Cybersecurity Policy Report, Transparency Obligations Under GDPR Will Be 2026 Focus of EU Privacy Authorities, (Mar 19, 2026)
By Tony Foley
The European Data Protection Board (EDPB) announced today that it had launched its coordinated enforcement framework (CEF) for 2026, focused on compliance with the obligations of transparency and information under the European Union’s General Data Protection Regulation (GDPR).
In announcing the CEF, the EDPB noted that individuals were entitled under GDPR articles 12-14 to be informed when their data is being processed. The right to be informed is a core element of transparency and ensures that individuals have more control over their data. EDPB said 25 data protection authorities (DPAs) across Europe (including the Spanish data protection authority, Agencia Española de Protección de Datos (AEPD), which indicated its participation in the project in a news release today) would take part in the CEF, looking closely to assess the compliance of controllers with their GDPR transparency obligations. Participating DPAs will contact controllers across multiple sectors, either through enforcement actions or fact-finding exercises. In cases where fact-finding is carried out, DPAs may also decide to undertake additional follow-up action if needed.
In the second half of 2026, participating DPAs will share and discuss their findings and aggregate the results of their national actions, generating deeper insights into the topic. A consolidated report then will be drafted and submitted for the EDPB’s adoption.
News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR