cette proposition vise à simplifier le cadre réglementaire numérique de l'UE, à réduire la charge administrative et à renforcer la compétitivité des organisations européennes. L’EDPB et le CEPD se concentrent sur les aspects concernant le RGPD, le RPDUE, la directive «vie privée et communications électroniques» et l’acquis en matière de données.** Plus précisément, ils évaluent si la proposition 1) conduit à une véritable simplification et facilite le respect des dispositions, 2) apporte une plus grande sécurité juridique et 3) porte atteinte aux droits fondamentaux des personnes. Modifications du RGPD et du RPDUE Changements suscitant des préoccupations importantes Certaines modifications proposées suscitent d’importantes préoccupations, car elles peuvent avoir une incidence négative[...]
: Brussels, 11 February - The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the Digital Omnibus Regulation proposal .* This proposal aims to simplify the EU's digital regulatory framework, reduce administrative burden and enhance the competitiveness of European organisations. The EDPB and the EDPS focus on the aspects concerning the GDPR, the EUDPR, the ePrivacy Directive, and the Data Acquis.** More specifically, they assess whether the proposal 1) leads to real simplification and facilitates compliance, 2) brings more legal certainty and 3) affects individuals’ fundamental rights. Changes to the GDPR and the EUDPR Changes raising significant concerns Some proposed changes raise significant concerns as they can adversely affect the level of protection enjoyed by individuals, create legal uncertainty and make data protection law more difficult to apply. The EDPB and the EDPS strongly urge the co-legislators not to adopt the proposed cha[...]
: Brussels, 12 February - During its latest plenary, the EDPB adopted its work programme for 2026-2027 . This is the second work programme to support the implementation of the EDPB strategy 2024-2027 *. The work programme is based on the priorities set out in the EDPB strategy and the needs identified as most critical for stakeholders. It also takes into account the commitments made in the Helsinki Statement on enhanced clarity, support and engagement aimed at making GDPR compliance easier, strengthening consistency, and boosting cross-regulatory cooperation. Built on the four pillars of the EDPB strategy, the work programme focuses on 1) enhancing harmonisation and promoting compliance , 2) reinforcing a common enforcement culture and effective cooperation , 3) safeguarding data protection in the developing digital and cross-regulatory landscape , and 4) contributing to the global dialogue on data protection . Enhancing harmonisation and promoting compliance The EDPB will continue to provide timely and clear[...]
: Bruxelles, le 12 février – Lors de sa dernière session plénière, le comité européen de la protection des données a adopté son programme de travail pour la période 2026-2027. Il s’agit du deuxième programme de travail visant à soutenir la mise en œuvre de la stratégie 2024-2027 du comité européen de la protection des données *. Le programme de travail se fonde sur les priorités définies dans la stratégie du comité européen de la protection des données et sur les besoins identifiés comme les plus critiques pour les parties prenantes. Elle tient également compte des engagements pris dans la déclaration d’Helsinki sur le renforcement de la clarté, du soutien et de l’engagement visant à faciliter la conformité au RGPD, à renforcer la cohérence et à stimuler la coopération entre les réglementations. S’appuyant sur les quatre piliers de la stratégie du comité européen de la protection des données, le programme de travail se concentre sur 1) le renforcement de l’harmonisation et la promotion du respect des règl[...]
: Brussels, 13 February - The EDPB has recently adopted its work programme for 2026-2027 , which is grounded in the four pillars of the EDPB strategy 2024-2027 . The work programme is based on the priorities set out in the EDPB strategy and it also takes into account the commitments made in the Helsinki Statement on enhanced clarity, support and engagement aimed at making GDPR compliance easier, strengthening consistency, and boosting cross-regulatory cooperation. Easing compliance is at the top of the EDPB agenda The work programme reaffirms the commitment of the EDPB to simplifying GDPR compliance for organisations, which includes the development of a series of ready-to-use templates for organisations . Following the public consultation on this, the EDPB decided to develop templates for legitimate interest assessment, record of processing activities and privacy notice/policy in addition to the already announced templates for data breach notifications and data protection impact assessment . This is also in [...]
: Brussels, 18 February - The European Data Protection Board (EDPB) has adopted a report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) . The Board selected this topic as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. The main objectives of this coordinated action are to ensure that the right to erasure is effectively exercised by individuals in Europe and understand how controllers comply with this right in practice. In addition, the EDPB identified good practices and the most important related challenges, with the aim of providing further guidance on this topic. Throughout 2025, 32 DPAs across Europe took part in this initiative. More specifically, 9 DPAs have initiated new formal investigations or have continued ongoing ones, and 23 DPAs carried out a fact-finding exercise. A total of 764 controllers across Europe responded to the action, ranging from small and medium-sized[...]
