(
2026/10/16:
)
Background information Date of final decision: 2 October 2026 National case Controller: Xandr Inc. Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data) Decision: Administrative fine Key words: Fines, Basic principles, Marketing, Online platforms Summary of the Decision Origin of the case The case started in 2020 when the Norwegian Consumer Council lodged a complaint against the advertising technology company Xandr (at the time AppNexus, now a part of Microsoft) with the Norwegian DPA (Data Protection Authority). The case concerns real-time bidding in Grindr, a location-based dating app aimed at gay, bi, trans and queer people. Key Findings The Norwegian DPA has found it proven by clear preponderance of probability that Xandr processed Grindr users’ personal data, at least the fact that individuals were using Grindr, their advertising ID and IP addresses, during real-time bidding. These are personal data under Article 4(1
(
2026/10/14:
)
Bruxelles, le 13 octobre – Lors de sa dernière session plénière, le comité européen de la protection des données a adopté une déclaration sur les lunettes intelligentes et publié le rapport intitulé «The connected regarde. Enregistrement vidéo, surveillance et administration de preuves à l’ère des lunettes intelligentes» *, élaboré dans le cadre du programme «Support Pool of Expert» (SPE) **. À mesure que les lunettes intelligentes deviennent largement disponibles et plus fréquemment utilisées, elles soulèvent des questions importantes pour la protection des données à caractère personnel et des droits et libertés des personnes, même si elles créent de nouvelles possibilités de communication, d’assistance et d’innovation. «Ces appareils ressemblent à des lunettes ordinaire
(
2026/10/14:
)
Brussels, 13 October – During its latest plenary, the EDPB has adopted statement on smart glasses and published the report “The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses” *, developed in the context of the Support Pool of Expert (SPE) programme **. As smart glasses become widely available and more frequently used, they raise significant questions for the protection of individuals’ personal data and rights and freedoms even if they create new opportunities for communication, assistance, and innovation. “These devices look like ordinary glasses, but they include cameras and microphones and are connected to the internet. This raises serious privacy concerns, as individuals may be recorded without their knowledge. The risks are even greater in sensitive environments—such as hospitals, schools, or workplaces—and when recordings are shared on social networks. And of course, children are especially at risk when using
(
2026/10/12:
)
Background information Date of final decision: 05/06/2026 National case Controller: Wind Tre S.p.A. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default) and Article 32 (Security of processing) Decision: Administrative fine, Definitive ban on data processing, Compliance order Website topics: Data subjects rights, Basic principles, Legal basis, Marketing Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) carried out an investigation into Wind Tre S.p.A. following numerous complaints and reports from individuals concerning unsolicited promotional contacts and the activation of contracts and services without
(
2026/10/09:
)
Background information Date of final decision: 23 September 2026 National case Controller: IQVIA Solutions Italy S.r.l Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 25 (Data protection by design and by default), Article 28 (Processor) and Article 35 (Data protection impact assessment) Decision: Administrative fine Key words: Data protection impact assessment, Health and research, Anonymisation/pseudonymisation, Privacy by design and by default, Fines, Basic principles and Controller/processor Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) carried out an investigation into IQVIA Solutions Italy S.r.l., a company belonging to a multinational group active in health data analytics and clinical research. The investigation concerned a database containing health inform
(
2026/10/09:
)
Background information Date of final decision: 6 August 2026 National case Controller: La Patria S.p.A. Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject) and Article 15 (Right to access by the data subject) Decision: Administrative fine Key words: Data subjects rights, Fines Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) initiated an investigation following a complaint lodged by a former employee of La Patria S.p.A., a security and technological security company. The complainant claimed that the company had failed to respond to two requests to access documentation concerning disciplinary proceedings against him, including data collected through a GPS system installed on the company vehicle assigned to him. The employee had requested access to the documentation in order to defend himself i
(
2026/10/09:
)
Background information Date of final decision: 14 May 2026 National case Controller: Emirates Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine, Compliance order Website topics: Health and research, Basic principles Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) initiated an investigation following a complaint lodged by a passenger concerning the processing of health data by Emirates in connection with assistance for passengers with disabilities or reduced mobility. The complainant stated that Emirates had required her to complete a MEDIF (Medical Information for Fitness to Travel or Special Assistance) form, although she claimed not to fall within the categories of passengers required
(
2026/10/09:
)
Background information Date of final decision: 3 July 2026 National case Controller: Banco Bilbao Vizcaya Argentaria, S.A., Italian branch (BBVA) Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller) Decision: Administrative fine, Compliance order Website topics: Basic principles, Data subjects rights, Marketing Summary of the Decision Origin of the case The Italian Data Protection Authority (DPA) investigated BBVA, a multinational Spanish banking group, following a complaint from a customer who continued to receive promotional communications through the bank’s mobile app despite having objected to direct marketing. The customer exercised his right to object through the settings provided in the BBVA app and subsequently reiterated his objection to the bank’s Customer Se
(
2026/10/09:
)
Background information Date of final decision: 1 February 2023 National case Controller: SECURITAS DIRECT, S.A. Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) Decision: Administrative fine, Compliance order Key words: Data subject rights Summary of the Decision Origin of the case A consumer association lodged a complaint against Securitas Direct concerning video surveillance notices that directed data subjects to a chargeable 902 telephone number to exercise their rights of access and objection. This was considered to impose a cost on data subjects and to hinder the exercise of their rights. Key Findings The use of a chargeable telephone number for the exercise of data subject rights was contrary to the GDPR requirement that such rights be exercisable free of charge and could discourage data subjects from exercising them. The availability of other free channels on the website did not remedy the issue, as the noti
(
2026/10/09:
)
Background information Date of final decision: 22/09/2026 National case Legal Reference(s): Article 32 (Security of processing) Decision: Administrative fine Website topics: Cybersecurity, personal data breaches Summary of the Decision Origin of the case In August 2025, the IT service provider Miljödata was targeted in a cyberattack, during which a malicious actor gained access to a large volume of personal data and subsequently published data on the darknet. According to the company, the incident affected 2.2 million individuals. Among Miljödata’s customers affected by the attack are a majority of Sweden’s municipalities, several regions, and government agencies, as well as a large number of private companies. The compromised data included personal identity numbers, contact details, and sensitive data related to sick leave, rehabilitation, and student-related incidents in schools. Key Findings The review shows that the company did not maintain a sufficiently high level of technical and
(
2026/10/09:
)
Background information Date of final decision: 28/07/2026 National case Controller: Ministry of Social Cohesion and Family Affairs Legal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine, Compliance order, Summary of the Decision Origin of the case The Hellenic Data Protection Authority (DPA) investigated a large-scale personal data breach affecting the information systems of the Hellenic Agency for Local Development and Local Government (E.E.T.A.A.) S.A., which were used to implement programmes of the Ministry of Social Cohesion and Family Affairs. Key Findings The breach affected databases containing personal data of a large number of data subjects, including identification and contact details, financial and health data. The Hellen
(
2026/10/09:
)
Background information Cross-border case Legal Reference(s): Article 22 (Automated individual decision making, including profiling) and Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine Key words: Automated decision making, profiling and online tracking, fines Summary of the Decision The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, imposes a fine of EUR 824 990 000 on Uber. The reason for this is that the AP has ruled that Uber made fully automated decisions about drivers. In case of suspicions of fraud or customer reviews that were too low, drivers' accounts were automatically temporarily deactivated or, in case of persistent low customer reviews, permanently deactivated. As a result, their income was lost via Uber during the deactivation. Origin of the case Complaints from 171 French Uber drivers, submitted through the Ligue des droits de l’Homme (LDH) to the French Commission Nationale de l'I
(
2026/10/06:
)
Background information Date of final decision: 21 September 2026 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine, compliance order Key words: GDPR enforcement, technology, accountability, data subjects rights Summary of the Decision Origin of the case The Irish Data Protection Commission (DPC) has announced its final decision following an inquiry into Google Ireland Limited (Google). This own-volition Inquiry was launched by the DPC, in its role as the Lead Supervisory Authority for Google, in February 2020, following receipt of complaints from several European consumer rights organisations, including BEUC, regarding Google’s processing of location data in connection
(
2026/10/06:
)
Background information Date of final decision: 1 February 2023 National case Controller: SECURITAS DIRECT, S.A. Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) Decision: Administrative fine, Compliance order Key words: Data subject rights Summary of the Decision Origin of the case A consumer association lodged a complaint against Securitas Direct concerning video surveillance notices that directed data subjects to a chargeable 902 telephone number to exercise their rights of access and objection. This was considered to impose a cost on data subjects and to hinder the exercise of their rights. Key Findings The use of a chargeable telephone number for the exercise of data subject rights was contrary to the GDPR requirement that such rights be exercisable free of charge and could discourage data subjects from exercising them. The availability of other free channels on the website did not remedy the issue, as the noti
(
2026/10/06:
)
Background information Date of final decision: 21 July 2026 National case Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure ‘right to be forgotten’) Decision: Administrative fine Key words: Data subject rights Summary of the Decision Origin of the case EXTIA, which specialises in IT and engineering, recruits consultants for various technical projects from its client companies. In 2024, the French Data Protection Authority (CNIL) received several complaints from former employees or candidates, relating to difficulties encountered in exercising their right to erasure or ‘right to be forgotten’. With a view to investigating these complaints, and also in the context of the Coordinated Enforcement Framework action on the ‘Right to erasure’ launched on the initiative of the European Data Protection Board in 2025, an audit of EXTIA was carried out in A
(
2026/10/06:
)
Background information Date of final decision: 3 September 2026 National case Controller: Hôpital Privé de la Loire Legal Reference: Article 32 (Security of processing), Article 34 (Communication of a personal data breach to the data subject), Decision: Administrative fine Keywords: Cybersecurity, Personal data breaches, Health and research Summary of the Decision Origin of the case In summer 2025, an attacker managed to connect to the Computerised Patient Summary (DPI) of the Hôpital Privé de la Loire (Loire’s private hospital), which centralises all the data of the individuals under care. It thus accessed the data of 524 867 patients (some of them health data) and 202 246 persons designated as “trusted third parties”. As a result of this data breach, the French Data Protection Authority (CNIL) carried out a check that identified several failures of the Hôpital Privé de la Loire to comply with the obligations laid down in the General Data Pr
(
2026/09/28:
)
Brussels, 30 July – The EDPB and the European Commission organise a remote stakeholder event in the context of their joint work on upcoming guidelines on the interplay between competition and data protection . The event will take place on 15 October 2026 and is an opportunity for stakeholders to inform and support the ongoing work on this topic. The event reflects the EDPB’s commitment to stakeholder engagement and cross-regulatory cooperation, as outlined in the Helsinki statement and in the EDPB Strategy 2024-2027 . Who can participate? The EDPB and the European Commission welcome participation from individuals and organisations with relevant expertise in the topic of the event. How to take part? The call is now closed. Agenda Click here to see the agenda . Overview of key topics Please find here the overview of topics and questions for the EDPB–EC Stakeholder Event on GDPR & Competition Law . Further background reading Position paper on Interplay between data protection and competition la
