EDPB Guidelines Research Library

What it covers

These guidelines interpret each of the derogations for specific situations set out in Article 49 GDPR that allow transfers of personal data to third countries in the absence of an adequacy decision or appropriate safeguards. It explains the conditions for explicit consent, contractual necessity, public interest, legal claims, vital interests and the public register derogation, and clarifies the meaning of occasional and not-repetitive transfers and the necessity test.

Why it matters

It is the primary EDPB reference for when an organisation may rely on an Article 49 derogation rather than Article 45 or 46 mechanisms, and stresses that derogations must be construed narrowly.

Refer to it when

• assessing whether a one-off international transfer can rely on Article 49
• determining whether consent for a transfer meets the additional Article 49(1)(a) requirements
• distinguishing occasional from repetitive transfers
• understanding the interaction between Article 48 and third-country authority requests

Provisions interpreted

• Art. 49

What it covers

These guidelines clarify when a processing operation constitutes a 'transfer of personal data to a third country or international organisation' under Chapter V of the GDPR, setting out three cumulative criteria to identify a transfer and explaining the consequences that follow. It also addresses situations where personal data are processed outside the EEA but no transfer takes place, and the safeguards still required in those cases.

Why it matters

It resolves a key definitional gap in the GDPR that determines whether Chapter V transfer safeguards apply, which is central to structuring cross-border data flows and outsourcing arrangements.

Refer to it when

• assessing whether a data flow to a non-EU recipient qualifies as a transfer
• determining whether Chapter V safeguards must be applied
• analysing remote access to EU data from abroad
• distinguishing transfers from processing outside the EEA by the same controller

Provisions interpreted

• Art. 3
• Art. 44
• Art. 45
• Art. 46

What it covers

This document explains how certification under Articles 42 and 43 GDPR can be used as an appropriate safeguard for international transfers under Article 46(2)(f). It sets out the roles of exporters, importers and certification bodies, additional certification criteria specific to transfers, and the content of binding and enforceable commitments, with an annex of supplementary measures.

Why it matters

It is the reference document for organisations and certification bodies considering certification as an alternative to standard contractual clauses or BCRs for transferring personal data outside the EEA.

Refer to it when

• assessing certification as a transfer mechanism
• designing certification criteria covering third-country transfers
• drafting binding and enforceable commitments for an importer
• advising a certification body on accreditation requirements for transfers

Provisions interpreted

• Art. 42
• Art. 43
• Art. 46

What it covers

This document sets out eighteen practical case studies of personal data breaches, covering ransomware, data exfiltration, internal human risk sources, lost or stolen devices and mispostal, and social engineering. For each case it discusses the prior organisational and technical measures relevant to risk, and how controllers should assess whether notification to the supervisory authority and communication to data subjects under Articles 33 and 34 GDPR are required.

Why it matters

It supplements the general WP250 breach guidance with concrete, scenario-based analysis that controllers and DPOs can use to benchmark their own incident response and notification decisions.

Refer to it when

• assessing whether a specific type of incident triggers Article 33/34 notification
• benchmarking incident response against comparable scenarios
• training staff on breach recognition and categorisation
• evaluating prior security measures against documented case examples

Provisions interpreted

• Art. 33
• Art. 34

What it covers

These guidelines set out a five-step methodology that supervisory authorities use to calculate the amount of administrative fines under Article 83 GDPR, covering identification of processing operations, the starting point for calculation, aggravating and mitigating circumstances, the legal maximum, and the final assessment of effectiveness, proportionality and dissuasiveness. They complement the earlier WP253 guidelines on when to impose a fine.

Why it matters

It is the EDPB's authoritative methodology for quantifying GDPR fines, so it is central to understanding how enforcement outcomes and sanction amounts are derived in practice.

Refer to it when

• assessing how a fine amount was or should be calculated
• understanding aggravating or mitigating factors in enforcement
• researching the legal maximum fine for an infringement
• analysing corporate liability and turnover in fine calculation

Provisions interpreted

• Art. 83

What it covers

These guidelines analyse the cooperation procedure between the lead supervisory authority and concerned supervisory authorities under Article 60 GDPR, clarifying its application paragraph by paragraph. They cover the exchange of relevant information, submission and revision of draft decisions, relevant and reasoned objections, and the interaction with the Article 66 urgency procedure.

Why it matters

It is the primary EDPB reference for understanding how the one-stop-shop cooperation procedure operates in practice among supervisory authorities handling cross-border cases.

