The European Data Protection Board helps authorities apply EU data protection law consistently. It publishes guidance, gives opinions and adopts binding decisions in specified circumstances. For an organisation, the practical question is which kind of document it is reading, who must act on it and how the reasoning relates to its own processing.
The EDPB is an independent EU body established by Article 68 of the GDPR. It is not the ordinary destination for a complaint against a business, and its publications do not all have the same legal effect. This guide explains the institutional structure, the enforcement process and a method for turning relevant EDPB material into documented operational decisions.
What the Board does and who participates
The Board brings together the heads of EU national supervisory authorities, or their representatives, and the European Data Protection Supervisor. Where a Member State has several authorities, national law determines a common representative. Its work supports consistent application of the GDPR and the Law Enforcement Directive, including cooperation on enforcement.
The authorities of Iceland, Liechtenstein and Norway participate as members for GDPR matters through the EEA arrangements, without voting rights or eligibility for election as Chair or Deputy Chair. The European Commission participates without a vote; the EFTA Surveillance Authority also participates without voting rights in GDPR matters. Consequently, a simple count of countries does not describe the voting rules accurately. The Board’s membership explanation sets out these distinctions.
As checked on 28 September 2026, the EDPB’s institutional page identifies Anu Talus as Chair and Jelena Virant Burnik and Zdravko Vukić as Deputy Chairs. The GDPR provides five-year terms, renewable once. The Chair represents the Board and organises its work; that role does not turn the Chair into a separate appellate regulator for individual complaints.
Expert subgroups prepare work for the Board. Its Secretariat supplies analytical, administrative and logistical support. The EDPS provides the Secretariat, but Article 75 requires its staff to operate under the Board Chair’s instructions for these tasks, with a separate reporting line from staff performing the EDPS’s own supervisory work. This matters when distinguishing institutional support from authority over a particular case.
EDPB, EDPS and national authorities have different roles
A national supervisory authority investigates and enforces the law within its competence. It may handle complaints, conduct inquiries and use corrective powers. The supervisory authority under the GDPR is therefore the starting point for determining where an organisation must report or where an individual may complain.
The EDPS supervises personal-data processing by EU institutions and bodies under the applicable EU institutional framework. It also advises on relevant policy and legislation. Its membership of the EDPB does not make the Board responsible for all EDPS investigations, or make the EDPS the general regulator of private companies throughout Europe.
The EDPB brings authorities together and performs the tasks assigned to it by EU law. It does not issue a general certificate approving a company’s GDPR programme. An organisation should therefore distinguish correspondence with its competent authority, participation in an EDPB consultation and reliance on published guidance. Each serves a different purpose and creates a different record.
For individuals, a complaint about processing ordinarily goes to a competent national authority, particularly in the Member State of habitual residence, workplace or the alleged infringement. A data subject access request, by contrast, goes to the controller. Sending that request to the Board does not substitute for contacting the organisation that holds the information.
Guidelines explain the law but do not amend it
EDPB guidelines, recommendations and best practices explain how the Board understands and applies data protection rules. They are important interpretive material for organisations and authorities, but they are not legislation. Courts retain their judicial role, and a guideline cannot override the GDPR or a controlling judgment.
The official guidance register should be the starting point for research. A search result, conference slide or law-firm summary may refer to an earlier version. Open the document itself and check its number, title, adoption date, version and status. A text adopted for public consultation is not the same as a final text adopted after that consultation.
For example, the Guidelines 07/2020 on controller and processor concepts are identified as a final version. Their practical value lies in analysing who determines purposes and essential means, and how the actual relationship operates. Adding the word “processor” to a contract does not settle the role if the underlying facts point elsewhere.
Guidance is most useful when its criteria are applied rather than merely cited. A procurement file can identify the decisions reserved to the customer, the supplier’s operational discretion and any separate purposes pursued by the supplier. The analysis then supports the appropriate arrangement under GDPR Article 28, or another applicable relationship, instead of assuming that all service providers are processors.