(
2026/09/23:
)
Background information Date of final decision: 21 September 2026 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine, compliance order Key words: GDPR enforcement, technology, accountability, data subjects rights Summary of the Decision Origin of the case The Irish Data Protection Commission (DPC) has announced its final decision following an inquiry into Google Ireland Limited (Google). This own-volition Inquiry was launched by the DPC, in its role as the Lead Supervisory Authority for Google, in February 2020, following receipt of complaints from several European consumer rights organisations, including BEUC, regarding Google’s processing of location data in connection
(
2026/09/23:
)
Bruxelles, le 21 septembre – Au cours de sa dernière session plénière, le comité européen de la protection des données a adopté des lignes directrices sur l’application du pouvoir d’infliger des amendes administratives en ce qui concerne d’autres pouvoirs correctifs en vertu du RGPD et la version finale de ses lignes directrices sur l’interaction entre la législation sur les services numériques et le RGPD. Les nouvelles lignes directrices du comité européen de la protection des données constituent une étape majeure dans l’alignement de la manière dont les autorités chargées de la protection des données décident si une amende administrative doit être infligée, seule ou parallèlement à d’autres mesures correctives. Le RGPD a considérablement accru les pouvoirs correctifs des APD, les amendes constituant un instru
(
2026/09/22:
)
Background information Date of final decision: 1 February 2023 National case Controller: SECURITAS DIRECT, S.A. Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) Decision: Administrative fine, Compliance order Key words: Data subject rights Summary of the Decision Origin of the case A consumer association lodged a complaint against Securitas Direct concerning video surveillance notices that directed data subjects to a chargeable 902 telephone number to exercise their rights of access and objection. This was considered to impose a cost on data subjects and to hinder the exercise of their rights. Key Findings The use of a chargeable telephone number for the exercise of data subject rights was contrary to the GDPR requirement that such rights be exercisable free of charge and could discourage data subjects from exercising them. The availability of other free channels on the website did not remedy the issue, as the noti
(
2026/09/21:
)
Brussels, 21 September – During its latest plenary, the EDPB has adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR and the final version of its guidelines on the interplay between the Digital Services Act (DSA) and the GDPR. The new EDPB guidelines are a major step in further aligning how Data Protection Authorities decide whether an administrative fine should be imposed, either on its own or alongside other corrective measures. The GDPR significantly increased the corrective powers of DPAs, with fines serving as an important instrument for effective enforcement. The guidelines reaffirm our commitment to providing greater clarity and ensuring the consistent application of the GDPR across Europe. EDPB Deputy Chair, Jelena Virant Burnik Data Protection Authorities (DPAs) should follow a five-step methodology when deciding whether to impose an administrative fine: the DPA checks if the infringement can lead to a fine, by
(
2026/09/11:
)
Background information Date of final decision: 21 July 2026 National case Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure ‘right to be forgotten’) Decision: Administrative fine Key words: Data subject rights Summary of the Decision Origin of the case EXTIA, which specialises in IT and engineering, recruits consultants for various technical projects from its client companies. In 2024, the French Data Protection Authority (CNIL) received several complaints from former employees or candidates, relating to difficulties encountered in exercising their right to erasure or ‘right to be forgotten’. With a view to investigating these complaints, and also in the context of the Coordinated Enforcement Framework action on the ‘Right to erasure’ launched on the initiative of the European Data Protection Board in 2025, an audit of EXTIA was carried out in A
(
2026/09/09:
)
Background information Date of final decision: 3 September 2026 National case Controller: Hôpital Privé de la Loire Legal Reference: Article 32 (Security of processing), Article 34 (Communication of a personal data breach to the data subject), Decision: Administrative fine Keywords: Cybersecurity, Personal data breaches, Health and research Summary of the Decision Origin of the case In summer 2025, an attacker managed to connect to the Computerised Patient Summary (DPI) of the Hôpital Privé de la Loire (Loire’s private hospital), which centralises all the data of the individuals under care. It thus accessed the data of 524 867 patients (some of them health data) and 202 246 persons designated as “trusted third parties”. As a result of this data breach, the CNIL carried out a check that identified several failures of the Hôpital Privé de la Loire to comply with the obligations laid down in the General Data Protection Regulation (GDPR). Key fin
(
2026/09/03:
)
Background information Date of final decision: 28 August 2026 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine, Compliance order, Communication order personal data breach Key words: GDPR enforcement, Data subjects rights, Fines, Health and research Summary of the Decision Origin of the case This Inquiry commenced on 24 May 2024 as a result of two personal data breaches notified to the Data Protection Commission (DPC) in October 2023 and November 2023. In both cases, individuals gained unauthorised access to paper records stored and retained in both St. Loman’s Hospital (Mullingar, County Westmeath) and St Conal’s Hospital (Letterkenny, County Donegal). Both locations are former disused psychiatric hospitals.Videos uploaded t
(
2026/08/31:
)
Brussels, 30 July – The EDPB and the European Commission organise a remote stakeholder event in the context of their joint work on upcoming guidelines on the interplay between competition and data protection . The event will take place on 15 October 2026 and is an opportunity for stakeholders to inform and support the ongoing work on this topic. The event reflects the EDPB’s commitment to stakeholder engagement and cross-regulatory cooperation, as outlined in the Helsinki statement and in the EDPB Strategy 2024-2027 . Who can participate? The EDPB and the European Commission welcome participation from individuals and organisations with relevant expertise in the topic of the event. How to take part? The call is now closed. Overview of Key Topics Please find here the overview of topics and questions for the EDPB–EC Stakeholder Event on GDPR & Competition Law
(
2026/07/31:
)
Brussels, 30 July – The EDPB and the European Commission organise a remote stakeholder event in the context of their joint work on upcoming guidelines on the interplay between competition and data protection . The event will take place on 15 October 2026 and is an opportunity for stakeholders to inform and support the ongoing work on this topic. The event reflects the EDPB’s commitment to stakeholder engagement and cross-regulatory cooperation, as outlined in the Helsinki statement and in the EDPB Strategy 2024-2027 . Who can participate? The EDPB and the European Commission welcome participation from individuals and organisations with relevant expertise in the topic of the event. How to take part? You can find further information and express your interest here. If you have technical problems submitting the application, we invite you to refresh the page or open the form in a different browser. The call for interest is open until 28 August
(
2026/07/23:
)
Brussels, 23 July – The EDPB and the European Commission organise a remote stakeholder event in the context of their joint work on upcoming guidelines on the interplay between competition and data protection . The event will take place on 15 October 2026 and is an opportunity for stakeholders to inform and support the ongoing work on this topic. The event reflects the EDPB’s commitment to stakeholder engagement and cross-regulatory cooperation, as outlined in the Helsinki statement and in the EDPB Strategy 2024-2027 . Join the event to have your say This is your chance to contribute directly to an evolving and highly relevant policy area. A call for expression of interest to participate in the stakeholder event will be launched in the following weeks. More details about the date and format of the event will be available soon on the EDPB website and European Commission’s websites.
(
2026/07/18:
)
Dublin, le 17 juillet – Lors d’une réunion à haut niveau qui s’est tenue à Dublin les 16 et 17 juillet 2026, le comité européen de la protection des données (CEPD) a plaidé en faveur d’une base juridique claire pour le partage d’informations entre les régulateurs ayant des compétences différentes. Le comité a également examiné la manière d’intensifier encore les efforts visant à soutenir une application cohérente du règlement général sur la protection des données (RGPD), notamment par une coopération plus intense entre les autorités chargées de la protection des données (APD). Une base juridique claire pour une coopération interréglementaire efficace Le comité souligne la nécessité croissante, dans l’environnement réglementaire actuel, d’une coopéra
(
2026/07/15:
)
Bruxelles, le 14 juillet – Le CEPD a publié sa décision contraignante du 28 mai 2026 au titre de l’article 65, paragraphe 1, point a), du RGPD*. La décision concerne un litige soumis par l’autorité belge de protection des données (DPA) au sujet d’une plainte contre Vlaamse Radio-en Televisieomroeporganisatie (VRT), une société publique de radiodiffusion basée en Belgique. La plainte a été déposée auprès de l’autorité autrichienne de protection des données par l’ONG autrichienne Noyb au nom d’un particulier. Il s’agit de l’utilisation de bannières de cookies sur le site web de VRT. L’APD belge, agissant en tant qu’autorité de contrôle chef de file, a présenté un projet de décision proposant de rejeter la réclamation sur la base d’un prétendu abus de l’article 77 du RGPD
(
2026/07/09:
)
Bruxelles, le 8 juillet – Au cours de sa dernière session plénière, le comité européen de la protection des données a adopté des lignes directrices sur l’anonymisation et des lignes directrices sur le web scraping dans le contexte de l’IA générative. En outre, le comité a adopté la version finale de ses lignes directrices sur le traitement des données à caractère personnel au moyen des technologies de la chaîne de blocs. Comprendre les données anonymes Les nouvelles lignes directrices du CEPD clarifient la notion de données anonymes, en tenant également compte de l’arrêt de la Cour de justice de l’Union européenne dans l’affaire C-413/23 P, CEPD/CRU, du 4 septembre 2025, et d’autres arrêts de la CJUE. Les lignes directrices marquent une étape importante dans la clarification de la no
(
2026/07/08:
)
Brussels, 8 July– During its latest plenary, the EDPB has adopted guidelines on anonymisation and guidelines on web scraping in the context of generative AI. In addition, the Board has adopted the final version of its guidelines on the processing of personal data through blockchain technologies. Understanding anonymous data The new EDPB guidelines bring clarity to the notion of anonymous data , taking also into account the ruling of the Court of Justice of the EU in the case C-413/23 P EDPS v SRB of 4 September 2025 and other CJEU jurisprudence. The guidelines mark a significant milestone in clarifying the notion of anonymous data, establishing clear standards that facilitate the use of data while protecting individuals' fundamental rights. In developing these guidelines, we incorporated valuable input from our stakeholder event, showing, once more, our strong commitment to collaborative dialogue as outlined in the EDPB Helsinki statement. EDPB Chair, Anu Talus Data is anonymous if it does no
(
2026/07/01:
)
Brussels/Frankfurt, 1 July – The EDPB and the Anti-Money Laundering Authority (AMLA) are working together to bring greater clarity to a question of growing importance for industry and authorities alike: how to share information to fight financial crime while protecting personal data. Why information sharing matters The fight against financial crime depends on cooperation, and information sharing can help detect and prevent money laundering and terrorist financing. Art. 75 of the AML Regulation makes this possible, allowing companies and professionals covered by anti-money laundering rules to share information with each other and with public authorities, within clear limits. The new information sharing possibility will apply from 10 July 2027. To provide clarity on this possibility, the EDPB and AMLA will work together on the development of Joint Guidelines. Clearer rules for industry and authorities Sharing information of this kind means processing personal data, which is why data protection safe
(
2026/06/25:
)
Brussels, 25 June - The EDPB has published an update of the One-Stop-Shop (OSS) case digest on right to object and right to erasure . This project has been developed in the framework of the of the Support Pool of Experts programme, which aims to support cooperation among Data Protection Authorities (DPAs). Thematic one-stop-shop case digests are drafted on the basis of one-stop-shop decisions taken from the EDPB’s public register (based on Art.60 GDPR). Such case digests complement the EDPB's public register by selecting and presenting the most important decisions on a given theme and providing aggregate results of relevant decisions on this theme. The one-stop-shop thematic case digest on the right to object and right to erasure offers insights into how DPAs analyse the internal processes implemented within organisations to comply with these rights . It also lists the most frequent infringements and gives an overview of which corrective measures have been issued . Cases cover for example the exerci
