All news
EDPB / EDPS May 12, 2026 8 min

EDPB publishes guidelines on public DPO profiles: transparency, accountability and data subject rights

Document 03/2026 adopted on May 12: operational guidance for platforms allowing DPOs to be publicly visible and contactable

TL;DR for the DPO

On May 12, 2026, the EDPB adopted document 03/2026 with 12 operational recommendations on platforms publishing DPO professional profiles. Key points: (1) publication of the profile requires explicit consent under art. 6(1)(a), (2) the right to immediate removal must be guaranteed, (3) marketing purposes must be separated from the professional contact purpose.

Context: the growth of DPO directories

In the last 18 months, dozens of platforms have emerged allowing organizations to find certified DPOs for appointments. The EDPB found that many of these platforms processed DPOs' personal data without a clear legal basis and adequate privacy notice.

The 12 recommendations in summary

  • Legal basis: only consent under art. 6(1)(a). Legitimate interest is not sufficient
  • Specific privacy notice covering all purposes and retention periods
  • Immediate removal right without justification
  • Separation of purposes between professional contact and marketing
  • Data minimization: only data strictly necessary for professional contact
  • Algorithmic transparency for ranking criteria
  • Verification of declared certifications by the platform
  • Audit logging with maximum 12-month retention
  • Notification to the DPO of access and contact requests
  • Data portability in structured format (CSV/JSON)
  • No post-removal data retention except for legal obligations
  • Transparent disclosure of sub-processors and consent for non-EEA transfers

In DPO Workspace

The Profile section allows you to enable an opt-in public profile compliant with EDPB Guidelines 03/2026. All 12 points are implemented by default.

Official source:EDPB - Guidelines 03/2026

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

EDPB / EDPS
12-14gli articoli sotto esame

In 2026 every European authority is looking at the same thing: privacy notices

Each year the EDPB picks a topic and every national authority checks it together, in the same period, through questionnaires and inspections. For 2026 the topic is transparency: how controllers tell people what happens to their data. In scope are Article 13, where data comes from the data subject, and Article 14, where it comes from elsewhere. The Czech authority has already written the theme into its inspection plan.

Aug 10, 2026New 6 min
EDPB / EDPS
28 agotermine per candidarsi

Competition and data protection: the EDPB opens the table, and there is a deadline

After the DSA and before the DMA and the AI Act, the fourth piece of the European regulatory mosaic concerns the relationship between competition and data protection. This is not theoretical: it touches data as a market asset, mergers, and the position of those who process data because they dominate a market. The EDPB and the Commission are asking for input before they write, and this time the deadline is close.

Jul 30, 2026New 6 min
EDPB / EDPS
10 lug 2027quando si potra' condividere

Anti-money laundering and privacy: the EDPB and AMLA write the sharing rules together

On 1 July 2026 the EDPB and the European Anti-Money Laundering Authority announced joint guidelines on a question neither could solve alone: how banks, professionals and authorities can share information about suspicions without building unchecked lists of suspects. The possibility applies from 10 July 2027 and the public consultation is expected in the first half of that year. Anyone advising obliged entities has a year to prepare.

Jul 01, 2026New 6 min