Ecuador

Regulator And AuthorityGreen

The EDPS is the independent supervisory authority responsible for monitoring and enforcing EUDPR compliance across ~80 EU institutions, bodies, offices and agencies; Wojciech Wiewiórowski holds the post.

Claims (1):

• The European Data Protection Supervisor (EDPS) is the independent supervisory authority responsible for monitoring the processing of personal data by EU institutions and bodies, advising on policies/legislation affecting privacy, and cooperating with other supervisory authorities.

Act And InstrumentsGreen

Core instrument is Regulation (EU) 2018/1725, supplemented by Commission Decision (EU) 2020/969 (DPO/restrictions implementing rules) and the EDPS Rules of Procedure.

Claims (1):

• Regulation (EU) 2018/1725 lays down the data protection obligations for the EU institutions and bodies when they process personal data and repeals Regulation (EC) 45/2001, adopting a principle-based approach in line with the GDPR.

Material ScopeGreen

EUDPR governs processing of personal data by Union institutions and bodies, including administrative processing by Europol/EPPO for staff matters; operational law-enforcement data of Europol/EPPO is carved out to their own founding legal acts, and a specific EUDPR chapter aligned with the Law Enforcement Directive applies to EU bodies processing operational data (e.g. Eurojust).

Claims (1):

• The processing of operational personal data by Europol and the European Public Prosecutor's Office is excluded from the scope of the EUDPR and instead governed by specific provisions in their founding legal acts, though their administrative processing of personal data (e.g. staff management) is subject to the Regulation.

Territorial ScopeAmber

EUDPR has no GDPR-style extraterritorial reach over non-EU private controllers; it applies to Union institutions and bodies as controllers regardless of where their processing physically occurs. This is a structurally different scope concept than GDPR Art 3, and should not be conflated with it.

Regulator Registration And FilingGreen

Each EUI must designate a DPO who is registered with the EDPS after designation; EUIs must also maintain a Record of Processing Activities (ROPA) under Art 31, made publicly accessible via a central register where feasible.

Claims (1):

• After designation, the data protection officer of a Union institution or body shall be registered with the European Data Protection Supervisor by the institution or body which designated him or her.

Lawful BasesGreen

Art 5 EUDPR sets the enumerated lawful bases for EUI processing (consent, contract, legal obligation, vital interests, public-interest task/official authority) as the EUI-context analogue of GDPR Art 6.

Claims (1):

• Article 5 of Regulation (EU) 2018/1725 sets out the lawfulness-of-processing principle governing which legal bases a Union institution or body may rely upon, mirroring the structure of GDPR Article 6.

Consent ThresholdsGreen

Art 7 requires consent to be freely given, specific, informed and unambiguous, demonstrable by the controller, and withdrawable as easily as it was given.

Claims (1):

• Where processing is based on consent, the controller must be able to demonstrate that the data subject consented, and withdrawal of consent must be as easy as giving it, without affecting the lawfulness of prior processing.

Special CategoriesGreen

Art 10 restricts processing of special-category data (ethnic/racial origin, political opinions, religious/philosophical beliefs, trade-union membership, genetic data, biometric data for unique identification, health data, sex life/orientation), with Art 11 governing criminal-conviction data.

Claims (1):

• Article 10 of the EUDPR restricts processing of data revealing racial/ethnic origin, political opinions, religious/philosophical beliefs, trade-union membership, genetic data, biometric data for unique identification, health data, or data on sex life/sexual orientation, subject to enumerated exceptions.

Pseudonymisation And AnonymisationGreen

The EDPB, sitting alongside the EDPS's own guidance function, adopted guidelines on anonymisation in July 2026 clarifying the notion of anonymous data in light of CJEU case-law directly involving an EUI (EDPS v SRB), of direct relevance to EUI compliance practice.

Claims (1):

• On 8 July 2026, the EDPB adopted guidelines on anonymisation and on web scraping in the context of generative AI, bringing clarity to the notion of anonymous data, taking into account the CJEU ruling in Case C-413/23 P EDPS v SRB of 4 September 2025.

Access RightGreen

Art 17 grants the right of access, exercisable without unnecessary constraints, free of charge; the EDPS ran a Coordinated Enforcement Action reviewing EUI right-of-access practice in 2024.