(
2026/06/24:
)
Brussels, 24 June – The EDPB has launched a dedicated contact form for stakeholders to report possible inconsistencies in how the GDPR is interpreted across Europe. This initiative reflects the commitments set out in the EDPB Helsinki Statement on enhanced clarity, support and engagement , aimed at strengthening the dialogue with stakeholders and ensuring consistent GDPR enforcement across Europe. The new tool enables stakeholders to report alleged divergences between national positions, as well as between national positions and those of the EDPB . The EDPB will not respond to individual submissions, but the information received will be compiled regularly and discussed at a high level by the Board members to consider possible steps to improve consistency
(
2026/06/23:
)
Bruxelles, le 19 mars 2026 – Le comité européen de la protection des données (CEPD) et le Contrôleur européen de la protection des données (CEPD) ont adopté un avis conjoint sur la proposition de la Commission européenne d’acte législatif sur la cybersécurité no 2 (CSA2) et sur la proposition de modification de la directive relative à la sécurité des réseaux et de l’information no 2 (SRI 2). Le 20 janvier 2026, la Commission a publié une proposition de train de mesures sur la cybersécurité visant à renforcer encore la cybersécurité en Europe tout en facilitant le respect de la législation en matière de cybersécurité par les organisations. Dans leur avis conjoint, rendu à la demande de la Commission*, l’EDPB et le CEPD abordent la proposition de révision de l’ACC et les modifications ciblé
(
2026/06/22:
)
Brussels, 22 June - Since its establishment in 2018, the core mission of the EDPB has been to uphold and safeguard the right to data protection. Over the years, the EDPB has played a key role in ensuring the consistent application of the GDPR across Europe, by providing guidance on key GDPR concepts and the interaction of the GDPR with other digital laws, as well as through the adoption of consistency opinions and binding decisions. The EDPB is also committed to making GDPR compliance easier for organisations and enhancing its dialogue with stakeholders . The EDPB is glad to announce today the launch of its newly redesigned website and updated brand identity. The EDPB’s new website: enhanced accessibility and user experience The new website offers stakeholders an improved user experience, more intuitive navigation , tailored to different user groups, better access to key information , and clearer routes for interaction . The site has been developed in line with accessibility standards to ensure a more i
(
2026/06/22:
)
Brussels, 12 June – As of today, coordinated supervision of the European Union’s asylum and migration database (Eurodac) will be carried out by the Coordinated Supervision Committee (CSC). Eurodac is an information system initially designed to compare the fingerprints of asylum applicants and irregular migrants, which has evolved into a full asylum and migration management system. It plays a key role in implementing the Dublin III Regulation , which aims at determining the Member State responsible for examining an asylum application. Operational since 15 January 2003, this system is currently used by all EU Member States as well as Iceland , Liechtenstein , Norway and Switzerland . National DPAs supervise the processing of personal data by national authorities and its transmission to the Eurodac database (central unit), whereas the European Data Protection Supervisor (EDPS) is responsible for the supervision of the processing of personal data at the central unit and its transmission to the Member
(
2026/06/22:
)
Brussels, 10 June – During its latest plenary, the EDPB met with Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection. In addition, the Board has adopted a common data breach notification template . The Board held a meeting with Commissioner McGrath, engaging in a fruitful discussion about common priorities and ongoing work on areas of mutual interest . The Digital Omnibus was among the key topics that shaped the discussion. The Board reiterated that, while several proposed changes have been welcomed by the Board, it is crucial not to adopt the proposed amendments to the definition of personal data, as they risk significantly weakening individual data protection. “The digital ecosystems we regulate are dynamic, multilayered, and evolving at unprecedented pace. In an increasingly digital and competitive world, the EDPB supports simplification, but never at the expense of fundamental rights. Promoting a human-centric approach to digital regulation—one t
(
2026/06/22:
)
Bruxelles, le 10 juin – Lors de sa dernière session plénière, le comité européen de la protection des données a rencontré Michael McGrath, commissaire chargé de la démocratie, de la justice, de l’état de droit et de la protection des consommateurs. En outre, le comité a adopté un modèle commun de notification des violations de données. Le conseil d’administration a tenu une réunion avec le commissaire McGrath, dans le cadre d’une discussion fructueuse sur les priorités communes et les travaux en cours dans des domaines d’intérêt mutuel. L'omnibus numérique a été l'un des principaux sujets qui ont façonné la discussion. Le comité a réaffirmé que, bien que plusieurs modifications proposées aient été saluées par le comité, il est essentiel
(
2026/06/22:
)
Background information Date of final decision: 18 December 2025 National case Controller: LTL S.p.A. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject) Decision: Administrative fine, Compliance order, Erasure order or Add here your free text for the decision Key words: Administrative fine, Principles relating to processing of personal data, Transparency, Right of access, Employment, Data subject rights Summary of the Decision Origin of the case In a complaint submitted to the Italian Supervisory Authority (SA), an individual complained that, after receiving a disciplinary letter followed by dismissal, the company had denied him access to his company' email account, which remained active. Exercising his rights, the data subject asked the company to disable the email account
(
2026/06/22:
)
Background information Date of final decision: 10 July 2025 National case Controller: Magna PT S.p.A. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine, Definitive ban on data processing Key words: Administrative fine, Principles relating to processing of personal data, Transparency, Retention time, Lawfulness of processing, Employment Summary of the Decision Origin of the case A trade union report highlighted a widespread practice within an automotive company: after an absence due to illness, accident or hospitalisation, workers were interviewed and asked to complete a questionnaire. The document, completed by a direct supervisor, was then sent to the Human Resources Department, which, together with the supervisor and/or the competen
(
2026/06/22:
)
Background information Date of final decision: 11 February 2026 National case Controller: Vodafone-Panafon S.A Hellenic Telecommunications Company Legal Reference: Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject, Article 12.2: Facilitation of the exercise of the rights of the data subject, Article 12.3: Time limit for responding to a request, Article 12.4: Information to be provided where no action is taken on the request, Article 15: Right of access by the data subject, Article 18: Right to restriction of processing Decision: Infringement of the GDPR; fine imposed; order to comply Key words: Transparent information, communication and exercise of the rights of the data subject Summary of the Decision Origin of the case A complaint was submitted to the Greek SA against Vodafone-Panafon S.A Hellenic Telecommunications Company for violation of the right of access to recorded calls, violation of the right to restriction of proce
(
2026/06/22:
)
Background information Date of final decision: 27 November 2025 National case Controller: Pioneer Hi-Bred Italia Sementi s.r.l. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 13 (Information to be provided where personal data are collected from the data subject), Article 28 (Processor), Article 88 Decision: Administrative fine, Compliance order, Erasure order Key words: Administrative fine, Principles relating to processing of personal data, Lawfulness of processing, Transparency, Definition of controller, Employment Summary of the Decision Origin of the case Following a complaint, the Italian Supervisory Authority (SA), became aware that a company had installed a satellite tracking device on company vehicles assigned to its employees, which was able to detect their behavior (times, mileage, fuel consumption, and driving style), both during work and private trips. The data collected were use
(
2026/06/22:
)
Background information Date of final decision: 27 November 2025 National case Controller: Verisure Italia srl Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 7 (Conditions for consent), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject), Article 21 (Right to object) Decision: Administrative fine, Compliance order, Erasure order Key words: Administrative fine, Principles relating to processing of personal data, Consent, Transparency, Right to object, Data retention, Direct marketing, Exercise of data subject rights Summary of the Decision Origin of the case The Italian Supervisory Authority (SA), received a complaint from a former customer who had continued to receive unsolicited promotional text messages even after objecting to the processing of his data, and a report from a
(
2026/06/22:
)
Background information Date of final decision: 10 July 2025 National case Controller: Poste Vita s.p.a. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 33 (Notification of a personal data breach to the supervisory authority) Decision: Administrative fine Key words: Administrative fine, Clients, Data security, Insurance, Personal data breach Summary of the Decision Origin of the case The investigation was initiated following a complaint from an insurance company (Poste Vita) customer who complained about the unlawful disclosure of personal data to an unauthorised third party who had then used it in legal proceedings. The data related to three life insurance policies held by the complainant. Key Findings During the investigation, the Italian Supervisory Authority (SA) verified that the data breach had occurred due to a series of errors committed by the company's operators. They had responded to requests for information regarding the data subject&
(
2026/06/12:
)
Brussels, 12 June – As of today, coordinated supervision of the European Union’s asylum and migration database (Eurodac) will be carried out by the Coordinated Supervision Committee (CSC). Eurodac is an information system initially designed to compare the fingerprints of asylum applicants and irregular migrants, which has evolved into a full asylum and migration management system. It plays a key role in implementing the Dublin III Regulation , which aims at determining the Member State responsible for examining an asylum application. Operational since 15 January 2003, this system is currently used by all EU Member States as well as Iceland , Liechtenstein , Norway and Switzerland . National DPAs supervise the processing of personal data by national authorities and its transmission to the Eurodac database (central unit), whereas the European Data Protection Supervisor (EDPS) is responsible for the supervision of the processing of personal data at the central unit and its transmission to the Member
(
2026/06/11:
)
Bruxelles, le 10 juin – Lors de sa dernière session plénière, le comité européen de la protection des données a rencontré Michael McGrath, commissaire chargé de la démocratie, de la justice, de l’état de droit et de la protection des consommateurs. En outre, le comité a adopté un modèle commun de notification des violations de données. Le conseil d’administration a tenu une réunion avec le commissaire McGrath, dans le cadre d’une discussion fructueuse sur les priorités communes et les travaux en cours dans des domaines d’intérêt mutuel. L'omnibus numérique a été l'un des principaux sujets qui ont façonné la discussion. Le comité a réaffirmé que, bien que plusieurs modifications proposées aient été saluées par le comité, il est essentiel
(
2026/06/10:
)
Brussels, 10 June – During its latest plenary, the EDPB met with Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection. In addition, the Board has adopted a common data breach notification template . The Board held a meeting with Commissioner McGrath, engaging in a fruitful discussion about common priorities and ongoing work on areas of mutual interest . The Digital Omnibus was among the key topics that shaped the discussion. The Board reiterated that, while several proposed changes have been welcomed by the Board, it is crucial not to adopt the proposed amendments to the definition of personal data, as they risk significantly weakening individual data protection. “The digital ecosystems we regulate are dynamic, multilayered, and evolving at unprecedented pace. In an increasingly digital and competitive world, the EDPB supports simplification, but never at the expense of fundamental rights. Promoting a human-centric approach to digital regulation—one t
(
2026/05/05:
)
