Cybersecurity Policy Report, Responsibilities of DPOs Within EUIs Clarified by EDPS, (Feb 13, 2026)

By Tony Foley

The European Data Protection Supervisor (EDPS) has released a pair of documents that clarify the role of data protection officers (DPOs) within European Union institutions, bodies, offices and agencies (EUIs).

In a press release today, EDPS noted that EU data protection law requires all EUIs to appoint a DPO. Citing a desire to strengthen the effectiveness and independence of DPO functions, EDPS adopted supervisory guidance in December 2025 that outlined EDPS’s interpretation of the DPO role in EUIs, including the designation of DPOs, their institutional positioning, guarantees of independence attached to the function, and the responsibilities entrusted to DPOs.

After developing the supervisory guidance, EDPS adopted Decision 01/2026 on Jan. 16. This decision establishes binding rules on the application of the requirement of prior consent by the EDPS for the dismissal of a DPO, setting out a clear and uniform procedural framework that EUIs must follow when seeking EDPS consent prior to dismissing a DPO before the end of their designated term.

EDPS said that, taken together, the guidance and rules clarified both its expectations and the applicable procedural requirements. Each document applies immediately and should be reflected as appropriate in the internal practices and procedures of all EUIs. “Since 2002, DPOs have been a cornerstone of effective data protection governance within EUIs,” said Supervisor Wojciech Wiewiórowski. “The updated Guidance and Rules on Consent for DPO Dismissal aim to strengthen their role by ensuring the independent, consistent and effective application of EU data protection law. These measures reinforce the DPO’s position as a critical internal safeguard for the protection of personal data.”

News: InternationalLegislation DataPrivacy