Refer to it when

• researching how the one-stop-shop mechanism functions
• determining obligations of a lead supervisory authority
• assessing the effect of an objection to a draft decision
• understanding when the urgency procedure interacts with Article 60

Provisions interpreted

• Art. 60

What it covers

These guidelines clarify the roles and responsibilities of social media providers and targeters when personal data is used to target social media users with tailored messages. They analyse the legal basis for targeting based on provided, observed and inferred data, transparency and right of access obligations, DPIA requirements, and the treatment of special categories of data including data made manifestly public.

Why it matters

It is the key reference for allocating controller responsibilities and identifying lawful bases in advertising and political targeting arrangements built on social media platforms, following the CJEU Wirtschaftsakademie and Fashion ID judgments.

Refer to it when

• structuring a joint controller arrangement between a targeter and a social media provider
• assessing the legal basis for an ad-targeting campaign
• evaluating whether inferred data constitutes a special category of data
• conducting a DPIA for a targeting mechanism

Provisions interpreted

• Art. 4
• Art. 26

What it covers

These recommendations address the legal basis for online providers of goods and services storing customers' credit card data solely to facilitate future purchases, excluding payment institutions and recurring-payment scenarios. They examine why other Article 6 bases are inadequate and conclude that specific, freely given consent is the appropriate basis for such storage.

Why it matters

It gives a clear, narrow answer on which legal basis applies to a common e-commerce practice, useful when assessing checkout flows that offer to remember payment card details.

Refer to it when

• designing or reviewing a 'save my card' checkout feature
• assessing legitimate interest as a basis for storing financial data
• advising on consent requirements for storing payment details
• handling withdrawal of consent for stored card data

Provisions interpreted

• Art. 6
• Art. 7

What it covers

This document provides guidance on the application of Article 37 of the Law Enforcement Directive, covering the legal standard for appropriate safeguards under Article 37(1)(a) and (b) and the factors competent authorities must assess when transferring personal data to third countries or international organisations for law enforcement purposes.

Why it matters

It guides Member States and law enforcement authorities on how to lawfully structure international data-sharing arrangements outside the framework of adequacy decisions.

Refer to it when

• negotiating a police cooperation agreement with a non-EU country
• assessing appropriate safeguards for an ad hoc law enforcement data transfer
• determining accountability obligations after relying on Article 37(1)(b)
• distinguishing LED transfer requirements from GDPR Chapter V

Provisions interpreted

• Art. 37

What it covers

This document analyses the data protection implications of virtual voice assistants (VVAs), describing their technical operation and the roles of designers, developers and users, and examining purpose limitation, legal basis, transparency, special category data, retention, security and data subject rights for voice-processing services. It also addresses the interaction between the GDPR and the ePrivacy Directive for VVA data stored on or accessed from terminal devices.

Why it matters

It gives sector-specific interpretation for an emerging technology where voice data is often processed continuously and may include biometric identifiers, helping product and compliance teams identify the applicable legal basis and design safeguards.

Refer to it when

• designing or auditing a voice assistant product
• determining the legal basis for storing voice recordings
• assessing whether biometric voice identification requires special safeguards
• enabling data subject rights through voice interfaces

Provisions interpreted

• Art. 5
• Art. 6
• Art. 9

What it covers

These guidelines interpret the right of access under Article 15 GDPR, covering its aim and structure, how controllers should assess and respond to access requests, identification and authentication of requesters, the modalities and timing for providing access, and the limits and restrictions applicable, including Articles 12(5), 15(4) and Article 23.

Why it matters

The right of access is one of the most frequently exercised data subject rights and a common source of complaints and disputes, making this the key reference for how controllers must respond to access requests.

Refer to it when

• handling a subject access request
• assessing whether a request is manifestly unfounded or excessive
• deciding how to authenticate a requester
• determining what information must be disclosed

Provisions interpreted

• Art. 15

What it covers

These guidelines set out best practices for the practical implementation of amicable settlements by supervisory authorities handling complaints, including in the one-stop-shop context and for local cases under Article 56(2). They address the definition of amicable settlement, the stages at which it may occur, and the legal consequences following a settlement.

Why it matters

It clarifies how a diverse and largely nationally-governed practice of amicable settlement should be applied consistently within the cooperation procedure, which affects how complaints are ultimately closed.

Refer to it when

• researching how a supervisory authority may close a complaint via settlement
• understanding cooperation obligations following an amicable settlement by the lead authority
• assessing treatment of local cases under Article 56(2)

Provisions interpreted

• Art. 60

What it covers

These guidelines explain how to determine whether processing constitutes 'cross-border processing' and how to identify the resulting lead supervisory authority by locating a controller's or processor's main establishment. They cover borderline cases, groups of undertakings, joint controllers, local processing, and an annex with step-by-step questions for identifying the lead authority.