Brussels, 5 May – On 9 May each year, Europeans celebrate the anniversary of the Schuman Declaration, the key moment which led to the creation of the EU as we know it today. To mark this special occasion, the European institutions will open their doors to the public on 9 May 2026 , and we would be delighted to welcome you. Come and visit us We invite you to our interactive booth to discover and enjoy the activities we have prepared together with the European Data Protection Supervisor (EDPS). • When: 9 May 2026, from 10:00 to 18:00 (CET) • Where: European Parliament (Rue Wiertz 60, Brussels) You will find us on the ground floor, in the cybersecurity area. Test your skills and discover more During your visit, you will get the chance to enjoy fun activities tailored just for you. This includes a: • EU Survey Quiz to test your knowledge of EU institutions • Roulette that will test you
(
2026/04/30:
)
Brussels, 23 April – The EDPB is organising a remote stakeholder event in the context of its joint work with the European Commission on upcoming guidelines on the interplay between competition and data protection . The event is an opportunity for stakeholders to inform and support the ongoing work on this topic. It also reflects the EDPB’s commitment to stakeholder engagement and cross-regulatory cooperation, as outlined in the Helsinki statement and in the EDPB Strategy 2024-2027 . Join the event to have your say This is your chance to contribute directly to a fast-evolving and highly relevant policy area. The EDPB will launch a call for expressions of interest to participate in the stakeholder event. Further details on the date and format will be published on the EDPB website
(
2026/04/27:
)
Brussels, 27 April – Today marks the 10th anniversary of the GDPR’s adoption, the first comprehensive data protection framework spanning an entire continent, establishing clear rights for individuals and obligations for organisations across Europe. The moment that led to the creation of the EDPB The GDPR led to the establishment of the European Data Protection Board (EDPB) on 25 May 2018, replacing the Article 29 Working Party that was previously in charge of dealing with issues relating to the protection of personal data. The GDPR gave the Data Protection Authorities (DPAs) stronger enforcement powers and expanded the scope of their work from focusing mainly on national compliance complaints to routinely dealing with cross-border cases. In the past 10 years, the 31 European DPAs comprising the EDPB have worked together to ensure the consistent enforcement of the GDPR and a harmonised data protection approach across Europe. A key role in an evolving digital landscape Today, the GDPR is part
(
2026/04/23:
)
Brussels, 23 April – The EDPB is organising a remote stakeholder event in the context of its joint work with the European Commission on upcoming guidelines on the interplay between competition and data protection . The event will take place on 29 June 2026 and is an opportunity for stakeholders to inform and support the ongoing work on this topic. The event reflects the EDPB’s commitment to stakeholder engagement and cross-regulatory cooperation, as outlined in the Helsinki statement and in the EDPB Strategy 2024-2027 . Join the event to have your say This is your chance to contribute directly to an evolving and highly relevant policy area. The EDPB will launch a call for expression of interest to participate in the stakeholder event in the following weeks. More details about the date and format will follow soon on the EDPB website
(
2026/04/17:
)
Bruxelles, le 16 avril – Lors de sa dernière session plénière, le comité européen de la protection des données a adopté des lignes directrices sur le traitement des données à caractère personnel à des fins de recherche scientifique. En outre, le conseil d'administration a créé une équipe pour accélérer la finalisation des lignes directrices sur l'anonymisation. L’EDPB a également adopté deux avis sur les deux ensembles de critères de certification Europrivacy pour l’approbation en tant que labels européens de protection des données, dont l’un doit être utilisé comme outil pour les transferts. De nombreux domaines de la recherche scientifique reposent sur le traitement des données à caractère personnel des personnes, ce qui a permis d’importantes avancées scientifiques au bén
(
2026/04/16:
)
Brussels, 16 April – During its latest plenary, the EDPB has adopted Guidelines on processing of personal data for scientific research purposes . In addition, the Board has created a team to speed up the finalisation of the guidelines on anonymisation. The EDPB has also adopted two opinions on the two sets of the Europrivacy certification criteria for approval as European Data Protection Seals, one of which to be used as a tool for transfers. Many areas of scientific research rely on the processing of individuals’ personal data, and this has driven significant scientific breakthroughs that benefit society. The rise of new technologies, such as artificial intelligence, also contributes to scientific progress by enabling researchers to use and analyse data in innovative ways. The main objective of the EDPB guidelines on scientific research is to provide more clarity for researchers and make GDPR compliance easier , while ensuring the protection of individuals’ fundamental rights . “Scien
(
2026/04/15:
)
Brussels, 14 April - In line with the EDPB’s Helsinki Statement to make GDPR compliance easier and strengthen consistency across Europe, the EDPB has adopted a template for Data Protection Impact Assessments (DPIA) . The template will help organisations structure, harmonise and evidence their DPIA reporting processes. The template is complemented by an explainer document providing concise explanations for completing this template effectively, by breaking down key concepts in a simple language and addressing possible questions and knowledge gaps controllers might have. A DPIA is a process required in situations where the processing is likely to result in a high risk, to describe how personal data will be processed, assess whether the processing is necessary and appropriate, and identify and reduce risks to individuals’ rights and freedoms. The EDPB template has been conceived to support organisations step by step in this process while filling the template. Controllers can conduct their risk analysi
(
2026/04/09:
)
Brussels, 09 April - The European Data Protection Board (EDPB) has published its 2025 Annual Report . The report provides an overview of the EDPB work carried out in 2025 and reflects on important milestones, such as the adoption of the Helsinki Statement on Enhanced Clarity, Support, and Engagement . “In 2025, we saw the data protection landscape change significantly. The rapid expansion of the EU’s digital regulatory framework has added complexity to the data protection ecosystem. To help organisations navigate this complexity and support compliance, the EDPB focused on enhancing legal certainty, making compliance more achievable in practice, and strengthening cooperation, both among Data Protection Authorities and with other regulators. We also prioritised meaningful dialogue with stakeholders to ensure our work reflected real-world needs. Our achievements support economic growth while continuing to protect individuals’ fundamental rights to privacy and data protection.&
(
2026/04/09:
)
Bruxelles, le 9 avril – Le comité européen de la protection des données (CEPD) a publié son rapport annuel 2025. Le rapport donne un aperçu des travaux menés par le comité européen de la protection des données en 2025 et se penche sur des étapes importantes, telles que l’adoption de la déclaration d’Helsinki sur le renforcement de la clarté, du soutien et de l’engagement. «En 2025, le paysage de la protection des données a considérablement évolué. L’expansion rapide du cadre réglementaire numérique de l’UE a ajouté de la complexité à l’écosystème de la protection des données. Pour aider les organisations à naviguer dans cette complexité et à soutenir la conformité, l’EDPB s’est attaché à renforcer la sécurité jur
(
2026/03/24:
)
Brussels, 23 March - On 17 March 2026, the EDPB conference “Cross-regulatory interplay and cooperation in the EU: a data protection perspective” took place in Brussels. The event showcased high-level discussions, featuring contributions from representatives of key EU institutions, European Data Protection Authorities, academia and industry. Key takeaways from the panel discussions Throughout the day, three panels were held, focusing on 1) data protection and competition , 2) the Digital Markets Act (DMA) and the GDPR , and 3) the Digital Services Act (DSA) and the GDPR . During the first panel , speakers emphasised the critical need for cooperation between regulatory bodies in the fields of data protection and competition and shared views on what regulators in the two fields can learn from each other, especially in the aftermath of the Bundeskartellamt ruling. A speaker emphasized that regulators should align their approaches and recognize synergies between the two fields, such as prot
(
2026/03/20:
)
Bruxelles, le 19 mars 2026 – Le comité européen de la protection des données (CEPD) et le Contrôleur européen de la protection des données (CEPD) ont adopté un avis conjoint sur la proposition de la Commission européenne d’acte législatif sur la cybersécurité no 2 (CSA2) et sur la proposition de modification de la directive relative à la sécurité des réseaux et de l’information no 2 (SRI 2). Le 20 janvier 2026, la Commission a publié une proposition de train de mesures sur la cybersécurité visant à renforcer encore la cybersécurité en Europe tout en facilitant le respect de la législation en matière de cybersécurité par les organisations. Dans leur avis conjoint, rendu à la demande de la Commission*, l’EDPB et le CEPD abordent la proposition de révision de l’ACC et les modifications
(
2026/03/19:
)
Brussels, 19 March 2026 – The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the European Commission’s proposal for a Cybersecurity Act 2 (CSA2) and the proposal on amendments to the Network and Information Security 2 (NIS2) Directive . On 20 January 2026, the Commission published a cybersecurity package proposal to further strengthen cybersecurity in Europe while making compliance with cybersecurity laws easier for organisations. In their joint opinion, issued at the request of the Commission*, the EDPB and the EDPS address the proposed revision of the CSA and the targeted amendments to the NIS2 Directive. “The relationship between data protection and cybersecurity is reciprocal and deeply interconnected. While cybersecurity supports the protection of personal data by limiting the risks of unwanted access, modification or unavailability of data, it is crucial to ensure that security controls are implemented in a way t
(
2026/03/19:
)
Brussels, 19 March - The EDPB has launched its Coordinated Enforcement Framework (CEF) action for 2026*. Following a year-long coordinated action on the right to erasure in 2025 , the CEF's focus this year will shift to compliance with the obligations of transparency and information under the GDPR . The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more control over their data. Next steps During 2026, 25 Data Protection Authorities (DPAs) across Europe will take part in this initiative. They will look closely to assess the compliance of controllers with their transparency obligations under the GDPR. Participating DPAs will soon contact controllers from different sectors across Europe, either through enforcement actions or fact-finding exercises. In the latter case, they might also decide to undertake additional follow-up actions if needed. During the sec
(
2026/03/12:
)
Bruxelles, le 12 mars 2026 – Le comité européen de la protection des données (CEPD) et le Contrôleur européen de la protection des données (CEPD) ont adopté un avis conjoint sur la proposition de la Commission européenne relative à un acte législatif européen sur les biotechnologies. La proposition vise à renforcer les secteurs européens de la biotechnologie et de la bioproduction, en particulier dans le domaine de la santé, en rationalisant le cadre réglementaire et en actualisant les règles relatives aux essais cliniques. L’EDPB et le CEPD soutiennent l’objectif de la proposition consistant à favoriser la compétitivité de l’UE et à remédier à la fragmentation existante dans l’application du règlement sur les essais cliniques. En particulier, ils se félicitent de l'objectif visant à établir
(
2026/03/12:
)
Brussels, 12 March 2026 – The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the European Commission’s Proposal for a European Biotech Act . The Proposal aims to strengthen Europe’s biotechnology and biomanufacturing sectors, particularly in the area of health, by streamlining the regulatory framework and updating the rules for clinical trials. The EDPB and the EDPS support the Proposal’s objective of fostering the EU’s competitiveness and addressing existing fragmentation in the application of the Clinical Trials Regulation (CTR). In particular, they welcome the aim to establish a single legal basis for the processing of personal data by sponsors and investigators, which will significantly improve legal clarity across Europe. At the same time, the EDPB and the EDPS underline that the sensitivity of health and genetic data processed in the context of clinical trials requires a high standard of protection. T
(
2026/03/06:
)
Brussels, 6 March - The EDPB organises a remote event to collect stakeholders’ input on its Guidelines on the processing of personal data to target or deliver political advertisements under the regulation on the transparency and targeting of political advertising , on 27 March 2026. The agenda is available here This will be an opportunity to inform and support the EDPB’s ongoing work on this topic as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakeholder engagement, as outlined in the recent Helsinki statement . Find out more: discussion paper
(
2026/03/03:
)
The conference "Cross- regulatory interplay and cooperation in the EU: a data protection perspective” takes place on 17 March 2026 from 9.15 to 15.30 . This event will offer a high-level overview of the EDPB’s work in the EU’s cross-regulatory landscape, focusing in particular on how regulatory frameworks interact and how cooperation between authorities is ensured. See the full conference programme Registration is now closed, but the event will be livestreamed on our