Claims (1):

• The right of access under EUDPR allows a data subject to obtain confirmation that data concerning him or her are processed, the purposes of processing, and the logic involved in automated decisions, exercisable without unnecessary constraints, at any time, free of charge.

Rectification And ErasureGreen

Art 18 grants rectification of inaccurate data; Art 19 grants erasure ('right to be forgotten') on enumerated grounds; the EDPS ran a Coordinated Enforcement Action on the right to erasure in 2025.

Claims (2):

• The data subject has the right to obtain from the controller rectification of inaccurate personal data without undue delay, including completion of incomplete data by supplementary statement.
• The right to erasure is enshrined in Article 19 of the EUDPR for EUIs, with similarities to Article 17 GDPR for EU/EEA countries; the EDPS conducted a fourth Coordinated Enforcement Action fact-finding exercise on EUI compliance with the right to erasure in 2025.

Restriction And ObjectionGreen

Art 20 grants restriction of processing; Art 23 grants the right to object on grounds relating to the data subject's particular situation; both may be restricted under the Art 25 internal-rules mechanism.

Claims (1):

• The EDPS may order the rectification or erasure of personal data or restriction of processing pursuant to Articles 18, 19 and 20 of the EUDPR, and notify such actions to recipients to whom the data have been disclosed.

Data PortabilityGreen

Art 22 grants the right to receive personal data in a structured, machine-readable format and to transmit it to another controller.

Claims (1):

• Under Article 22, the data subject has the right to receive personal data concerning him or her in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance.

Deadlines And Response WindowsGreen

Controllers must respond to data-subject requests without undue delay and in any event within one month of receipt, extendable by two further months where necessary, with reasons communicated to the data subject.

Claims (1):

• The data controller must respond to a data subject's request for access to their personal data without undue delay and in any event within one month from receipt, which may be extended by two further months where necessary.

Accountability And DpiaGreen

Art 39(1) requires a DPIA where processing is likely to result in a high risk to rights and freedoms; the EDPS has adopted binding, non-exhaustive DPIA-trigger lists under Art 39(4)/(5).

Claims (1):

• Article 39(1) of Regulation (EU) 2018/1725 requires a DPIA when the processing activity is likely to result in a high risk to the rights and freedoms of natural persons, with Article 39(3) providing a non-exhaustive illustrative list.

Dpo RequirementsGreen

DPO designation is compulsory for every EUI; the DPO may only be dismissed with the EDPS's prior consent, with detailed procedural Rules adopted by EDPS Decision 01/2026 (16 January 2026), entering into force early 2026.

Claims (2):

• EU institutions, bodies, offices and agencies are required to designate a Data Protection Officer, and the Regulation establishes that a DPO may not be dismissed or penalised by the controller for performing their tasks without the EDPS's prior consent.
• EDPS Decision 01/2026 of 16 January 2026 establishes detailed procedural rules on the requirement of prior EDPS consent for the dismissal of DPOs, requiring EUIs to submit a complete dismissal request with supporting documentation before any intended dismissal.

Ropa RequirementsGreen

Art 31 requires each controller to maintain a record of processing activities, in writing (including electronic form), centrally registered and made publicly accessible unless disproportionate given EUI size.

Claims (1):

• Each controller shall maintain a record of processing activities under its responsibility in writing, including electronic form, and Union institutions and bodies shall keep their records in a central, publicly accessible register unless inappropriate given their size.

Joint Controller ArrangementsGreen

Art 28 governs joint-controller arrangements between Union institutions/bodies; infringement of Art 28 is expressly fineable under Art 66.

Claims (1):

• Article 28 (joint controllers) of the EUDPR is among the provisions for which infringement can be sanctioned with an administrative fine under Article 66.

Security MeasuresGreen

Art 33 requires appropriate technical and organisational security-of-processing measures; infringement is expressly fineable under Art 66(2)/(3).

Claims (1):

• Article 33 (security of processing) is expressly listed among the infringements for which fining is set out under Article 66 of the EUDPR.

Breach NotificationGreen

EUIs must notify the EDPS of a personal-data breach presenting a risk to rights and freedoms within 72 hours of becoming aware, where feasible, and notify affected individuals without undue delay where the breach is likely to result in high risk; a dedicated encrypted-notification web form is maintained.

