All news
EDPB / EDPS February 13, 2026 3 min

EDPS strengthens DPO independence: new binding rules

Decision 01/2026: prior consent required to dismiss a DPO in EU institutions

The European Data Protection Supervisor (EDPS) adopted two key documents to strengthen the role and independence of DPOs in European Union institutions, bodies, offices and agencies.

The two measures

On December 18, 2025, a Supervisory Guidance was published on the role of DPOs in EU institutions. Subsequently, on January 16, 2026, Decision 01/2026 was adopted, establishing binding rules: to dismiss a DPO before the end of their term, the institution must obtain prior consent from the EDPS.

Why it matters for private sector DPOs too

  • Even though the act only binds EU institutions, it indicates an interpretive direction reflected in the private sector
  • Reinforces the argument of Art. 38(3) GDPR: a DPO cannot be dismissed for performing their tasks
  • Italian companies modifying DPO contracts must justify the change with objective reasons unrelated to the function
  • Early termination clauses must be drafted with caution and documented

Practical implications

If you are an external DPO and receive a request to terminate the contract before the natural expiration, it is advisable to request the reasons in writing and keep every communication. You may need to demonstrate that the termination was not related to the performance of your duties.

Official source:EDPS strengthens DPO role: new guidance and binding rules

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

EDPB / EDPS
EDPBfirst statement on smart glasses

Smart glasses: the EDPB takes a position — users can be controllers, and people being filmed must be able to tell

They look like ordinary glasses, but they have a camera, a microphone and a connection. The EDPB publishes its first statement on smart glasses: when the user becomes a controller, why manufacturers and app providers cannot pass their obligations on to users, and what making a recording visible means in practice.

Oct 13, 2026New 5 min
EDPB / EDPS
25the authorities looking at your privacy notice this year, not at your registers

The year the authorities read the privacy notice: CEF 2026 on transparency

On 19 March 2026 the EDPB launched this year's coordinated enforcement action on the transparency and information obligations of Articles 12, 13 and 14 GDPR. Twenty-five authorities are taking part, each free to choose its method: inspections, questionnaires sent to controllers, reading the notices published on websites, sector reviews. National results will be aggregated in the second half of 2026 and the EDPB will publish a summary report with follow-up recommendations. For anyone running compliance the point is that this year the check starts from a text that is already public.

Oct 09, 2026New 7 min
EDPB / EDPS
13 novlast day to send comments to the consultation

When a fine, and when not: the EDPB writes down the part that was missing

On 21 September 2026 the European Data Protection Board adopted Guidelines 04/2026 on the exercise of the power to fine in relation to the other corrective powers, open to public consultation until 13 November 2026. They replace the old Article 29 Working Party guidelines and complete the 2022 ones on calculating the amount. The difference is substantive: those said how much, these say whether. And at the fourth step there is a presumption that shifts the burden of the defence.

Sep 21, 2026New 6 min