(
2026/02/23:
)
Brussels, 23 February - EDPB Chair Anu Talus has signed a Joint Statement on AI-Generated Imagery and the Protection of Privacy on behalf of the EDPB . The statement, coordinated by the Global Privacy Assembly's (GPA) International Enforcement Cooperation Working Group (IEWG) , represents the united position of 61 authorities across the world. This reflects the Board’s commitment to contributing to the global dialogue on data protection as outlined in the fourth pillar of its work programme 2026-2027 . The statement addresses serious concerns about AI systems that generate realistic images and videos depicting identifiable individuals without their knowledge or consent. Whilst AI has the potential to bring numerous benefits for individuals and society, recent developments - particularly AI image and video generation integrated into widely accessible social media platforms - have enabled the creation of non-consensual intimate imagery, defamatory depictions, and other harmful content featuring
(
2026/02/18:
)
Brussels, 18 February - The European Data Protection Board (EDPB) has adopted a report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) . The Board selected this topic as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. The main objectives of this coordinated action are to ensure that the right to erasure is effectively exercised by individuals in Europe and understand how controllers comply with this right in practice. In addition, the EDPB identified good practices and the most important related challenges, with the aim of providing further guidance on this topic. Throughout 2025, 32 DPAs across Europe took part in this initiative. More specifically, 9 DPAs have initiated new formal investigations or have continued ongoing ones, and 23 DPAs carried out a fact-finding exercise. A total of 764 controllers across Europe responded to the
(
2026/02/13:
)
Brussels, 13 February - The EDPB has recently adopted its work programme for 2026-2027 , which is grounded in the four pillars of the EDPB strategy 2024-2027 . The work programme is based on the priorities set out in the EDPB strategy and it also takes into account the commitments made in the Helsinki Statement on enhanced clarity, support and engagement aimed at making GDPR compliance easier, strengthening consistency, and boosting cross-regulatory cooperation. Easing compliance is at the top of the EDPB agenda The work programme reaffirms the commitment of the EDPB to simplifying GDPR compliance for organisations, which includes the development of a series of ready-to-use templates for organisations . Following the public consultation on this, the EDPB decided to develop templates for legitimate interest assessment, record of processing activities and privacy notice/policy in addition to the already announced templates for data breach notifications and data protection impact assessment . This is
(
2026/02/12:
)
Bruxelles, le 12 février – Lors de sa dernière session plénière, le comité européen de la protection des données a adopté son programme de travail pour la période 2026-2027. Il s’agit du deuxième programme de travail visant à soutenir la mise en œuvre de la stratégie 2024-2027 du comité européen de la protection des données *. Le programme de travail se fonde sur les priorités définies dans la stratégie du comité européen de la protection des données et sur les besoins identifiés comme les plus critiques pour les parties prenantes. Elle tient également compte des engagements pris dans la déclaration d’Helsinki sur le renforcement de la clarté, du soutien et de l’engagement visant à faciliter la conformité au RGPD, à renforcer la cohérence et à
(
2026/02/12:
)
Brussels, 12 February - During its latest plenary, the EDPB adopted its work programme for 2026-2027 . This is the second work programme to support the implementation of the EDPB strategy 2024-2027 *. The work programme is based on the priorities set out in the EDPB strategy and the needs identified as most critical for stakeholders. It also takes into account the commitments made in the Helsinki Statement on enhanced clarity, support and engagement aimed at making GDPR compliance easier, strengthening consistency, and boosting cross-regulatory cooperation. Built on the four pillars of the EDPB strategy, the work programme focuses on 1) enhancing harmonisation and promoting compliance , 2) reinforcing a common enforcement culture and effective cooperation , 3) safeguarding data protection in the developing digital and cross-regulatory landscape , and 4) contributing to the global dialogue on data protection . Enhancing harmonisation and promoting compliance The EDPB will continue to provide timely and c
(
2026/02/11:
)
Brussels, 11 February - The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the Digital Omnibus Regulation proposal .* This proposal aims to simplify the EU's digital regulatory framework, reduce administrative burden and enhance the competitiveness of European organisations. The EDPB and the EDPS focus on the aspects concerning the GDPR, the EUDPR, the ePrivacy Directive, and the Data Acquis.** More specifically, they assess whether the proposal 1) leads to real simplification and facilitates compliance, 2) brings more legal certainty and 3) affects individuals’ fundamental rights. Changes to the GDPR and the EUDPR Changes raising significant concerns Some proposed changes raise significant concerns as they can adversely affect the level of protection enjoyed by individuals, create legal uncertainty and make data protection law more difficult to apply. The EDPB and the EDPS strongly urge the co-legislators not to adopt the pro
(
2026/02/11:
)
Bruxelles, le 11 février - Le comité européen de la protection des données (CEPD) et le Contrôleur européen de la protection des données (CEPD) ont adopté un avis conjoint sur la proposition de règlement omnibus numérique*. Cette proposition vise à simplifier le cadre réglementaire numérique de l'UE, à réduire la charge administrative et à renforcer la compétitivité des organisations européennes. L’EDPB et le CEPD se concentrent sur les aspects concernant le RGPD, le RPDUE, la directive «vie privée et communications électroniques» et l’acquis en matière de données.** Plus précisément, ils évaluent si la proposition 1) conduit à une véritable simplification et facilite le respect des dispositions, 2) apporte une plus grande sécurité juridique et 3) porte atteinte au
(
2026/02/03:
)
The European Data Protection Board (EDPB) invites you to register for its conference, “Cross-regulatory interplay and cooperation in the EU: a data protection perspective” , taking place on 17 March 2026 in Brussels . This event will offer a high-level overview of the EDPB’s work in the EU’s cross-regulatory landscape, focusing in particular on how regulatory frameworks interact and how cooperation between authorities is ensured. Registration is open until 26 February 2026 and can be completed by filling out the EU Survey ( link ). There will also be a possibility to follow the event remotely.
(
2026/01/29:
)
Brussels, 29 January - The EDPB organises a remote event to collect stakeholders’ input on its Guidelines on the processing of personal data to target or deliver political advertisements under the regulation on the transparency and targeting of political advertising . The event will take place on 27 March 2026 (time to be confirmed). This will be an opportunity to inform and support the EDPB’s ongoing work on this topic as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakeholder engagement, as outlined in the recent Helsinki statement . Who can participate? The EDPB invites individuals or organisations with relevant expertise in the event's specific topic to take part in the event. How to take part? Click here to find further information and express your interest If you have technical problems submitting the application, we invite you to refresh the page or open the form in a different browser. The call for interest is o
(
2026/01/28:
)
Watch the video on online data protection risks for kids Brussels, 28 January - Every day, the European Data Protection Authorities (DPAs) that make up the EDPB work together to ensure the protection of individuals’ personal data. When it comes to children's data, extra vigilance is essential , particularly in today's fast-evolving digital environment where new risks emerge constantly. Children are more at risk online than adults because they do not easily recognise dangers, tend to trust strangers too much, and may share personal data without realising. The apps they use often collect their data and, without adequate protections, they can be exposed to harmful content. These risks can follow them throughout their lives, affecting their privacy and leaving long-term digital footprints that are difficult to erase. The EDPB’s commitment in action Protecting children’s data is a strategic priority for the EDPB and the Board has delivered important advances in safegu
(
2026/01/21:
)
Bruxelles, le 21 janvier – Le comité européen de la protection des données (CEPD) et le Contrôleur européen de la protection des données (CEPD) ont adopté un avis conjoint sur la proposition de la Commission européenne relative à l’«omnibus numérique sur l’IA». La proposition vise à simplifier la mise en œuvre de certaines règles harmonisées au titre de la législation sur l’IA afin de garantir leur application effective. L’EDPB et le CEPD soutiennent l’objectif consistant à relever les défis pratiques liés à la mise en œuvre de la législation sur l’IA. La simplification administrative ne doit toutefois pas amoindrir la protection des droits fondamentaux. L’avis conjoint reconnaît la complexité du paysage de l’IA et salue les efforts visant à alléger les charges pesant su
(
2026/01/21:
)
Brussels, 21 January - The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the European Commission’s Proposal for the ‘Digital Omnibus on AI’ . The Proposal seeks to simplify the implementation of certain harmonised rules under the AI Act to ensure their effective application. The EDPB and the EDPS support the objective of addressing practical challenges relating to the implementation of the AI Act. Administrative simplification must not, however, lower the protection of fundamental rights . The Joint Opinion acknowledges the complexity of the AI landscape and welcomes efforts to ease burdens for organisations. However, certain proposed changes could undermine the protection of individuals in the context of AI. “Innovation and efficiency are crucial and can coexist with maintaining accountability of AI providers. We welcome EU-level regulatory sandboxes and simplified procedures to promote innovation and sup
(
2026/01/19:
)
Bruxelles, le 19 janvier – Lors de sa dernière session plénière, le comité européen de la protection des données a adopté un rapport visant à soutenir l’évaluation, par la Commission européenne, de la directive en matière de protection des données dans le domaine répressif. La Commission doit présenter son rapport public* sur l’évaluation et le réexamen de la présente directive au Parlement européen et au Conseil au plus tard le 6 mai 2026. En amont, la Commission a recueilli les points de vue des autorités européennes de protection des données (APD) sur l’application et le fonctionnement de la directive en matière de protection des données dans le domaine répressif au cours de la période allant de janvier 2022 au 31 août 2025**. «Nous nous félicitons des évaluations r&
(
2026/01/19:
)
Brussels, 19 January - During its latest plenary, the EDPB adopted a report to support the European Commission’s evaluation of the Law Enforcement Directive (LED ). The Commission has to submit its public report* on the evaluation and review of this Directive to the European Parliament and to the Council by 6 May 2026. Ahead of this, the Commission gathered the views of the European Data Protection Authorities (DPAs) on the application and functioning of the LED over the period from January 2022 to 31 August 2025.** “We welcome the European Commission’s regular evaluations of the application of the LED, and we are committed to providing our expertise for these evaluations to ensure that the LED continues to uphold high data protection standards in the law enforcement context.” EDPB Chair, Anu Talus The EDPB facilitates cooperation and coordination between DPAs when supervising law-enforcement processing. The EDPB Secretariat also provides the Secretariat of the Coordinated Superv
(
2025/12/05:
)
Bruxelles, le 4 décembre – Lors de sa dernière session plénière, l'EDPB a adopté des recommandations sur la base juridique permettant d’exiger la création de comptes d’utilisateurs sur les sites web de commerce électronique . En outre, le comité a eu une discussion préliminaire sur la proposition d’omnibus numérique et a nommé la nouvelle vice-présidente de l'EDPB. Les internautes visitent les sites Web de commerce électronique pour diverses raisons, notamment pour effectuer des achats en ligne, profiter de promotions ou simplement naviguer sur des produits. Lors de l'interaction avec ces sites Web, il peut leur être demandé de créer un compte, ce qui peut entraîner la collecte et le traitement de données personnelles, ainsi que des risques accrus pour la vie privée et la sécurité. L’EDPB a adopté des recommandations v
(
2025/12/04:
)
Brussels, 4 December - During its latest plenary, the EDPB adopted recommendations on the legal basis for requiring the creation of user accounts on e-commerce websites . In addition, the Board had a preliminary discussion on the Digital Omnibus proposal and appointed the new EDPB Deputy Chair. Internet users visit e-commerce websites for a variety of reasons, including making online purchases, taking advantage of promotions, or simply browsing products. When interacting with these websites, they may be asked to create an account, which can result in the collection and processing of personal data, as well as increased privacy and security risks. The EDPB adopted recommendations to clarify when e-commerce websites can require their users to create an account. As a general rule, users should have the option to engage with e-commerce websites, including the ability to make purchases, without creating an account. In such cases, the EDPB recommends that e-commerce websites offer a choice: either a 'guest'
