EDPS adopts guidance and binding rules to strengthen DPO independence across EU institutions
The European Data Protection Supervisor (EDPS) has adopted two documents aimed at strengthening the role and independence of data protection officers (DPOs) within EU institutions, bodies, offices and agencies (EUIs). On 18 December 2025, the EDPS issued Supervisory Guidance clarifying requirements relating to DPO designation, institutional positioning, independence guarantees and responsibilities within EUIs. On 16 January 2026, the EDPS adopted Decision 01/2026, establishing binding rules requiring EUIs to obtain prior EDPS consent before dismissing DPOs before the end of their term. The guidance sets out the EDPS’ interpretation of DPO roles, positions and tasks, while the decision creates a uniform procedural framework for dismissals. Both measures apply with immediate effect and must be reflected in EUIs’ internal practices and decision-making regarding the position and protection of DPOs.