: Brussels, 23 February - EDPB Chair Anu Talus has signed a Joint Statement on AI-Generated Imagery and the Protection of Privacy on behalf of the EDPB . The statement, coordinated by the Global Privacy Assembly's (GPA) International Enforcement Cooperation Working Group (IEWG) , represents the united position of 61 authorities across the world. This reflects the Board’s commitment to contributing to the global dialogue on data protection as outlined in the fourth pillar of its work programme 2026-2027 . The statement addresses serious concerns about AI systems that generate realistic images and videos depicting identifiable individuals without their knowledge or consent. Whilst AI has the potential to bring numerous benefits for individuals and society, recent developments - particularly AI image and video generation integrated into widely accessible social media platforms - have enabled the creation of non-consensual intimate imagery, defamatory depictions, and other harmful content featuring real individu[...]
: Brussels, 6 March - The EDPB organises a remote event to collect stakeholders’ input on its Guidelines on the processing of personal data to target or deliver political advertisements under the regulation on the transparency and targeting of political advertising , on 27 March 2026. The agenda is available here This will be an opportunity to inform and support the EDPB’s ongoing work on this topic as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakeholder engagement, as outlined in the recent Helsinki statement . Find out more: discussion paper
: Brussels, 12 March 2026 – The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the European Commission’s Proposal for a European Biotech Act . The Proposal aims to strengthen Europe’s biotechnology and biomanufacturing sectors, particularly in the area of health, by streamlining the regulatory framework and updating the rules for clinical trials. The EDPB and the EDPS support the Proposal’s objective of fostering the EU’s competitiveness and addressing existing fragmentation in the application of the Clinical Trials Regulation (CTR). In particular, they welcome the aim to establish a single legal basis for the processing of personal data by sponsors and investigators, which will significantly improve legal clarity across Europe. At the same time, the EDPB and the EDPS underline that the sensitivity of health and genetic data processed in the context of clinical trials requires a high standard of protection. The Joint Opinion provides sev[...]
: Bruxelles, le 12 mars 2026 – Le comité européen de la protection des données (CEPD) et le Contrôleur européen de la protection des données (CEPD) ont adopté un avis conjoint sur la proposition de la Commission européenne relative à un acte législatif européen sur les biotechnologies. La proposition vise à renforcer les secteurs européens de la biotechnologie et de la bioproduction, en particulier dans le domaine de la santé, en rationalisant le cadre réglementaire et en actualisant les règles relatives aux essais cliniques. L’EDPB et le CEPD soutiennent l’objectif de la proposition consistant à favoriser la compétitivité de l’UE et à remédier à la fragmentation existante dans l’application du règlement sur les essais cliniques. En particulier, ils se félicitent de l'objectif visant à établir une base juridique unique pour le traitement des données à caractère personnel par les promoteurs et les enquêteurs, ce qui améliorera considérablement la clarté juridique dans toute l'Europe. Dans le même temps, l’EDPB[...]
: Brussels, 19 March - The EDPB has launched its Coordinated Enforcement Framework (CEF) action for 2026*. Following a year-long coordinated action on the right to erasure in 2025 , the CEF's focus this year will shift to compliance with the obligations of transparency and information under the GDPR . The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more control over their data. Next steps During 2026, 25 Data Protection Authorities (DPAs) across Europe will take part in this initiative. They will look closely to assess the compliance of controllers with their transparency obligations under the GDPR. Participating DPAs will soon contact controllers from different sectors across Europe, either through enforcement actions or fact-finding exercises. In the latter case, they might also decide to undertake additional follow-up actions if needed. During the second[...]
: Brussels, 19 March 2026 – The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the European Commission’s proposal for a Cybersecurity Act 2 (CSA2) and the proposal on amendments to the Network and Information Security 2 (NIS2) Directive . On 20 January 2026, the Commission published a cybersecurity package proposal to further strengthen cybersecurity in Europe while making compliance with cybersecurity laws easier for organisations. In their joint opinion, issued at the request of the Commission*, the EDPB and the EDPS address the proposed revision of the CSA and the targeted amendments to the NIS2 Directive. “The relationship between data protection and cybersecurity is reciprocal and deeply interconnected. While cybersecurity supports the protection of personal data by limiting the risks of unwanted access, modification or unavailability of data, it is crucial to ensure that security controls are implemented in a way that does not unde[...]
: Bruxelles, le 19 mars 2026 – Le comité européen de la protection des données (CEPD) et le Contrôleur européen de la protection des données (CEPD) ont adopté un avis conjoint sur la proposition de la Commission européenne d’acte législatif sur la cybersécurité no 2 (CSA2) et sur la proposition de modification de la directive relative à la sécurité des réseaux et de l’information no 2 (SRI 2). Le 20 janvier 2026, la Commission a publié une proposition de train de mesures sur la cybersécurité visant à renforcer encore la cybersécurité en Europe tout en facilitant le respect de la législation en matière de cybersécurité par les organisations. Dans leur avis conjoint, rendu à la demande de la Commission*, l’EDPB et le CEPD abordent la proposition de révision de l’ACC et les modifications ciblées de la directive SRI2. «La relation entre la protection des données et la cybersécurité est réciproque et profondément interconnectée. Si la cybersécurité soutient la protection des données à caractère personnel en lim[...]