(
2025/12/03:
)
Brussels, 3 December - As part of its December’s plenary meeting, the European Data Protection Board (EDPB) held yesterday an online meeting with Commissioners and representatives of Data Protection Authorities (DPAs) from the countries and the organisation with an EU adequacy decision. This meeting marked the second of its kind, following the first gathering in October 2024 . An adequacy decision is a key-mechanism in EU data protection legislation which allows free flow of personal data from Europe to third countries or an international organisation offering an adequate level of data protection.* To date, the following countries and organisation benefit from this: Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, United Kingdom, Uruguay, United States, and the European Patent Organisation . Data Protection Authorities from those countries and the European Patent Organisation are key partners for the EDPB, playin
(
2025/12/03:
)
Brussels, 28 November - The EDPB launched a call for expression of interest to establish a new reserve list for the Support Pool of Experts (SPE) programme . The objective is set up a reserve list of legal and technical experts. The legal expertise sought includes a wide range of fields, such as data protection, policy monitoring, technology, cybersecurity, competition, healthcare, online intermediary services and content moderation . As for the technical expertise , the relevant areas include IT auditing, website security, mobile OS and apps, Internet of Things, cloud-computing, behavioural advertising, anonymisation techniques, cryptology, artificial intelligence, User experience (UX) design, fintech , data science, social science (incl. economics, sociology, psychology), and development of applications and software . Bring your expertise to the table Don’t miss this opportunity to participate in this EDPB’s key strategic initiative. Your work will help Data Protection Authorities (DPAs) across
(
2025/12/03:
)
Brussels, 17 November - The EDPB organises a remote event to collect stakeholders’ input on anonymisation and pseudonymisation on implications of the judgement of the Court of Justice of the European Union (CJEU) in EDPS v Single Resolution Board (SRB) . The event will take place on 12 December 2025 (time to be confirmed). This will be an opportunity to inform and support the EDPB’s ongoing work on these topics as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakeholder engagement, as outlined in the recent Helsinki statement . Who can participate? Individuals representing sector associations, organisations or NGOs and individual companies, law firms or academics are invited to express their interest to participate in this event (one participant per organisation). The EDPB encourages all organisations interested in this matter to delegate a representative with technical knowledge of these topics. As a general rule, participants will be registered on
(
2025/12/03:
)
Brussels, 5 November - The European Data Protection Board (EDPB) is taking an important step towards facilitating GDPR compliance for organisations by developing a series of ready-to-use templates. This initiative, announced following the Helsinki Statement on enhanced clarity, support, and engagement , aims to provide practical tools that organisations can readily implement to meet their data protection obligations. To ensure these templates address the needs of organisations, the EDPB has launched a public consultation inviting stakeholders to share their suggestions. The consultation specifically seeks feedback on which types of templates would be most beneficial (for example, a template for privacy notices or a template for records of processing activities). The EDPB will already work on templates for key GDPR requirements such as Data Protection Impact Assessments (DPIAs) and data breach notifications. Contributions can be submitted here until 3 December 2025 . The EDPB encourages all interested parties
(
2025/12/03:
)
Brussels, 5 November - During its latest plenary, the EDPB adopted an opinion on the European Commission’s draft decision on the adequate level of protection of personal data in Brazil .* Once adopted, the decision will ensure that personal data can flow freely from Europe to Brazil and that individuals can retain control over their data. In its opinion, requested by the Commission, the EDPB assesses whether the Brazilian data protection framework and the rules on government access to personal data transferred from Europe provide safeguards essentially equivalent to the ones in EU legislation. The Board positively notes the close alignment with EU legislation and the case law of the Court of Justice of the EU. The EDPB also examines whether the safeguards provided under the legal framework in Brazil are in place and effective. “The EDPB welcomes the alignment between Brazil and Europe’s data protection frameworks. This is a pivotal moment that will strengthen legal certainty for organisation
(
2025/12/03:
)
Bruxelles, le 5 novembre – Lors de sa dernière session plénière, le comité européen de la protection des données a adopté un avis sur le projet de décision de la Commission européenne sur le niveau adéquat de protection des données à caractère personnel au Brésil *. Une fois adoptée, la décision garantira que les données à caractère personnel peuvent circuler librement d’Europe vers le Brésil et que les personnes physiques peuvent conserver le contrôle de leurs données. Dans son avis, demandé par la Commission, l’EDPB évalue si le cadre brésilien de protection des données et les règles relatives à l’accès des pouvoirs publics aux données à caractère personnel transférées depuis l’Europe offrent des garanties essentiellement équivalentes &ag
(
2025/12/03:
)
Brussels, 20 October - During its latest plenary, the EDPB adopted two opinions on the European Commission’s draft decisions on the extension of the validity of the UK adequacy decisions under the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) until December 2031.* The EDPB opinions, requested by the Commission as per Art. 70(1) (s) GDPR and Art. 51(1) (g) LED, address the proposed six-year extension of the two UK adequacy decisions which are set to expire in December 2025. The extension of the validity of the UK adequacy decisions will allow organisations and competent authorities based in Europe to continue transferring data to UK-based organisations and authorities without implementing additional guarantees.** “The EDPB welcomes the continuing alignment between the UK and Europe’s data protection framework, despite the recent changes in the UK legal framework. I call on the European Commission to address the points highlighted by the Board and to ensure
(
2025/12/03:
)
Bruxelles, le 20 octobre – Au cours de sa dernière session plénière, le comité européen de la protection des données a adopté deux avis sur les projets de décisions de la Commission européenne concernant la prorogation de la validité des décisions d’adéquation du Royaume-Uni au titre du règlement général sur la protection des données (RGPD) et de la directive en matière de protection des données dans le domaine répressif (DEL) jusqu’en décembre 2031.* Les avis de l'EDPB, demandés par la Commission conformément à l’article 70, paragraphe 1, point s), du RGPD et à l’article 51, paragraphe 1, point g), de la directive en matière de protection des données dans le domaine répressif , portent sur la proposition de prolongation de six ans des deux décisions d’adéquation du Roya
(
2025/12/03:
)
Brussels, 14 October - During its October plenary, the European Data Protection Board (EDPB) picked the topic for its fifth coordinated enforcement action, which will concern compliance with the obligations of transparency and information under the General Data Protection Regulation (GDPR) . The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more control over their data. In a coordinated action, the EDPB prioritises a certain topic for Data Protection Authorities (DPAs) to work on at national level. The results of these national actions are then aggregated and analysed to generate deeper insight into the topic and allowing for targeted follow-up at both national and European level if needed. Participating DPAs will join this new action on a voluntary basis in the coming weeks and the action itself will be launched over the course of 2026. CEF achievemen
(
2025/10/10:
)
Brussels, 10 October - On the occasion of the upcoming entry into operation of the EU Entry Exit System (EES) on 12 October 2025, the Coordinated Supervision Committee (CSC) will include the EES system under its scope. This system registers non-Schengen nationals travelling with a short stay visa or travellers who are visa exempt. The EES is a large scale IT systems developed by the EU to prevent irregular migration and enhance security in the Schengen area. How it works The EES gradually replaces passport stamping at the external borders of the Schengen area, with the aim of making the border process more efficient. The system records which travellers from third countries, with or without a visa, enter and exit the Schengen area. The implementation of the EES will happen gradually. European countries will have the option to progressively start using this system over a period of six months, starting with the registration of third country nationals at 10% of border crossings. By
(
2025/10/10:
)
Brussels, 9 October - The EDPB is organising a remote stakeholder event to collect stakeholders’ input on anonymisation and pseudonymisation following the clarification on the scope of the concept of personal data provided by the Court of Justice of the European Union (CJEU) in its judgement in EDPS v Single Resolution Board (SRB) . The event will take place by the end of the year. The event will inform and support the EDPB’s ongoing work on these topics as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakeholder engagement, as outlined in the recent Helsinki statement . Do you wish to participate to have your say? The EDPB will launch a call for expression of interest to participate in the stakeholder event in the following weeks. More details about the date and format will follow soon on the EDPB website
(
2025/10/09:
)
Bruxelles, le 9 octobre - Le comité européen de la protection des données (CEPD) et la Commission européenne ont approuvé des lignes directrices communes sur l'interaction entre la législation sur les marchés numériques et le règlement général sur la protection des données (RGPD) . Il s’agit des premières lignes directrices conjointes du conseil d’administration et de la Commission européenne. Conformément à sa stratégie 2024-2027 et auxobjectifs de la récente déclaration d’Helsinki visant à faciliter la conformité au RGPD et à renforcer la cohérence, l’EDPB a coopéré avec la Commission européenne, chacun dans le cadre de ses mandats respectifs, afin de faciliter l’application cohérente du règlement sur les marchés numériques* et du RGPD et d’acc
(
2025/10/09:
)
Brussels, 09 October - The European Data Protection Board (EDPB) and the European Commission endorsed joint guidelines on the interplay between the Digital Markets Act (DMA) and the General Data Protection Regulation (GDPR) . These are the first joint guidelines by the Board and the European Commission. In line with its 2024-2027 Strategy and the recent Helsinki Statement’s objectives to make GDPR compliance easier and strengthen consistency, the EDPB has cooperated with the European Commission, each within their respective mandates, to facilitate the coherent application of the DMA*and GDPR and to increase legal certainty for gatekeepers, business users, beneficiaries and individuals. EDPB Chair Anu Talus said: “These joint guidelines are the result of a fruitful cooperation between the EDPB and the European Commission. This is the first time that the EDPB and the European Commission prepare guidelines jointly. This approach maximises usefulness of the guidance by simplifying compliance fo
(
2025/09/12:
)
Bruxelles, le 12 septembre - Lors de sa réunion plénière de septembre, le comité européen de la protection des données (CEPD) a adopté des lignes directrices sur l'interaction entre la législation sur les services numériques (DSA) et le règlement général sur la protection des données (RGPD) . Il s’agit de la première série de lignes directrices du comité européen de la protection des données sur l’interaction entre le RGPD et la législation numérique récemment adoptée par l’UE. Le règlement sur les services numériques vise à compléter les règles du RGPD afin de garantir le plus haut niveau de protection des droits fondamentaux dans l’espace numérique. Son objectif principal est de créer un environnement en ligne plus sûr dans lequel les droits fondamentaux de tous les utilisat
(
2025/09/12:
)
Brussels, 12 September - During its September plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on the interplay between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR) . These are the first set of EDPB guidelines on the interplay between the GDPR and the EU’s recently adopted digital laws. The DSA aims to complement the rules of the GDPR to ensure the highest level of protection of fundamental rights in the digital space. Its main goal is to create a safer online environment in which the fundamental rights of all users, including the right to freedom of expression, are protected. It applies to online intermediary services , such as search engines and platforms. Several provisions included in the DSA entail the processing of personal data by intermediary service providers. The EDPB guidelines contribute to the consistent application of the DSA and of the GDPR, insofar as some provisions of the DSA concern the processing of personal da
(
2025/07/09:
)
