All news
EDPB / EDPS May 12, 2026 8 min

EDPB publishes guidelines on public DPO profiles: transparency, accountability and data subject rights

Document 03/2026 adopted on May 12: operational guidance for platforms allowing DPOs to be publicly visible and contactable

TL;DR for the DPO

On May 12, 2026, the EDPB adopted document 03/2026 with 12 operational recommendations on platforms publishing DPO professional profiles. Key points: (1) publication of the profile requires explicit consent under art. 6(1)(a), (2) the right to immediate removal must be guaranteed, (3) marketing purposes must be separated from the professional contact purpose.

Context: the growth of DPO directories

In the last 18 months, dozens of platforms have emerged allowing organizations to find certified DPOs for appointments. The EDPB found that many of these platforms processed DPOs' personal data without a clear legal basis and adequate privacy notice.

The 12 recommendations in summary

  • Legal basis: only consent under art. 6(1)(a). Legitimate interest is not sufficient
  • Specific privacy notice covering all purposes and retention periods
  • Immediate removal right without justification
  • Separation of purposes between professional contact and marketing
  • Data minimization: only data strictly necessary for professional contact
  • Algorithmic transparency for ranking criteria
  • Verification of declared certifications by the platform
  • Audit logging with maximum 12-month retention
  • Notification to the DPO of access and contact requests
  • Data portability in structured format (CSV/JSON)
  • No post-removal data retention except for legal obligations
  • Transparent disclosure of sub-processors and consent for non-EEA transfers

In DPO Workspace

The Profile section allows you to enable an opt-in public profile compliant with EDPB Guidelines 03/2026. All 12 points are implemented by default.

Official source:EDPB - Guidelines 03/2026

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

EDPB / EDPS
EDPBfirst statement on smart glasses

Smart glasses: the EDPB takes a position — users can be controllers, and people being filmed must be able to tell

They look like ordinary glasses, but they have a camera, a microphone and a connection. The EDPB publishes its first statement on smart glasses: when the user becomes a controller, why manufacturers and app providers cannot pass their obligations on to users, and what making a recording visible means in practice.

Oct 13, 2026New 5 min
EDPB / EDPS
25the authorities looking at your privacy notice this year, not at your registers

The year the authorities read the privacy notice: CEF 2026 on transparency

On 19 March 2026 the EDPB launched this year's coordinated enforcement action on the transparency and information obligations of Articles 12, 13 and 14 GDPR. Twenty-five authorities are taking part, each free to choose its method: inspections, questionnaires sent to controllers, reading the notices published on websites, sector reviews. National results will be aggregated in the second half of 2026 and the EDPB will publish a summary report with follow-up recommendations. For anyone running compliance the point is that this year the check starts from a text that is already public.

Oct 09, 2026New 7 min
EDPB / EDPS
13 novlast day to send comments to the consultation

When a fine, and when not: the EDPB writes down the part that was missing

On 21 September 2026 the European Data Protection Board adopted Guidelines 04/2026 on the exercise of the power to fine in relation to the other corrective powers, open to public consultation until 13 November 2026. They replace the old Article 29 Working Party guidelines and complete the 2022 ones on calculating the amount. The difference is substantive: those said how much, these say whether. And at the fourth step there is a presumption that shifts the burden of the defence.

Sep 21, 2026New 6 min