EDPB Launches Coordinated GDPR Enforcement on Transparency

EDPB News

Filed March 19th, 2026

Detected March 19th, 2026

Summary

The European Data Protection Board (EDPB) has launched a coordinated enforcement action for 2026 focusing on compliance with GDPR transparency and information obligations. Twenty-five Data Protection Authorities across Europe will participate, assessing controllers' adherence to Articles 12, 13, and 14 of the GDPR.

View original document View source feed page

What changed

The EDPB has initiated its Coordinated Enforcement Framework (CEF) action for 2026, targeting transparency and information obligations under the General Data Protection Regulation (GDPR). This initiative involves 25 Data Protection Authorities (DPAs) across Europe who will conduct enforcement actions and fact-finding exercises to assess how controllers are informing individuals about data processing, as required by Articles 12, 13, and 14 of the GDPR.

Controllers across various sectors in Europe will be contacted by their national DPAs. The findings will be shared and aggregated in the second half of 2026, leading to a consolidated report by the EDPB. This action aims to streamline enforcement and cooperation among DPAs, ensuring greater compliance with core GDPR principles. While no specific penalties are detailed, non-compliance with GDPR transparency obligations can lead to significant fines.

What to do next

Review data processing notices for compliance with GDPR Articles 12, 13, and 14.
Ensure individuals are adequately informed about data collection and processing.
Prepare for potential inquiries or fact-finding exercises from national DPAs.

Penalties

Non-compliance with GDPR transparency obligations can lead to significant fines.

Source document (simplified)

Brussels, 19 March - The EDPB has launched its Coordinated Enforcement Framework (CEF) action for 2026. Following a year-long coordinated action on the right to erasure in 2025, the CEF's focus this year will shift to *compliance with the obligations of transparency and information under the GDPR**.

The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more control over their data.

Next steps

During 2026, 25 Data Protection Authorities (DPAs) across Europe will take part in this initiative. They will look closely to assess the compliance of controllers with their transparency obligations under the GDPR.

Participating DPAs will soon contact controllers from different sectors across Europe, either through enforcement actions or fact-finding exercises. In the latter case, they might also decide to undertake additional follow-up actions if needed.

During the second half of the year, participating DPAs will share and discuss their findings together, with a view to aggregate the results of their national actions and generate deeper insight into the topic. A consolidated report will then be drafted and submitted for adoption by the EDPB, allowing for targeted follow-ups on both national and EU levels.

Background

The CEF is a key action of the EDPB under its 2024-2027 Strategy, aimed at streamlining enforcement and cooperation among DPAs.

In 2023, the EDPB published the report on its first coordinated action on the use of cloud-based services by the public sector.

In 2024, the EDPB also published the report on the outcome of the second coordinated action on the designation and position of Data Protection Officers.

In 2025, the EDPB issued the report on its third coordination action on the implementation of the right of access.

In 2026, the EDPB has adopted a report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR).

Note to editors:
*The Board selected this topic during its October 2025 plenary.

Topics:
- Cooperation between authorities
- GDPR enforcement