Why it matters

Identifying the correct lead supervisory authority determines which regulator coordinates a cross-border investigation under the one-stop-shop mechanism, affecting how organisations engage with regulators.

Refer to it when

• determining whether processing is cross-border
• identifying a multinational's main establishment
• working out the lead authority for joint controllers
• handling a complaint involving several Member States

Provisions interpreted

• Art. 4
• Art. 56

What it covers

These guidelines analyse the applicability of Article 6(1)(b) GDPR, the contractual necessity lawful basis, to processing of personal data in the context of online service contracts. They set out the objective necessity test, its interaction with other lawful bases, and its application to service improvement, fraud prevention, online behavioural advertising and content personalisation.

Why it matters

It is the central reference for determining whether an online service can lawfully rely on contractual necessity rather than consent or legitimate interests, particularly for advertising-funded services.

Refer to it when

• assessing whether processing for an online service is genuinely necessary for contract performance
• distinguishing contractual necessity from consent or legitimate interests
• evaluating whether behavioural advertising can be justified under Article 6(1)(b)
• reviewing processing that occurs prior to contract conclusion

Provisions interpreted

• Art. 6

What it covers

This document analyses the concept of consent under Article 4(11) and Article 7 GDPR, covering each element of valid consent, explicit consent, withdrawal, the interaction with other lawful bases, and specific areas of concern including children's consent and scientific research.

Why it matters

It is the primary interpretive reference for determining whether consent obtained from a data subject meets GDPR validity requirements, including in cookie and online consent scenarios.

Refer to it when

• designing a consent request or cookie banner
• assessing whether consent is freely given in an imbalance-of-power relationship
• handling withdrawal of consent
• obtaining consent from children for online services

Provisions interpreted

• Art. 4
• Art. 7

What it covers

This document is a short quick-reference summary of the EDPB Guidelines on consent, presenting the four cumulative validity criteria, explicit consent, withdrawal of consent and rules for children's consent through a checklist and short practical examples; the full guidelines carry the detailed legal analysis.

Why it matters

It offers a fast checklist for confirming whether a consent mechanism is likely to be valid, useful as an entry point before consulting the full guidelines for detailed reasoning.

Refer to it when

• quickly checking the basic validity criteria for consent
• training non-specialist staff on consent basics
• spotting obvious invalid consent designs such as cookie walls

Provisions interpreted (from the full document)

• Art. 4
• Art. 7

What it covers

This is a consultation-stage recommendation setting out the standard application form and the elements and principles required for Processor Binding Corporate Rules (BCR-P) under Article 47 GDPR, including their scope, their interplay with Article 28 processing agreements, and the approval procedure before the BCR Lead supervisory authority. It repeals and replaces the earlier WP257 rev.01 and WP265 documents.

Why it matters

It is the current reference for organisations seeking to use processor BCR as an appropriate safeguard for international transfers within a corporate group, though it remains at the public consultation stage and should not be treated as current.

Refer to it when

• preparing an application for approval of processor BCR
• distinguishing BCR-P from BCR-C
• understanding what must be included in a BCR-P versus a processing agreement
• identifying the role of the BCR Lead supervisory authority

Provisions interpreted

• Art. 47

What it covers

These guidelines, adopted in consultation version, interpret the GDPR's specific rules for processing personal data for scientific research purposes, covering the scope of the concept of scientific research, the data protection principles applicable, the available legal bases including consent and legitimate interest, transparency obligations, and the exceptions to the rights to erasure and objection. They also address attribution of responsibility among multiple actors and appropriate safeguards such as pseudonymisation and anonymisation.

Why it matters

It is the EDPB's central interpretive document on the research-specific derogations scattered across the GDPR, which researchers, universities and research-based industry rely on when designing lawful data processing for scientific projects.

Refer to it when

• assessing whether an activity meets the GDPR definition of scientific research
• choosing a legal basis for a research project
• designing broad or dynamic consent mechanisms
• responding to erasure or objection requests concerning research data

Provisions interpreted

• Art. 5
• Art. 6
• Art. 9
• Art. 89

What it covers

This document provides a short quick-reference summary of the EDPB Guidelines on processing of personal data for scientific research purposes; the full guidelines carry the detailed legal analysis and examples. It highlights the six indicative factors for identifying genuine scientific research, guidance on broad and dynamic consent, transparency measures, and limits on erasure and objection rights.

Why it matters

It gives researchers and DPOs a fast checklist for determining whether an activity qualifies for the GDPR's research-specific flexibilities before consulting the full guidelines for detailed analysis.