Claims (1):

• The EUDPR introduces a duty on all EU institutions and bodies to report certain types of personal-data breach to the EDPS within 72 hours of becoming aware of the breach, where feasible, and to inform affected individuals without undue delay if the breach is likely to result in high risk.

Retention And DisposalGreen

EUDPR's storage-limitation principle requires that personal data be kept in identifiable form no longer than necessary for the purposes for which it is processed.

Claims (1):

• Personal data processed under the EUDPR must be kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which the data are processed.

Transfer MechanismsGreen

In the absence of a GDPR/LED adequacy decision or Art 48 safeguards, an EUI transfer to a third country/international organisation may only occur on enumerated conditions; Art 49 additionally provides that third-country judicial/administrative orders demanding disclosure are enforceable only if based on an international agreement (e.g. MLAT).

Claims (1):

• Any judgment of a court or tribunal, or decision of an administrative authority, of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union.

Adequacy ReceivedRed

EUDPR does not itself operate an 'adequacy received' concept analogous to a Member State's inbound recognition; EUIs instead rely on the same GDPR/LED adequacy-decision architecture as Member States.

Adequacy GrantedAmber

Adequacy decisions relevant to EUI transfers are granted under GDPR Art 45(3)/LED Art 36(3), not under EUDPR itself; EUDPR Art 47 simply cross-references those decisions for EUI use.

Claims (1):

• In the absence of an adequacy decision pursuant to Article 45(3) of the GDPR or Article 36(3) of the Law Enforcement Directive, or of appropriate Article 48 safeguards, an EUI transfer to a third country or international organisation may take place only under enumerated conditions.

Sccs And BcrsGreen

Art 48 allows the Commission or the EDPS to lay down standard contractual clauses for EUI transfers, including clauses that may build on certifications granted under GDPR Art 42; pre-GDPR-era SCCs/BCRs must be adapted to EUDPR requirements before continued use.

Claims (1):

• The European Data Protection Supervisor may adopt standard contractual clauses for EUI international-transfer purposes, and pre-existing SCCs/BCRs adopted under the old Directive 95/46 remain valid but must be adapted to Regulation (EU) 2018/1725 before continued use.

Transfer Impact AssessmentAmber

No standalone EUDPR provision names a formal 'transfer impact assessment' step distinct from the Art 46-48 safeguards analysis; EDPS opinion practice (e.g. its September 2025 Opinion on an EU-US framework agreement for security-screening data exchange) functions as the practical equivalent for high-profile international agreements.

Claims (1):

• On 17 September 2025, the EDPS issued an Opinion on the negotiating mandate for a framework agreement between the EU and the United States on the exchange of information for security screenings and identity verifications, functioning as a de facto transfer-risk assessment for a major international data-sharing instrument.

Data LocalisationGreen

EUDPR imposes no blanket data-localisation mandate; instead it relies on the Art 46-50 transfer-safeguard cascade and the Art 49 restriction on recognising third-country compulsion orders absent an international agreement.

Claims (1):

• Transmissions of personal data to recipients established in the Union other than Union institutions and bodies are subject to additional safeguard conditions under the EUDPR, distinct from the stricter third-country transfer regime of Articles 46-50.

Financial Sector OverlayGreen

EU financial-supervision agencies such as ESMA and EIOPA, as EUIs, have each adopted EDPS-consulted internal-rules decisions under Art 25 restricting certain data-subject rights (e.g. right of access, rectification, erasure) in the context of supervisory investigations/inquiries.

Claims (1):

• ESMA, following Article 25 of Regulation (EU) 2018/1725 and after an EDPS opinion, adopted internal rules permitting it to restrict data-subject rights of access, rectification, erasure and restriction of processing in the context of its investigations or inquiries.

Health Sector OverlayGreen

EDPS Decision 46/2026 authorised a Model Administrative Arrangement for transfers of personal data from the European Medicines Agency (EMA) to the Council of Europe's Directorate for the Quality of Medicines & HealthCare for a sampling/testing cooperation programme.

Claims (1):

• EDPS Decision 46/2026 authorises the use of an administrative arrangement based on the EDPS Model Administrative Arrangement for transfers of personal data from the European Medicines Agency to the Council of Europe's EDQM, pursuant to Article 48(3)(b) of the EUDPR, in the context of a medicines sampling and testing cooperation.

