All news
Regulation June 12, 2026 5 min

EDPB 2026: the EU coordinated action targets transparency (Art. 12-14). What to check in privacy notices

The year's theme for EU authorities: how you tell people what you do with their data. Notice clarity and disclosure of transfer countries under scrutiny

TL;DR for the DPO

The EDPB announced its 2026 Coordinated Enforcement Action focuses on TRANSPARENCY and information obligations (Art. 12-14 GDPR). National authorities will jointly examine privacy notices: clarity, completeness, accuracy. Previous themes were the DPO role and access/erasure rights.

What they will look at

  • Plain language: is the notice understandable or a wall of legalese?
  • Completeness: all Art. 13-14 elements (purposes, legal bases, retention, rights)?
  • Extra-EU transfers: some authorities expect EACH third country to be explicitly named
  • Accessibility: easy to find and read, including on mobile?

What to do now

Time for a notice review across your clients. For special-category sectors (e.g. healthcare) the bar is higher: separate notices by data-subject category (patients vs staff).

Official source:EDPB - Coordinated Enforcement Action 2026

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
26the article nobody signs before broadcasting

Who answers for the live stream of the under-14 match? Sweden answers the question nobody asks

On 25 August the Swedish authority published guidance on streaming youth sport. Many clubs stream children's matches online, and the guidance sets out the factors that decide what is allowed. But the part worth reading is the other one: responsibility when the municipality owns the venue and the club wants to install cameras.

Aug 25, 2026New 5 min
Regulation
24months after which a past incident should not be used

The score they refuse your credit with can be requested, and it has to be explained

On 19 August the CNIL translated for the public its May 2026 recommendation on assessing creditworthiness. Inside are three numbers and one principle that concern anyone doing scoring: twenty-four months for past incidents, six months for the data of a refused application, and a right of access to the score that cannot be dismissed by invoking trade secrecy.

Aug 19, 2026New 6 min
Regulation
2EDPB criteria and the DPIA becomes mandatory

In schools, advertising trackers are prohibited — and consent has nothing to do with it

On 24 August the CNIL published its rules for the digital workspaces used in schools. The decisive point is not the protection of minors but a principle of administrative law: the neutrality of the public education service includes commercial neutrality, so trackers used for advertising or profiling are prohibited in principle. If the tool has them, the controller must switch them off.

Aug 24, 2026New 6 min