Reliance on a guideline does not provide immunity from challenge. The facts may differ, the organisation may have implemented the recommendation incompletely, or later case law may alter the interpretation. A reasoned position records those limits and explains why the chosen approach is appropriate for the specific processing.
Opinions are more than casual advice
Article 64 opinions form part of the consistency mechanism. Some concern proposed national measures, such as lists of processing requiring a DPIA, certification criteria, codes of conduct or certain transfer instruments. Article 64 also permits requests on matters of general application or producing effects in more than one Member State.
An opinion is different from a binding decision under Article 65. Nevertheless, describing every opinion as advice an authority can simply ignore misses the procedural consequences. The authority concerned must take utmost account of an applicable opinion and communicate whether it will maintain or amend its draft within the specified process. A failure to follow the opinion can lead to an Article 65 binding decision.
For an organisation, the immediate task is to identify what the opinion addresses. An opinion on a particular certification mechanism does not certify every participant’s service. An opinion dealing with a general technology question may contain principles useful elsewhere, but its factual assumptions and statutory basis still matter.
The adoption of an opinion also does not automatically create a new statutory deadline for all controllers. Before assigning implementation work, distinguish an existing legal duty clarified by the opinion, a condition attached to a specific mechanism and a recommendation that the organisation chooses to follow as a risk-management measure.
How cross-border cooperation works
Under Article 60, a lead supervisory authority cooperates with other concerned authorities in relevant cross-border cases. The lead role depends on the GDPR’s competence rules, including the establishment arrangements. An organisation cannot select its lead authority merely by choosing where to send correspondence or where a convenient group company is registered.
The lead authority shares relevant information and a draft decision. Concerned authorities can raise relevant and reasoned objections. The process seeks consensus: the lead authority may revise its draft to address an objection, and many cases conclude through this cooperation without an EDPB dispute-resolution decision.
Article 65 becomes relevant where specified disagreements remain, including disputes about objections to a draft decision or which authority is competent for the main establishment. It also covers certain failures to request or follow Article 64 opinions. The Board’s role is therefore broader than increasing proposed fines, and narrower than rehearing every aspect of every national case.
A business responding to an inquiry should preserve the factual material that affects this process. The locations of decision-making, the processing concerned and the roles of group companies can matter as much as the text of a privacy notice. Consistent explanations across authorities reduce the risk of contradictions in the record.
What an Article 65 decision binds
An Article 65 decision is addressed to the lead and concerned supervisory authorities and binds them on the matters resolved. The relevant national authority then adopts its final decision on that basis, without undue delay and at the latest one month after notification of the Board’s decision. That national decision may contain orders or a fine directed at the controller or processor.
The voting rules are not a single permanent two-thirds threshold. Article 65 first provides for a two-thirds majority within one month, extendable by another month because of complexity. If no decision is adopted within those periods, a further two-week stage uses a simple majority, with the Chair deciding in the event of a tie. Other EDPB procedures have their own rules.
For a reader of an enforcement announcement, the distinction between stages is essential. The Board may resolve a legal disagreement before the national authority issues and publishes its final decision. A later court judgment is another event. Dates, amounts and procedural outcomes should be attributed to the relevant document rather than compressed into a single claim that “the EDPB fined” the company.
The GDPR text, especially Articles 60 and 63–76, supplies the legal framework. It also limits the EDPS’s voting right in Article 65 cases to decisions concerning principles and rules applicable to EU institutions that correspond in substance to the GDPR rules at issue.
The WhatsApp example and the 2026 judicial clarification
The Board adopted Binding Decision 1/2021 concerning WhatsApp on 28 July 2021. It resolved disagreements arising from the Irish authority’s proposed decision. The example shows why the Board’s binding reasoning and the subsequent national enforcement decision must be read as connected but distinct acts.
Judicial review also requires an up-to-date account. On 10 February 2026, the Court of Justice held in C-97/23 P that WhatsApp’s action against that EDPB decision was admissible. It set aside the General Court’s earlier inadmissibility order and referred the case back for examination of the merits. The Court’s official explanation describes the Board decision as an act open to challenge that directly concerned the undertaking.
