The European Data Protection Board (EDPB) has adopted recommendations clarifying the legal basis for requiring user account creation on e-commerce websites. The recommendations establish that users should generally have the option to engage with e-commerce websites, including making purchases, without creating an account through either a "guest mode" or voluntary account creation option. Mandatory account creation can only be justified in limited cases, such as offering subscription services or providing access to exclusive offers. The recommendations are subject to public consultation to allow stakeholder feedback. The EDPB also conducted preliminary discussions on the Digital Omnibus proposal, on which it will issue a joint opinion with the European Data Protection Supervisor (EDPS), and appointed Jelena Virant Burnik, Information Commissioner of Slovenia, as new Deputy Chair of the Board during its 4 December 2025 plenary meeting.

The European Data Protection Board (EDPB) has adopted a report on its Coordinated Enforcement Framework action concerning the right to erasure under Article 17 Regulation (EU) 2016/679 (General Data Protection Regulation(GDPR)). The coordinated action, conducted throughout 2025, involved 32 Data Protection Authorities across Europe, with responses from 764 controllers ranging from small and medium-sized enterprises to large companies and public entities. Nine DPAs initiated or continued formal investigations, while 23 conducted fact-finding exercises. The report identifies seven recurring challenges hindering full implementation of the right to erasure, including inadequate internal procedures for handling requests, insufficient information provided to individuals, reliance on inefficient anonymisation techniques, and difficulties in determining retention periods and deletion of personal data in back-ups. The EDPB noted that some controllers face difficulties assessing conditions for exercising the right to erasure and conducting balancing tests between erasure rights and other rights and freedoms. The report includes recommendations for controllers to improve compliance. The next CEF action in 2026 will focus on transparency and information obligations under GDPR.

The European Data Protection Board (EDPB) has adopted a report on the first review of the EU-US Data Privacy Framework (DPF). In it, the EDPB welcomes the implementation efforts for the DPF but highlights the need for monitoring DPF-certified companies' compliance and providing guidance on data transfer requirements. It acknowledges the implementation of the redress mechanism but calls for monitoring its practical functioning and safeguards, such as the principles of necessity and proportionality. The EDPB recommends reviewing the EU-US adequacy decision within three years and raises concerns about potential intrusiveness on fundamental rights from certain recommendations regarding law enforcement access to data. In addition, the EDPB has published a statement on the recommendations of the high-level group on access to data for effective law enforcement, in which it stresses that it is crucial to safeguard fundamental rights when law enforcement agencies access the personal data of individuals. In addition, it notes that some of the recommendations could cause serious intrusiveness of fundamental rights such as the respect for privacy and family life.

The European Data Protection Board (EDPB) has adopted a report on the findings of its second co-ordinated enforcement action, on the designation and position of Data Protection Officers (DPOs). The report lists the obstacles currently faced by DPOs, such as lack of designation of a DPO and insufficient resources, along with a series of recommendations to further strengthen their independence and guarantee necessary resources.

The European Data Protection Board (EDPB) has adopted a common template for personal data breach notifications under Regulation (EU) 2016/679 ((the General Data Protection Regulation (GDPR)). The template is intended to help organisations and data protection authorities (DPAs) standardise breach notification processes and ensure notifications contain the information required under Article 33 GDPR. The template is open for public consultation until 5 August 2026.

The European Data Protection Board (EDPB) has adopted a statement on age assurance, outlining ten principles for the compliant processing of personal data when determining an individual's age or age range. The EDPB has stated that these principles aim to ensure a consistent European approach to age assurance, balancing the protection of minors with data protection compliance. The Board emphasises that age verification methods should be the least intrusive possible whilst safeguarding children's personal data. Additionally, the EDPB is collaborating with the European Commission on age verification within the context of the EU Digital Services Act working group.

The European Data Protection Board (EDPB) has adopted Statement 4/2024 on the amendments made by the European Parliament and the Council of the EU to the European Commission’s proposal for a regulation laying down additional procedural rules for the enforcement of the EU General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR). In the statement, the EDPB welcomes the modifications, but recommends that a legal basis and harmonised procedure is required for amicable settlements, and that consensus is reached on the summary of key issues. In addition, the EDPB urged the co-legislators to remove the provisions related to the relevant and reasoned objections and the ‘statement of reasons’ in the dispute resolution procedure, and emphasised that the introduction of a joint case file would require complex changes to the document management and communication systems used at the EU and national levels.

The European Data Protection Board (EDPB) has adopted a statement outlining that Members of the Board should work together respectfully to reconcile and reach common meaningful decisions to ensure the consistent application of the EU's General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR). While deliberations by the EDPB may involve complex issues of principle and law, the starting point may not be a unified view which is not a failure of data protection authorities nor demonstrates a lack of integrity, but rather a sign that the EU GDPR is working as intended. The EDPB states that its guidelines and recommendations on the EU GDPR reflect ‘the common position and understanding which the authorities agree to apply in a consistent way’. EDPB Members are noted to act in compliance with the duty of sincere co-operation to ensure its effective functioning.

The European Data Protection Board (EDPB) has adopted a template for Cross-Regulatory Cooperation Agreements. It is intended to provide data protection supervisory authorities (DPAs) with a flexible, non-binding basis for negotiating cooperation agreements with other competent authorities. The EDPB has opened a 12-week consultation on the template, inviting feedback from national electronic communications regulators, consumer protection bodies and competition authorities.

The European Data Protection Board (EDPB) has adopted two EU-US Data Privacy Framework (DPF) FAQs for businesses and individuals on 16 July 2024.

The European Data Protection Board (EDPB) has adopted, for public consultation, recommendations on the application for approval and on the elements and principles to be found in Processor Binding Corporate Rules (BCR-P). The recommendations update the existing BCR-P referential and merge it with the standard application form, setting out the criteria for BCR-P approval and providing criteria and explanations to ensure that BCR-P developed by groups of undertakings or enterprises are compliant with the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR). The recommendations are open to public consultation until 2 March 2026.

The European Data Protection Board (EDPB) and the European Commission are calling for expressions of interest from individuals and organisations with relevant expertise to participate in a remote stakeholder event on 15 October 2026. This event is part of their joint effort to develop forthcoming guidelines that address the interplay between data protection and competition law. Individuals and organisations with relevant expertise are invited to express interest in participating until 28 August 2026. The EDPB highlighted that this initiative reflects the cross-regulatory cooperation commitments outlined in the Helsinki Statement and the EDPB Strategy 2024–27.