Bruxelles, le 9 juillet 2025 – Le comité européen de la protection des données (CEPD) et le Contrôleur européen de la protection des données (CEPD) ont publié aujourd’hui un avis conjoint sur la proposition de règlement de la Commission européenne modifiant certains règlements, dont le RGPD . La proposition, qui fait partie du quatrième règlement omnibus sur la simplification, vise à simplifier les règles de l’UE et à réduire la charge administrative, en étendant certaines mesures d’atténuation disponibles pour les petites et moyennes entreprises (PME) aux petites entreprises à moyenne capitalisation (PME), et comprend de nouvelles mesures de simplification. La proposition vise à modifier l’article 30, paragraphe 5, du RGPD, en prévoyant une dérogation à l’obligation de tenir un registre des opéra
(
2025/07/09:
)
Brussels, 9 July 2025 - The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) issued today a Joint Opinion on the European Commission’s Proposal for a Regulation amending certain regulations, including the GDPR . The Proposal, part of the fourth simplification Omnibus, aims to simplify EU rules and reduce administrative burden, extending certain mitigating measures available for small and medium sized enterprises (SMEs) to small mid-cap enterprises (SMCs), and includes further simplification measures. The Proposal aims to modify Art.30 (5) GDPR, providing a derogation to the obligation to keep a record of data processing operations. Currently, this derogation only applies to enterprises and organisation under 250 employees, except in certain cases. Under the Proposal, the derogation would apply to an enterprise or organisation employing fewer than 750 people, unless the processing operation carried out is likely to result in a high risk to individuals&rsqu
(
2025/07/03:
)
Une approche de l’innovation et de la compétitivité fondée sur les droits fondamentaux Helsinki, le 3 juillet 2025 – Lors d’une réunion à haut niveau qui s’est tenue à Helsinki les 1er et 2 juillet 2025, le comité européen de la protection des données (CEPD) a adopté une déclaration historique sur le renforcement de la clarté, du soutien et de l’engagement. La déclaration décrit de nouvelles initiatives visant à faciliter la conformité au RGPD, en particulier pour les micro, petites et moyennes organisations, à renforcer la cohérence et à stimuler la coopération entre les réglementations. Le président du comité européen de la protection des données, Anu Talus, a déclaré: «Le comité européen de la protection des données vise à faire en sorte q
(
2025/07/03:
)
A fundamental rights approach to innovation and competitiveness Helsinki, 3 July 2025 – At a high-level meeting in Helsinki on 1–2 July 2025, the European Data Protection Board (EDPB) adopted a landmark Statement on enhanced clarity, support and engagement . The Statement outlines new initiatives to make GDPR compliance easier, in particular for micro, small and medium organisations, strengthen consistency and boost cross-regulatory cooperation. EDPB Chair Anu Talus said: “The EDPB aims to ensure that compliance with the GDPR can be more easily achieved. By placing fundamental rights into the core of their digital transformation, organisations can ensure that technological advancements and the respect for European values go hand in hand, ultimately building a stronger and more resilient digital economy.” Across its efforts, the EDPB will strengthen its dialogue with stakeholders, holding proactive and early engagement to identify areas where further support and clarification is r
(
2025/06/10:
)
Background information Date of final decision: 15 May 2025 National case Controller: SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent, unsolicited communication Summary of the Decision Origin of the case As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors ar
(
2025/06/05:
)
Brussels, 06 June - During its latest plenary, the European Data Protection Board (EDPB) adopted the final version of its guidelines on Art.48 GDPR about data transfers to third country authorities , after public consultation. In addition, the Board presented two new Support Pool of Experts (SPE) projects providing training material on artificial intelligence and data protection. Finally, the Board discussed the European Commission’s request for a joint EDPB-EDPS opinion on the draft proposal on the simplification of record-keeping obligation under the GDPR. Data transfers to third country authorities Following public consultation, the EDPB has adopted the final version of the guidelines on data transfers to third country authorities. In its guidelines, the EDPB zooms in on Art. 48 GDPR and clarifies how organisations can best assess under which conditions they can lawfully respond to requests for a transfer of personal data from third country authorities (i.e. authorities from n
(
2025/05/21:
)
Background information Date of final decision: 15 May 2025 National case Controller: SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months Key words: administrative fine, consent, unsolicited communication Summary of the Decision Origin of the case As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors a
(
2025/05/09:
)
Brussels, 08 May - The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a letter , addressed to the European Commission, on the upcoming proposal on the simplification of record-keeping obligation under the GDPR, amounting to a targeted amendment of Art. 30(5) GDPR. The joint letter replies to the letter sent by the European Commission to the EDPB and the EDPS on 6 May 2025 where the Commission explained how it intends to introduce specific modifications to the GDPR. The EDPB and EDPS understand that a formal consultation will take place after the publication of the proposed legislative change. The EDPB and EDPS shared that, at this stage, they could express preliminary support to this targeted simplification initiative, bearing in mind that this would not affect the obligation of controllers and processors to comply with other GDPR obligations. Nevertheless, the EDPB and EDPS asked the Commission to better evaluate the impact on the organisation sub
(
2025/05/06:
)
Brussels, 06 May - During its latest plenary, the European Data Protection Board (EDPB) adopted an opinion on the European Commission’s draft adequacy decision under the GDPR concerning the European Patent Organisation (EPO) . In addition, the Board adopted an opinion on the European Commission’s proposal to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED) . Finally, the EDPB agreed to grant the status of observer to the Personal Data Protection Agency of Bosnia and Herzegovina. Adequate protection of personal data by the EPO At the European Commission’s request, the Board adopted an opinion on the Commission’s draft adequacy decision regarding the European Patent Organisation (EPO). Once formally adopted by the Commission, this will be the first adequacy decision concerning an international organisation and not a country or a region. An adequacy decision is a key-mechanism in EU data protection legislation which allows the
(
2025/05/06:
)
Bruxelles, le 6 mai – Lors de sa dernière session plénière, le comité européen de la protection des données (CEPD) a adopté un avis sur le projet de décision d’adéquation de la Commission européenne au titre du RGPD concernant l’Organisation européenne des brevets (OEB). En outre, le comité a adopté un avis sur la proposition de la Commission européenne visant à prolonger la validité des décisions d’adéquation du Royaume-Uni au titre du RGPD et de la directive en matière de protection des données dans le domaine répressif . Enfin, l’EDPB a accepté d’accorder le statut d’observateur à l’Agence de Bosnie-Herzégovine pour la protection des données à caractère personnel. Protection adéquate des données à caractère personnel par l'
(
2025/05/05:
)
Every year, on 9 May, people across Europe celebrate the anniversary of the Schuman Declaration, which was a milestone to bring peace and solidarity in Europe. This year is particularly special as it marks the 75th anniversary of this historic moment. Let’s celebrate together To celebrate this occasion, the EDPB takes part in the EU Open Day, with an interactive stand hosted by volunteers from the EDPB Secretariat and national Data Protection Authorities (DPAs). Come and visit us to learn more about data protection and the EDPB’s activities. You will find the EDPB and EDPS stands at the European Commission’s headquarters - the Berlaymont building - Village 1 “A Democratic Union”, on Saturday 10 May from 10:00 to 18:00. Do you want to learn more about privacy and data protection — and test your knowledge? Come visit us for fun activities and quizzes designed just for you! Further information about Europe Day 2025
(
2025/04/23:
)
Bruxelles, le 23 avril - Le comité européen de la protection des données (CEPD) a publié son rapport annuel 2024. Le rapport donne un aperçu des travaux du comité européen de la protection des données menés en 2024 et examine les étapes importantes, telles que l’adoption de la stratégie 2024-2027, l’augmentation des avis de cohérence au titre de l’article 64, paragraphe 2, et la poursuite des efforts visant à fournir des orientations et des conseils juridiques. Le président ducomité européen de la protection des données, Anu Talus, a déclaré: «En revenant sur le travail accompli au cours de l’année écoulée, je suis fier de présenter nos réalisations. En 2024, nous avons réaffirmé notre engagement à protéger les droits fondamentaux des personnes à la vie priv&eacu
(
2025/04/23:
)
Brussels, 23 April - The European Data Protection Board (EDPB) has published its 2024 Annual Report . The report provides an overview of the EDPB work carried out in 2024 and reflects on important milestones, such as the adoption of the 2024-2027 strategy , the increase in Art. 64(2) consistency opinions and the continued efforts to provide guidance and legal advice. EDPB Chair Anu Talus said: “As I look back on the work carried out over the past year, I am proud to present our achievements. In 2024, we reaffirmed our commitment to safeguarding individuals’ fundamental rights to privacy and data protection in a fast-changing digital landscape. We adopted a new strategy and continued to play a central role in providing guidance and ensuring a consistent application of the General Data Protection Regulation (GDPR) across Europe. To support understanding and implementation of data protection rights and duties, we expanded our outreach activities by devoting special attention to businesses and non-exp
(
2025/04/14:
)
Brussels, 14 April - During its April 2025 plenary, the European Data Protection Board (EDPB) has adopted guidelines on processing of personal data through blockchain technologies . A blockchain is a distributed digital ledger system that can confirm transactions and establish who owned a digital asset (such as cryptocurrency) at a given time. Blockchains can also support the secure handling and transfer of data, ensuring its integrity and traceability. As the use of blockchain technologies is expanding, the Board considers it important to help organisations using these technologies to comply with the GDPR. In its guidelines, the EDPB explains how blockchains work, assessing the different possible architectures and their implications for the processing of personal data. The guidelines highlight the importance of implementing technical and organisational measures at the earliest stages of the design of the processing. The
(
2025/03/14:
)
Bruxelles, le 14 mars - Lors de sa réunion plénière de mars 2025, le comité européen de la protection des données (CEPD) a adopté une déclaration sur la mise en œuvre de la directive relative aux données des dossiers passagers (PNR) à la lumière de l’arrêt de la Cour de justice de l’Union européenne (CJUE) dans l’affaire C-817/19*. Dans sa deuxième déclaration sur la mise en œuvre de la directive PNR, qui fait suite à celle du 15 décembre 2022 , le comité donnedes orientations supplémentaires aux unités de renseignements passagers** sur les adaptations et limitations nécessaires au traitement des données des dossiers passagers, à la suite de l’arrêt PNR . Les données des dossiers passagers sont des informations personnelles fournies par les passagers, collectées et conservées par les transp
(
2025/03/14:
)
Brussels, 14 March - During its March 2025 plenary meeting, the European Data Protection Board (EDPB) adopted a statement on the implementation of the Passenger Name Record Directive (PNR) in light of the Court of Justice of the EU (CJEU) judgment C-817/19 *. In its second statement on the implementation of the PNR Directive, which follows the one of 15 December 2022 , the Board gives further guidance to the Passenger Information Units (PIUs)** on the necessary adaptions and limitations to the processing of PNR data, following the PNR judgment. PNR data is personal information provided by passengers, and collected and held by air carriers that includes the names of the passengers, travel dates, itineraries, seats, baggage, contact details and means of payment. The statement includes practical recommendations for the national laws transposing the PNR Directive in order to give effect to the findings of the CJEU in the PNR judgment. The recommendations cover some of the key aspects of the PNR judgement such as
(
2025/03/05:
)
Bruxelles, le 5 mars - Le comité européen de la protection des données (CEPD) a lancé son action relative au cadre coordonné de mise en œuvre (CEF) pour 2025. À la suite d’une action coordonnée d’un an sur le droit d’accès en 2024, le CEF se concentrera cette année sur la mise en œuvre d’un autre droit à la protection des données, à savoir le droit à l’effacement ou le «droit à l’oubli» (article 17 du RGPD). Le comité a choisi ce sujet lors de sa session plénière d’octobre 2024, car il s’agit de l’un des droits les plus fréquemment exercés au titre du RGPD et au sujet duquel les APD reçoivent fréquemment des plaintes de particuliers. Prochaines étapes En 2025, 32 autorités de protection des données (APD) de toute l’Europe participeront à cette initiative.