Telecoms And EprivacyAmber

EUDPR Art 36 (confidentiality of communications) sits alongside the ePrivacy Directive 2002/58/EC, which the EDPS notes 'is due to be repealed'; the pending Digital Omnibus proposal would further amend the ePrivacy Directive alongside the GDPR and EUDPR.

Claims (1):

• The ePrivacy Directive 2002/58/EC provides additional data-protection rules for telecommunications networks and internet services alongside the EUDPR, and is due to be repealed/amended as part of the Digital Omnibus proposal.

Employment DataAmber

EDPS supervisory activity covers EUI staff-management processing, including a reprimand of EPSO (EU Personnel Selection Office) over remote-testing practices, and active monitoring of AI use in recruitment/HR processes across EUIs.

Claims (1):

• The EDPS's February 2025 Newsletter reports an EDPS reprimand issued to EPSO (the EU Personnel Selection Office) concerning its data-processing practices, alongside continued monitoring of AI use in EUI recruitment.

Credit And ScoringRed

No distinct EUI credit-scoring sub-regime was identified; EUIs are not consumer-credit actors in the way private financial institutions are.

Absence provenance: unavailable. Searched: EDPS credit scoring EU institutions, EUDPR credit reporting sectoral rules.

EducationRed

No distinct statutory EUI education-sector sub-regime was identified beyond general EUDPR principles; EDPS public engagement on AI-in-education is awareness-raising rather than a binding sectoral overlay.

Absence provenance: unavailable. Searched: EDPS education sector data protection EUI, EUDPR school data processing.

InsuranceGreen

EIOPA, as an EUI insurance/pensions supervisory agency, operates under an EDPS-consulted Art 25 internal-rules decision restricting data-subject rights in the context of its supervisory investigations.

Claims (1):

• EIOPA adopted a Decision, following Article 25 of Regulation (EU) 2018/1725 and after consulting the EDPS, laying down rules restricting data-subject rights (access, rectification, erasure, restriction) in the framework of its supervisory procedures.

Cookies And TrackersAmber

EUI web services are subject to the ePrivacy Directive alongside EUDPR; the Digital Omnibus proposal targets ePrivacy amendments addressing cookie-banner consent fatigue.

Claims (1):

• The ePrivacy Directive 2002/58/EC provides additional data-protection rules for telecommunications networks and internet services and is targeted for amendment by the Digital Omnibus proposal alongside the GDPR and EUDPR.

Dark PatternsRed

No EUI-specific dark-pattern prohibition distinct from general GDPR/DSA-level discourse was identified for the EC/EUDPR context.

Absence provenance: unavailable. Searched: EDPS dark patterns EUI, EUDPR deceptive design prohibition.

Opt Out SignalsAmber

The Digital Omnibus proposal introduces requirements on automated, machine-readable indications of individuals' choices regarding data processing, which the EDPB/EDPS jointly support as a solution to consent fatigue.

Claims (1):

• The EDPB and the EDPS strongly support the Digital Omnibus's objective of addressing consent fatigue and cookie-banner proliferation via automated, machine-readable indications of individuals' processing choices.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room regime specific to EUIs was identified.

Absence provenance: unavailable. Searched: EDPS clean room data collaboration EUI.

Cross Context AdvertisingAmber

EDPS newsletter reporting references an EDPS review of whether the European Commission organised a micro-targeting campaign on a social-media platform (X), indicating active EDPS scrutiny of EUI targeted-communication practices.

Claims (1):

• EDPS newsletter reporting flags scrutiny of whether the European Commission organised a micro-targeting campaign on the social-media platform X, indicating active EDPS review of EUI targeted-communications practices.

Direct MarketingRed

EUIs, as public bodies, are not typically direct-marketing actors; no dedicated EUDPR direct-marketing consent/suppression regime was identified.

Absence provenance: unavailable. Searched: EUDPR direct marketing consent EUI.

Profiling RestrictionsGreen

Art 24 restricts automated individual decision-making including profiling, and decisions may not be based on special-category data save under narrow exceptions with safeguards.

Claims (1):

• Automated individual decisions under Article 24 of the EUDPR shall not be based on special categories of personal data referred to in Article 10(1), unless narrow exceptions apply with suitable safeguards for the data subject's rights, freedoms and legitimate interests.

