The European Data Protection Supervisor (EDPS) adopted two key documents to strengthen the role and independence of DPOs in European Union institutions, bodies, offices and agencies.
The two measures
On December 18, 2025, a Supervisory Guidance was published on the role of DPOs in EU institutions. Subsequently, on January 16, 2026, Decision 01/2026 was adopted, establishing binding rules: to dismiss a DPO before the end of their term, the institution must obtain prior consent from the EDPS.
Why it matters for private sector DPOs too
- Even though the act only binds EU institutions, it indicates an interpretive direction reflected in the private sector
- Reinforces the argument of Art. 38(3) GDPR: a DPO cannot be dismissed for performing their tasks
- Italian companies modifying DPO contracts must justify the change with objective reasons unrelated to the function
- Early termination clauses must be drafted with caution and documented
Practical implications
If you are an external DPO and receive a request to terminate the contract before the natural expiration, it is advisable to request the reasons in writing and keep every communication. You may need to demonstrate that the termination was not related to the performance of your duties.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
