The European Data Protection Board (EDPB) has launched a public consultation on Guidelines 1/2026 on processing of personal data for scientific research purposes, covering health, controller and processor roles, legal basis, consent and data subject rights. The guidelines aim to clarify how the Regulation (EU) 2016/679 (EU General Data Protection Regulation (EU GDPR)) applies to scientific research, including the concept of scientific research, presumption of compatibility, storage limitation, applicable legal bases, processing of special categories of personal data, transparency obligations, data subject rights, attribution of responsibility and appropriate safeguards. The consultation closes on 25 June 2026.

The European Data Protection Board (EDPB) has announced the creation of a task force on AI enforcement, expanding the scope of its existing ChatGPT task force. The EDPB has emphasised the need to coordinate Data Protection Authorities' (DPA) actions on urgent sensitive matters, leading to the establishment of a quick response team. This initiative aims to support DPAs in navigating the complexities of AI whilst maintaining robust data protection standards. The EDPB Chair, Anu Talus, stressed the importance of balancing responsible innovation with high data protection standards under the GDPR framework.

MLex: The European Data Protection Board (EDPB) has the power to direct national regulators to open new investigations, the EU’s General Court ruled today, reinforcing the board’s role in enforcing the EU's General Data Protection Regulation. The decision comes after Ireland’s Data Protection Commission (DPC) challenged the EDPB’s authority, arguing that it had overstepped by mandating further probes into Meta’s data practices. The case originated from privacy complaints against Meta in 2018, with regulators across the EU disputing Ireland’s decision to allow the company to justify targeted ads under its terms of service.

The European Data Protection Board (EDPB) has issued its Opinion on the use of facial recognition technology for the biometrics-enabled authentication or identification of passengers by airport operators and airline companies to enhance airport passengers’ flow in accordance with Articles 5(1)(e) and(f), 25 and 32 of Regulation (EU) 2016/679, the EU’s General Data Protection Regulation (EU GDPR), following a request from the French Supervisory Authority. The EDPB assessed the compliance of processing biometric data with Articles 5(1)(e) and (f), 25 and 32 of the EU GDPR using four specific scenarios and highlighted minimum safeguards which should be implemented as a solution to each of the four specific scenarios, among other things.

The European Data Protection Board (EDPB) has adopted a position paper addressing the intersection of data protection and competition law. The EDPB emphasises that cooperation between data protection and competition authorities is mandatory in some cases, as per the CJEU judgment in Case C-252/21. The Board recommends closer cooperation between regulatory authorities in the digital sector and suggests internal measures to facilitate this, such as dedicated teams. The paper highlights the need for a better understanding of the relationship between data protection and competition law concepts, aiming to protect individuals and their decision-making in both areas.

The European Data Protection Board (EDPB) has adopted Guidelines 1/2024 on the processing of personal data based on Article 6(1)(f) of the EU General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR). These Guidelines analyse the three cumulative criteria laid down in Article 6(1)(f) of the EU GDPR that controllers must meet, namely the pursuit of a legitimate interest by the controller or by a third party, the necessity to process personal data for the purposes of  pursuing the legitimate interest, and ensuring the interests or fundamental freedoms and rights of individuals do not take precedence over the legitimate interests of the controller or of a third party. They also explain how this assessment should be carried out in practice, including in a number of specific contexts like fraud prevention, direct marketing and information security. The EDPB document also considers the relationship between this legal basis and other data subject rights under the EU GDPR. Guidelines 1/2024 are subject to a public consultation until 20 November 2024.

The European Data Protection Board (EDPB) has adopted guidelines addressing personal data processing through blockchain technologies. The guidelines outline requirements for privacy-by-design implementation, emphasise the need for Data Protection Impact Assessments for high-risk processing, and advise against storing personal data in blockchains when conflicting with data protection principles. The EDPB also announced its intention to cooperate with the AI Office on developing guidelines on the interplay between the EU AI Act and data protection law. The public consultation on the blockchain guidelines runs until 9 June 2025.

The European Data Protection Board (EDPB) has adopted an opinion on the use of personal data in AI model development and deployment. The opinion provides guidance on determining AI model anonymity, assessing legitimate interest as a legal basis for processing, and addressing the implications of using unlawfully processed data. The EDPB aims to support responsible AI innovation while ensuring compliance with the Regulation (EU) 2016/679 – known as EU's General Data Protection Regulation (GDPR). The opinion offers a framework for case-by-case analysis, considering the rapid evolution and diversity of AI models, and includes criteria for evaluating reasonable expectations of data use and potential mitigating measures.

The European Data Protection Board (EDPB) has launched its Coordinated Enforcement Framework for 2026, focusing on compliance with transparency and information obligations under the EU General Data Protection Regulation (GDPR). National data protection authorities (DPAs) will assess how controllers comply with transparency obligations set out in Articles 12–14 of the GDPR, which are intended to ensure individuals are informed about how their personal data is processed. Participating authorities will engage with controllers across different sectors through enforcement actions or fact-finding exercises, with follow-up actions where necessary. In H2 2026, DPAs will share their findings and produce a consolidated report for adoption by the EDPB.

The European Data Protection Board (EDPB) has launched a public consultation seeking input on which ready-to-use templates would be most useful for organisations to facilitate Regulation (EU) 2016/679 (The General Data Protection Regulation (GDPR)) compliance. The consultation, running from 5 November 2025 to 3 December 2025, follows the EDPB's Helsinki Statement on enhanced clarity, support and engagement. The EDPB will create templates for data protection impact assessments and data breach notifications, and is seeking stakeholder views on additional templates that would assist organisations, with examples including privacy notices and records of processing activities. Contributions are limited to 2,500 characters and can be submitted via the EU Survey platform, with responses to be published on the EDPB website following screening by the EDPB Secretariat.

The European Data Protection Board (EDPB) has opened a public consultation on its draft Guidelines 3/2025, which address how the EU Digital Services Act (EU DSA) and Regulation (EU) 2016/679 (General Data Protection Regulation (GDPR)) should be applied consistently where provisions overlap. The draft explains lawful bases for processing personal data when detecting or removing illegal content, clarifies transparency duties for recommender systems and advertising, and underscores the prohibition on targeted ads using special categories of data. It also highlights the importance of cooperation between Digital Services Coordinators and data protection authorities to prevent regulatory inconsistencies. The consultation runs until 31 October 2025.

The European Data Protection Board (EDPB) has launched the AI Auditing and Standardised Messenger Audit projects to ensure compliance with Regulation 2016/679, the EU General Data Protection Regulation (EU GDPR). The AI Auditing project aims to develop pilot tools which evaluate AI systems’ compliance with the EU GDPR. The Standardised Messenger Audit further aims to explore the compliance of businesses’ messenger services with the EU GDPR. This project includes frontend requirements and audit methodology as deliverables and provides a catalogue of mandatory, recommended and optional requirements for a GDPR-compliant messenger.