Automated Decision Making TransparencyGreen

The right of access under Art 17 extends to information on the logic involved in any automated decision-making process concerning the data subject.

Claims (1):

• The right of access allows a data subject to obtain from the controller confirmation of processing, the purposes, and the logic involved in any automated decision process concerning him or her.

Ai Risk AssessmentsGreen

The EDPS published its 'Compass' for its AI Act role (17 March 2026), identifying over 100 AI systems deployed or under development across EUIs and setting four strategic supervisory pillars for 2026-2027.

Claims (1):

• The EDPS's mapping exercise for its AI Act role identified more than one hundred AI systems currently deployed or under development across EUIs, with the highest concentration of high-risk use cases in the Area of Freedom, Security and Justice and in employment/recruitment.

Biometric RegimeGreen

Article 43(1) of the AI Act designates the EDPS as the notified body for conformity assessment of high-risk AI systems of EUIs in the areas of remote biometric identification, biometric categorisation, and emotion recognition.

Claims (1):

• Article 43(1) of the AI Act designates the EDPS as a notified body in charge of conformity assessment for high-risk AI systems of EUIs in the areas of remote biometric identification, biometric categorisation and emotion recognition under Annex III(1) of the AI Act.

Genetic DataGreen

Genetic data is enumerated among the EUDPR special categories under Art 10, subject to the same restrictive processing conditions as other sensitive categories.

Claims (1):

• Genetic data is enumerated as a special category of personal data under Article 10 of the EUDPR, subject to restrictive processing conditions.

State Surveillance CarveoutsAmber

Art 25 permits EUIs to restrict data-subject rights (Arts 14-22, 35-36) where necessary and proportionate to safeguard enumerated public-interest objectives (including security and defence), subject to publication of the restricting legal act/internal rule in the Official Journal and EDPS consultation.

Claims (1):

• Legal acts adopted on the basis of the Treaties, or internal rules on the operation of Union institutions and bodies, may restrict Articles 14-22, 35-36 EUDPR where the restriction respects the essence of fundamental rights and is a necessary and proportionate measure in a democratic society, and such restrictions must be clear, precise, published in the Official Journal, and adopted at the highest management level.

Age VerificationGreen

Where consent is the legal basis, EUDPR Art 8(1) deems processing of a child's data lawful where the child is at least 13 years old in the context of an offer of information-society services directly to the child.

Claims (1):

• Where point (d) of Article 5(1) of the EUDPR applies, in relation to the offer of information society services directly to a child, the processing of a child's personal data is lawful where the child is at least 13 years old.

Parental ConsentGreen

Below age 13, EUDPR Art 8 requires the holder of parental responsibility to give or authorise consent, and the controller must make reasonable efforts to verify this, taking available technology into account.

Claims (1):

• Where a child is below the age of 13, EUDPR processing of the child's information-society-service data is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility, and the controller must make reasonable efforts to verify this, taking into consideration available technology.

Minor Profiling BansAmber

No EUDPR provision creates a categorical profiling ban specific to minors beyond the general Art 24(4) restriction on special-category-based automated decisions; the EDPS has engaged in public conferences on children's digital rights (e.g. its 'From Cradle to Cloud' event) but this is soft-law engagement, not a binding minor-specific profiling prohibition.

Claims (1):

• On 4 July 2025, the EDPS and EDPB Trainees organised the 'From Cradle to Cloud: Surveillance and Digitalisation around Childhood' conference to foster discussion on the digital rights of children and minors, reflecting active but non-binding EDPS engagement on minors' data protection.

Education SettingsRed

No dedicated EUI education-settings sub-regime under EUDPR was identified.

Absence provenance: unavailable. Searched: EDPS education settings children EUI data protection, EUDPR school-specific provisions.

Dependent AdultsRed

No dedicated EUDPR provision addressing dependent/vulnerable adults distinct from general data-subject rights was identified.

Absence provenance: unavailable. Searched: EDPS dependent adults vulnerable persons EUDPR, EUDPR incapacitated data subject provisions.

Regulator Powers And PenaltiesGreen

Art 58 confers the EDPS a wide range of investigative, corrective (including data-flow-suspension), and authorisation/advisory powers; Art 66 allows the EDPS to impose administrative fines on a Union institution or body for non-compliance with specified EDPS orders, with the CJEU holding unlimited jurisdiction to cancel, reduce or increase such fines.