That ruling concerns access to judicial review. It did not itself decide the substantive lawfulness of all the findings or annul the national fine. An account suggesting that EDPB decisions can only ever be challenged indirectly through national proceedings would therefore be incomplete after this judgment.
Urgent procedures and coordinated enforcement
Article 66 addresses exceptional urgency. A concerned authority may adopt provisional measures producing effects in its own territory for a specified period of up to three months where urgent action is needed to protect individuals. The provision also allows requests for urgent EDPB opinions or binding decisions in the circumstances it identifies.
The urgent Board procedure has its own two-week timeframe and simple-majority rule. It should not be confused with the ordinary Article 65 sequence or with a general power for any organisation to demand an emergency Board ruling. The relevant authorities must use the statutory procedure and explain the urgency.
The Coordinated Enforcement Framework is different again. It organises national authorities around a shared topic, potentially through investigations or fact-finding exercises. The CEF action launched on 19 March 2026 focuses on transparency and information duties under Articles 12, 13 and 14, with 25 participating authorities.
The year of an action and the year of its report should remain separate. The right-to-erasure action took place in 2025, with its report adopted in 2026. Neither a coordinated project nor the publication of a report means that every organisation in a sector has been investigated or found in breach.
Turn a relevant publication into an operational decision
Start with a defined question. A company buying a hosted service may need to decide the parties’ roles. A team transferring employee data may need to assess an international transfer. A controller redesigning an account interface may need to improve transparency. Broad searches for “latest GDPR guidance” can produce documents that are interesting but irrelevant to the decision at hand.
Record the applicable legal provision and the relevant part of the EDPB document. Then map the criteria to evidence from the actual service: contracts, data flows, configuration, access arrangements, purposes and retention. Where a fact is missing, assign someone to establish it instead of assuming the most convenient answer.
For an international transfer, for example, the existence of standard contractual clauses is one part of the assessment. The transfer impact assessment must address the relevant circumstances and safeguards. A citation to EDPB recommendations cannot compensate for an unknown recipient or unexplained remote access.
The outcome should specify a decision, its assumptions and the resulting work. A privacy notice may need an accurate description of recipients; a supplier arrangement may need clarification; a process may require a control before launch. The privacy policy guide helps translate transparency requirements into information people can understand, while the underlying evidence remains in the accountability documentation.
Maintain a focused monitoring process
Assign ownership for monitoring the publications that affect significant processing. A useful update record distinguishes consultation drafts, final guidance, Board decisions, national enforcement and court judgments. Each category has a different consequence for the organisation and should not be treated as an identical “new rule”.
When a publication changes a previous interpretation, identify the affected decisions and reassess them. Preserve the earlier assessment and record why it changed. This makes the organisation’s reasoning understandable during an audit and avoids silently replacing a document without updating the process it describes.
The GDPR audit methodology can be used to verify that documentary changes reached the actual service. A revised supplier policy is ineffective if new contracts still follow the old process. A new notice is insufficient if the collection screen continues to display obsolete information.
EDPB priorities are useful evidence of regulatory attention, but they are not a reliable prediction that a particular business will be investigated within a fixed number of months. A broader data privacy compliance programme should remain based on applicable duties and the risks of its processing, with publications informing that work rather than replacing it.
Frequently asked questions
Are EDPB guidelines legally binding?
Guidelines are interpretive material, distinct from legislation and binding decisions. Organisations should assess their relevance and reasoning carefully, alongside the GDPR and case law. Simply citing a guideline neither establishes compliance nor prevents an authority from examining the underlying facts.
Does the EDPB handle my complaint against a company?
Individual complaints ordinarily belong with a competent national supervisory authority. The EDPB supports consistency and cooperation, and may resolve disputes between authorities through the statutory procedures. It is not a general first-instance complaints office for controllers throughout Europe.
Can an EDPB binding decision be reviewed by a court?
Judicial review depends on the applicable procedural conditions. The Court of Justice’s February 2026 WhatsApp ruling confirms that the particular binding Board decision was open to direct challenge and directly concerned WhatsApp. Admissibility of a challenge and success on its merits are separate questions.