Guidelines of the European Data Protection Board

The European Data Protection Board is responsible for the uniform application of the EU's General Data Protection Regulation (EUR-Lex) and the Data Protection Directive (EUR-Lex) applying to police and criminal justice authorities in the European Union.

The European Data Protection Board was established on 25 May 2018. Before the establishment of the European Data Protection Board, the Article 29 Working Party served as the cooperation body for data protection authorities in the EU.

Guidelines of the EDPB

Public consultation on guidelines

Guidelines 04/2021 on codes of conduct as tools for transfers (open for public consultation until 1 October 2021)

Adopted guidelines

Guidelines 02/2021 on Virtual Voice Assistants (pdf)

Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions (pdf)

Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive (pdf)

Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (pdf)

Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679 (pdf)

Guidelines 8/2020 on the targeting of social media users (pdf)

Guidelines 07/2020 on the concepts of controller and processor in the GDPR (pdf)

Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR (pdf)

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures (pdf)

Guidelines 05/2020 on consent under Regulation 2016/679 (pdf)

Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak (pdf)

Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak (pdf)

Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies (pdf)

Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications (pdf)

Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (pdf)

Guidelines 4/2019 on Article 25 Data Protection by Design and by Default (pdf)

Guidelines 3/2019 on processing of personal data through video devices (pdf)

Guidelines 2/2019 on the processing of personal data in the context of the provision of online services to data subjects (Art. 6 1 b( (pdf)

Recommendation 01/2019 on the draft list of the European Data Protection Supervisor regarding the processing operations subject to the requirement of a data protection impact assessment (pdf)

Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies (pdf)

Guidelines 4/2018 on the accreditation of certification bodies (pdf)

Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) (pdf)

Guidelines 2/2018 on derogations of Article 49 (pdf)

Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 (pdf)

Guidelines that have gone through a public consultation but not yet adopted

Guidelines 03/2021 on the application of Article 65(1)(a) GDPR (pdf)

Guidelines 01/2021 on Examples regarding Data Breach Notification (pdf)

Guidelines 10/2020 on restrictions under Article 23 GDPR (pdf)

Guidelines and recommendations of the Article 29 Working Party

Automated individual decision-making and profiling

Guidelines on Automated Individual Decision-making and Profiling for the Purposes (pdf)

Identifying the lead supervisory authority

Guidelines for identifying a controller or processor’s lead supervisory authority and frequently asked questions (pdf)

Transparency

Guidelines on Transparency (pdf)

Consent

Guidelines on Consent (pdf)

Data portability

Guidelines on the right to data portability (pdf)

Frequently asked questions: Data portability (pdf)

Data Protection Officers

Guidelines on Data Protection Officers (‘DPOs’) and frequently asked questions about DPOs (pdf)

Personal data breaches

Guidelines on Personal Data Breach Notification (pdf)

Impact assessments

Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679 (pdf)

Administrative fines

Guidelines on the application and setting of administrative fines (pdf)