TL;DR for the DPO
The privacy notice is the document everyone has and almost nobody re-reads. In 2026 it is the document every European authority will be looking at, at the same time. If you carry a client portfolio, this is the year to re-read all of them - and not in September.
How the coordinated action works
Since 2022 the EDPB has picked one topic a year and national authorities check it in parallel: some send questionnaires, some open formal inspections, some start proceedings. The findings feed a European report that becomes the interpretive reference for the years that follow. Previous editions covered the role of the DPO, the right of access and erasure. 2026 is transparency.
The practical consequence is that you do not need to be in the spotlight to end up in the sample: authorities pick controllers of every size, and for many the first news arrives as a questionnaire with a deadline.
What they actually look at
Article 12 does not require the notice to exist: it requires it to be concise, transparent, intelligible, easily accessible and in clear and plain language. That is five adjectives, and each one is a possible finding. A complete but unreadable notice breaches Article 12 just as an incomplete one breaches Article 13.
Article 14 is the real weak spot
Where data does not come from the data subject but from another source - a purchased list, a customer base inherited through an acquisition, a supplier passing records on - the notice is still due, must be given within a month, and must state WHERE the data came from. In practice it is the most neglected obligation of all, because nobody has a process that triggers when data enters through an indirect channel.
The questions to ask about each client
- Is the notice current for what the client does TODAY, or does it describe the company of three years ago?
- Do the purposes and legal bases match those written in the Article 30 records? The two diverge more often than people think, and authorities compare them.
- Where data arrives from third parties, is there an Article 14 notice, and does anyone actually send it within the month?
- Are retention periods stated with a criterion, or with 'for as long as necessary', which informs nobody?
- Is the notice reachable in under two clicks from the point where data is collected?
What to do now, in practice
1) Inventory every client's notice with the date of its last review: anything older than two years is the backlog to clear first. 2) For each client, cross-check the purposes in the notice against the Article 30 records and note the divergences - it is the first check an authority runs, because it costs nothing. 3) Hunt for indirect data flows: lists, partners, acquisitions, suppliers passing records. Each one requires an Article 14 notice stating the source. 4) Put the notice review in this year's plan with a date, not as an ongoing activity: ongoing activities never happen.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
