Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
EDPB / EDPS July 17, 2026 6 min

EDPB from Dublin: a legal basis is needed so authorities can share information across regulatory fields

High-level meeting of 16 and 17 July 2026: the Board asks the Commission for a legal basis for information sharing between regulators, including confidential information, and admits complaints are growing faster than resources

TL;DR for the DPO

Two things to take away. First: authorities are building channels to share information with regulators in adjacent fields, so an investigation started elsewhere can land on your DPA's desk. Second: proceedings stay long because resources are short, and that is not a good reason to relax - joint operations exist precisely to compensate.

What the Board asked for

At the high-level meeting held in Dublin on 16 and 17 July 2026, the EDPB called on the European Commission to propose a legal basis for cross-regulatory information sharing, including confidential information relevant to enforcement within each regulator's area of competence. Chair Anu Talus linked the request to first-hand experience of cooperating with other EU digital regulators at national and EU level: stronger legislation is needed to remove barriers and improve enforcement outcomes and cross-regulatory coherence.

The problem said out loud: complaints grow, resources do not

The Board recalled the significant progress on cross-border enforcement, also mentioned in the second European Commission report on the GDPR. At the same time authorities face a considerable rise in the number and complexity of complaints, among others as a result of the increased use of AI, placing additional strain on already stretched resources and limiting their ability to perform all their tasks under the Regulation. Authorities underlined the need for practical and, where necessary, legislative solutions, especially in cases where a large number of people is affected.

The solutions on the table

  • Greater use of joint operations between authorities, to pool resources
  • The possibility for complaint-receiving authorities to make resources available to lead supervisory authorities, where useful
  • A series of workshops on enforcement procedures and on exchanging information about national practices, also in the context of the upcoming Procedural Regulation
  • A broader dialogue with other actors in the ecosystem, because consistency also depends on national legislation and case law, which the EDPB does not govern

What changes for the DPO

  • If a client is also subject to other regulators (competition, digital services, finance, AI), treat the documentation as potentially shared between authorities: consistency between what you tell one and the other becomes an issue
  • In cross-border cases, expect longer but more coordinated investigations: more authorities looking at the same file, not fewer
  • The Procedural Regulation will codify practices many authorities already apply: if you have an internal procedure for replying to the authority, now is the time to write it properly
Official source:EDPB - Comunicato della riunione di Dublino del 17 luglio 2026Official source:Commissione europea - Secondo rapporto sul GDPROfficial source:EDPB - Helsinki Statement on enhanced clarity, support and engagement

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

EDPB / EDPS
EDPBfirst statement on smart glasses

Smart glasses: the EDPB takes a position — users can be controllers, and people being filmed must be able to tell

They look like ordinary glasses, but they have a camera, a microphone and a connection. The EDPB publishes its first statement on smart glasses: when the user becomes a controller, why manufacturers and app providers cannot pass their obligations on to users, and what making a recording visible means in practice.

Oct 13, 2026New 5 min
EDPB / EDPS
25the authorities looking at your privacy notice this year, not at your registers

The year the authorities read the privacy notice: CEF 2026 on transparency

On 19 March 2026 the EDPB launched this year's coordinated enforcement action on the transparency and information obligations of Articles 12, 13 and 14 GDPR. Twenty-five authorities are taking part, each free to choose its method: inspections, questionnaires sent to controllers, reading the notices published on websites, sector reviews. National results will be aggregated in the second half of 2026 and the EDPB will publish a summary report with follow-up recommendations. For anyone running compliance the point is that this year the check starts from a text that is already public.

Oct 09, 2026New 7 min
EDPB / EDPS
13 novlast day to send comments to the consultation

When a fine, and when not: the EDPB writes down the part that was missing

On 21 September 2026 the European Data Protection Board adopted Guidelines 04/2026 on the exercise of the power to fine in relation to the other corrective powers, open to public consultation until 13 November 2026. They replace the old Article 29 Working Party guidelines and complete the 2022 ones on calculating the amount. The difference is substantive: those said how much, these say whether. And at the fourth step there is a presumption that shifts the burden of the defence.

Sep 21, 2026New 6 min