The Office of the Data Protection Ombudsman to investigate the transparency of personal data processing as part of EU-wide action

This year, European data protection authorities will investigate how well organisations comply with the transparency and information obligations related to personal data processing. Data protection authorities from 25 countries across Europe will take part in the action.

The European Data Protection Board initiated the coordinated enforcement action for 2026 on 19 March. The action focuses on investigating how organisations from different sectors comply in practice with the data protection legislation obligations related to the transparency of personal data processing, and how they ensure the right of individuals to be informed is respected. 

Everyone has the right to be informed how their personal data is processed. This gives individuals better opportunities to control their data. 

The Office of the Data Protection Ombudsman will investigate the situation in Finland with a survey sent to the parties that have representatives in the Finnish Parliament. The purpose is to collect information about the most common challenges, and to provide the parties with useful guidance before the parliamentary election of 2027. The survey will be sent during the spring.

To conclude the action, the European Data Protection Board will aggregate and analyse the results of the investigations carried out in different countries. Follow-up measures may be taken based on the results both on the national and EU levels. The results are expected to be available at the start of 2027. 

Part of the EU’s data protection collaboration

The joint initiatives of European data protection authorities promote uniform supervision and collaboration within the European Economic Area. The coordinated enforcement action initiated now is the fifth action coordinated by the European Data Protection Board. 

A focus for the action is decided every year. In previous years, European data protection authorities have looked at the implementation of the right to be forgotten and the right of access, the use of cloud-based services by the public sector, and the position of data protection officers in EU countries.

Further information: 

Press release from the European Data Protection Board: CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations under the GDPR (edpb.europa.eu)