(
2025/03/05:
)
Brussels, 05 March - The European Data Protection Board (EDPB) has launched its Coordinated Enforcement Framework (CEF) action for 2025. Following a year-long coordinated action on the right of access in 2024 , the CEF's focus this year will shift to the implementation of another data protection right, namely the right to erasure or the “right to be forgotten” (Art.17 GDPR). The Board selected this topic during its October 2024 plenary as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. Next steps During 2025, 32 Data Protection Authorities (DPAs) across Europe will take part in this initiative. Participating DPAs will soon contact a number of controllers from different sectors across Europe, either by opening new formal investigations or doing fact-finding exercises. In the latter case, they might also decide to undertake additional follow-up actions if needed. DPAs will check how controllers handle and respond to
(
2025/02/27:
)
Brussels, 13 February - The EDPB published the Coordinated Supervision Committee's (CSC) biannual activity report (July 2022 - December 2024) . Over the last two years, the CSC worked on the integration of the large-scale EU information technology (IT) systems within its scope. During the reporting period, it took over the supervision of the upgraded Schengen Information System (SIS) and the Visa Information System (VIS). In addition, the Committee prepared for the arrival of new systems and for the implementation of interoperability regulations. The Committee has also published a set of recommendations on the Internal Market Information System (IMI) transparency obligations for data controllers . In addition, in July 2023, the CSC published ‘Europol’s information systems - a guide for exercising data subjects’ rights: the right of access, rectification, erasure and restriction’ . Following the 2022 Audit Report of the EDPS on Europol’s processing of personal data of minors u
(
2025/02/21:
)
If someone asked you to answer 100 questions about your personal life to sell the answers, would you agree? Most likely not. It can be difficult to keep in control over your personal data and to keep it safe. From online shopping and browsing to social media, with every click, share and login-in you leave behind a digital trail. The GDPR ensures that your data can only be used in ways you agree to and that you can access any information about yourself. But do people actually know how to protect their data? We asked passers-by on the streets of Brussels. Happy Data Protection Day! Sorry, your browser doesn't support embedded
(
2025/02/21:
)
Si quelqu'un vous demandait de répondre à 100 questions sur votre vie personnelle pour vendre les réponses, seriez-vous d'accord? Probablement pas. Il peut être difficile de garder le contrôle de vos données personnelles et de les garder en sécurité. Des achats en ligne et de la navigation aux médias sociaux, à chaque clic, partage et connexion, vous laissez derrière vous une trace numérique. Le RGPD garantit que vos données ne peuvent être utilisées que d'une manière que vous acceptez et que vous pouvez accéder à toute information vous concernant. Mais les gens savent-ils réellement comment protéger leurs données? Nous avons demandé aux passants dans les rues de Bruxelles. Bonne journée de la protection des données! Sorry, your browser doesn't support embedded
(
2025/02/13:
)
Brussels, 13 February - The EDPB published the Coordinated Supervision Committee's (CSC) biannual activity report (July 2022 - December 2024) . Over the last two years, the CSC worked on the integration of the large-scale EU information technology (IT) systems within its scope. During the reporting period, it took over the supervision of the upgraded Schengen Information System (SIS) and the Visa Information System (VIS). In addition, the Committee prepared for the arrival of new systems and for the implementation of interoperability regulations. The Committee has also published a set of recommendations on the Internal Market Information System (IMI) transparency obligations for data controllers . In addition, in July 2023, the CSC published ‘Europol’s information systems - a guide for exercising data subjects’ rights: the right of access, rectification, erasure and restriction’ . Following the 2022 Audit Report of the EDPS on Europol’s processing of personal data of minors u
(
2025/02/12:
)
Bruxelles, le 12 février - Lors de sa réunion plénière de février 2025, le comité européen de la protection des données (CEPD) a adopté une déclaration sur l’assurance de l’'ge et a décidé de créer un groupe de travail sur l’application de l’IA. En outre, le Conseil a également adopté des recommandations sur le Code mondial antidopage de l'Agence mondiale antidopage (AMA) de 2027. Dans une déclaration sur la garantie de l’'ge, l’EDPB énumère dix principes pour le traitement conforme des données à caractère personnel lors de la détermination de l’'ge ou de la tranche d’'ge d’une personne. La déclaration vise à garantir une approche européenne cohérente de la garantie de l''ge, afin de protéger les mineur
(
2025/02/12:
)
Brussels, 12 February - During its February 2025 plenary meeting, the European Data Protection Board (EDPB) adopted a statement on age assurance and decided to create a taskforce on AI enforcement. In addition, the Board also adopted recommendations on the 2027 World Anti-Doping Agency (WADA) World Anti-Doping Code. In a statement on age assurance, the EDPB lists ten principles for the compliant processing of personal data when determining the age or age range of an individual. The statement aims to ensure a consistent European approach to age assurance, to protect minors while complying with data protection principles. EDPB Chair Anu Talus said: “Age assurance is essential to ensure that children do not access content that is not appropriate for their age. At the same time, the method to verify age must be the least intrusive possible and the personal data of children must be protected. The principles put forward by the EDPB will help the industry to assess an individual’s age in a wa
(
2025/01/28:
)
If someone asked you to answer 100 questions about your personal life to sell the answers, would you agree? Most likely not. It can be difficult to keep in control over your personal data and to keep it safe. From online shopping and browsing to social media, with every click, share and login-in you leave behind a digital trail. The GDPR ensures that your data can only be used in ways you agree to and that you can access any information about yourself. But do people actually know how to protect their data? We asked passers-by on the streets of Brussels. Happy Data Protection Day! Sorry, your browser doesn't support embedded
(
2025/01/23:
)
Bruxelles, le 20 janvier - Le comité européen de la protection des données (CEPD) a adopté un rapport sur la mise en œuvre du droit d'accès des responsables du traitement. Le rapport résume les résultats d’une série d’actions nationales coordonnées menées en 2024 au titre du cadre de mise en œuvre coordonnée (CEF). Il énumère les problèmes qui ont été observés pour certains contrôleurs, ainsi qu'une série de recommandations pour les aider à mettre en œuvre le droit d'accès. Un élément central est la connaissance, par les responsables du traitement, des lignes directrices 01/2022 du comité européen de la protection des données sur les droits des personnes concernées – Droit d’accès et si ces lignes directrices ont été suivies dans la p
(
2025/01/21:
)
Bruxelles, le 20 janvier - Le comité européen de la protection des données (CEPD) a adopté un rapport sur la mise en œuvre du droit d'accès des responsables du traitement. Le rapport résume les résultats d’une série d’actions nationales coordonnées menées en 2024 au titre du cadre de mise en œuvre coordonnée (CEC). Il énumère les problèmes qui ont été observés pour certains contrôleurs, ainsi qu'une série de recommandations pour les aider à mettre en œuvre le droit d'accès. Un élément central est la connaissance, par les responsables du traitement, des lignes directrices 01/2022 du comité européen de la protection des données sur les droits des personnes concernées – Droit d’accès et si ces lignes directrices ont été suivies dans la p
(
2025/01/20:
)
Brussels, 20 January - The European Data Protection Board (EDPB) has adopted a report on the implementation of the right of access by controllers . The report summarises the outcome of a series of coordinated national actions carried out in 2024 under the Coordinated Enforcement Framework (CEF). It lists the issues that were observed for some controllers, along with a series of recommendations to help them implement the right of access. A central element is controllers’ awareness of the EDPB Guidelines 01/2022 on data subjects rights – Right of access and whether these guidelines were followed in practice. EDPB Deputy Chair Zdravko Vukíc said: “The CEF is a valuable initiative that helps strengthen the cooperation among Data Protection Authorities (DPAs): by tackling selected topics in a coordinated fashion, they achieve greater efficiency and more consistency. How controllers implement the right of access lies at the heart of data protection and it is one of the most frequently exerc
(
2025/01/18:
)
Bruxelles, le 17 janvier – Lors de sa réunion plénière de janvier 2025, le comité européen de la protection des données (CEPD) a adopté des lignes directrices sur la pseudonymisation , ainsi qu’une déclaration sur l’interaction entre le droit de la concurrence et la protection des données . L’EDPB clarifie l’utilisation de la pseudonymisation pour se conformer au RGPD Le RGPD introduit le terme «pseudonymisation»* et le désigne comme une garantie qui peut être appropriée et efficace pour satisfaire aux obligations en matière de protection des données. Dans ses lignes directrices, l’EDPB clarifie la définition et l’applicabilité de la pseudonymisation et des données pseudonymisées, ainsi que les avantages de la pseudonymisation. Les lignes directrices apportent deux clarifications juridiques importantes: Les données pseudonymis
(
2025/01/17:
)
Brussels, 17 January - During its January 2025 plenary meeting, the European Data Protection Board (EDPB) has adopted guidelines on pseudonymisation , as well as a statement on the interplay of competition law and data protection . EDPB clarifies the use of pseudonymisation for GDPR compliance The GDPR introduces the term ‘pseudonymisation’* and refers to it as a safeguard that may be appropriate and effective to meet data protection obligations. In its guidelines, the EDPB clarifies the definition and applicability of pseudonymisation and pseudonymised data, and the advantages of pseudonymisation. The guidelines provide two important legal clarifications: Pseudonymised data, which could be attributed to an individual by the use of additional information, remains information related to an identifiable natural person and is therefore still personal data. Indeed, if the data can be linked back to an individual by the data controller or someone else, it remains personal data. Pseudonymisation
(
2024/12/18:
)
Bruxelles, le 18 décembre – Le comité européen de la protection des données (CEPD) a adopté un avis* sur l’utilisation des données à caractère personnel pour le développement et le déploiement de modèles d’IA . Le présent avis examine 1) quand et comment les modèles d’IA peuvent être considérés comme anonymes, 2) si et comment l’intérêt légitime peut être utilisé comme base juridique pour développer ou utiliser des modèles d’IA, et 3) ce qui se passe si un modèle d’IA est développé à l’aide de données à caractère personnel qui ont été traitées illégalement. Il prend également en compte l'utilisation de données de première et de tierce partie. L'avis a été demandé par l'autorit&e
(
2024/12/18:
)
Brussels, 18 December - The European Data Protection Board (EDPB) has adopted an opinion* on the use of personal data for the development and deployment of AI models . This opinion looks at 1) when and how AI models can be considered anonymous, 2) whether and how legitimate interest can be used as a legal basis for developing or using AI models, and 3) what happens if an AI model is developed using personal data that was processed unlawfully. It also considers the use of first and third party data. The opinion was requested by the Irish Data Protection Authority (DPA) with a view to seeking Europe-wide regulatory harmonisation. To gather input for this opinion, which deals with fast-moving technologies that have an important impact on society, the EDPB organised a stakeholders’ event and had an exchange with the EU AI Office. EDPB Chair Talus said: “AI technologies may bring many opportunities and benefits to different industries and areas of life. We need to ensure these innovations are done ethi