Claims (2):

• Article 58 of Regulation (EU) 2018/1725 confers the EDPS a wide range of investigative powers including risk-based compliance audits, and corrective powers including ordering rectification/erasure/restriction, imposing administrative fines under Article 66 for non-compliance with EDPS orders, and ordering suspension of data flows to a recipient in a Member State, third country, or international organisation.
• The Court of Justice of the European Union has unlimited jurisdiction to review administrative fines imposed by the EDPS under Article 66, and may cancel, reduce or increase those fines within the limits of that Article.

Enforcement Activity IndexGreen

Following EDPS enforcement proceedings and a March 2024 Decision identifying infringements and imposing corrective measures, the European Commission demonstrated compliance with the EUDPR regarding its use of Microsoft 365 by December 2024; the EDPS separately reprimanded Frontex in January 2025 for unlawful data-sharing with Europol, and reprimanded EPSO over remote-testing practices.

Claims (2):

• Following enforcement proceedings by the EDPS, the European Commission demonstrated compliance with Regulation (EU) 2018/1725 in relation to its use of Microsoft 365, following the EDPS's Decision of 8 March 2024 which had identified infringements and imposed corrective measures, with compliance confirmed by 9 December 2024.
• On 8 January 2025, the EDPS issued a reprimand to Frontex for infringing Regulation (EU) 2019/1896 by systematically sharing personal data of suspects of cross-border crime with Europol without assessing whether such sharing was strictly necessary, following an EDPS audit opened in October 2022.

Regulator Funding And CapacityGreen

The Union budgetary authority is required to ensure the EDPS is provided with the human and financial resources necessary for the performance of its tasks, with a separate budgetary heading; the EDPS also established a dedicated AI Unit in October 2024 to operationalise its expanded AI Act mandate.

Claims (1):

• The budgetary authority shall ensure that the EDPS is provided with the human and financial resources necessary for the performance of its tasks, with the EDPS budget shown in a separate budgetary heading of the Union's general budget.

Collective Redress And Class ActionsAmber

The EUDPR permits a data subject to mandate a not-for-profit organisation to lodge a complaint with the EDPS on their behalf, functioning as a limited representative-action mechanism.

Claims (1):

• The EUDPR permits a data subject to mandate a not-for-profit organisation to lodge a complaint with the EDPS on the data subject's behalf.

Private Right Of ActionGreen

Any person who has suffered material or non-material damage as a result of an EUDPR infringement has the right to receive compensation from the responsible Union institution or body, subject to Treaty conditions, alongside the right to a judicial remedy before the CJEU.

Claims (1):

• Any person who has suffered material or non-material damage as a result of an infringement of the EUDPR has the right to receive compensation from the responsible Union institution or body, subject to the conditions provided for in the Treaties.

Recent Developments 180DAmber

Within the last 180 days: the EDPB/EDPS adopted Joint Opinion 2/2026 on the Digital Omnibus Regulation proposal (Feb 2026) and a Joint Opinion on the 'Digital Omnibus on AI' (Jan 2026); the EDPS published its AI Act 'Compass' for 2026-2027 (17 March 2026); the EDPB launched its 2026 Coordinated Enforcement Framework action on transparency/information obligations (19 March 2026); the EDPS/BfDI/BayLfD held a high-level Digital Omnibus debate (8 June 2026); the EDPB adopted anonymisation and generative-AI web-scraping guidelines (8 July 2026); and the EDPB, meeting in Dublin, called for a clearer legal basis for cross-regulatory information sharing among regulators (16-17 July 2026).

Claims (3):

• The EDPB and EDPS adopted a Joint Opinion on the Digital Omnibus Regulation proposal, which amends Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and several directives, following the Commission's formal consultation under Article 42(2) EUDPR on 25 November 2025.
• The EDPB launched its 2026 Coordinated Enforcement Framework action on 19 March 2026, shifting focus from the 2025 right-to-erasure action to compliance with transparency and information obligations under Articles 12-14 GDPR, with 25 DPAs participating during 2026.
• At a high-level meeting in Dublin on 16-17 July 2026, the EDPB called for a clear legal basis for the sharing of information among regulators with different competences, and discussed expanding cooperation to support consistent GDPR application.