Refer to it when

• quickly checking whether a project can claim research exemptions
• deciding between broad and dynamic consent models
• handling an erasure or objection request in a research context
• briefing non-specialist staff on research data protection duties

Provisions interpreted (from the full document)

• Art. 5
• Art. 6
• Art. 9
• Art. 89

What it covers

These guidelines, adopted as a version for public consultation, clarify how specific provisions of the Digital Services Act relating to illegal content moderation, notice and action mechanisms, deceptive design, advertising transparency, recommender systems, protection of minors, risk assessment and codes of conduct interact with the GDPR. They also address cooperation between Digital Services Coordinators and data protection authorities.

Why it matters

It gives intermediary service providers and regulators a consistent framework for applying DSA obligations that involve personal data processing, reducing the risk of conflicting requirements between the two regimes.

Refer to it when

• assessing the lawful basis for content moderation activities
• designing notice-and-action or complaint-handling mechanisms
• evaluating whether an interface feature is a deceptive design pattern under the DSA or GDPR
• reviewing advertising transparency and profiling restrictions on online platforms

Provisions interpreted

• Art. 7
• Art. 16
• Art. 17
• Art. 20
• Art. 23
• Art. 25
• Art. 26
• Art. 27

What it covers

This document is a short quick-reference summary illustrating five scenarios where GDPR and Digital Services Act obligations intersect, such as illegal content reporting, protection of minors from targeted ads, age verification, non-profiling recommender options, and sensitive-data-based advertising; the full guidelines carry the detailed legal analysis.

Why it matters

It offers a fast entry point for identifying where DSA obligations trigger GDPR personal data considerations before consulting the fuller interplay guidelines.

Refer to it when

• quickly checking how a DSA obligation intersects with GDPR
• orienting a team new to DSA-GDPR overlap issues
• identifying scenarios needing further study in the full guidelines

Provisions interpreted (from the full document)

• Art. 7
• Art. 16
• Art. 17
• Art. 20
• Art. 23
• Art. 25
• Art. 26
• Art. 27

What it covers

This document examines how GDPR principles apply to the processing of personal data through blockchain technologies, describing blockchain architecture, the identification of controllers and processors in decentralised governance, and how data protection principles, lawfulness, international transfers, retention, security and data subject rights can be addressed when data is recorded on a distributed ledger.

Why it matters

It addresses the tension between blockchains' immutable, append-only design and GDPR requirements such as erasure and storage limitation, giving organisations deploying blockchain technology practical mitigation measures.

Refer to it when

• assessing GDPR compliance of a proposed blockchain application
• identifying controllers and processors among blockchain participants
• designing on-chain/off-chain data architecture to limit personal data exposure
• handling erasure or rectification requests for blockchain-recorded data

Provisions interpreted

• Art. 5
• Art. 25

What it covers

This is a short quick-reference summary explaining that pseudonymised data remains personal data, and outlining how pseudonymisation can help organisations meet GDPR obligations such as security, data minimisation, and data protection by design and by default; the full Guidelines 01/2025 on Pseudonymisation carry the detailed analysis.

Why it matters

It gives a fast, plain-language entry point for understanding when and why pseudonymisation is useful, pointing readers to the full guidelines for detailed implementation requirements.

Refer to it when

• needing a quick overview of pseudonymisation before consulting the full guidelines
• explaining to non-specialists why pseudonymised data is still personal data
• identifying illustrative examples of pseudonymisation use cases

Provisions interpreted (from the full document)

• Art. 4
• Art. 25
• Art. 32

What it covers

These recommendations set out a six-step roadmap for exporters to assess and, where necessary, supplement Article 46 GDPR transfer tools following the CJEU's Schrems II judgment, so that transferred personal data receives an essentially equivalent level of protection in the destination country. It includes guidance on mapping transfers, assessing third-country law and practice, and identifying technical, contractual and organisational supplementary measures.

Why it matters

It is the principal EDPB reference for conducting transfer impact assessments and selecting supplementary measures after Schrems II invalidated reliance on transfer tools alone in certain circumstances.

Refer to it when

• conducting a transfer impact assessment for a third-country data flow
• selecting supplementary measures to accompany standard contractual clauses
• documenting accountability for a transfer decision
• responding to a supervisory authority enquiry about international transfers

Provisions interpreted

• Art. 46

What it covers

This WP29 guidance, endorsed by the EDPB, clarifies the scope of Article 35 GDPR, explaining when a data protection impact assessment is mandatory, who is responsible for carrying it out, and the criteria and methodology for conducting one. It also addresses when the supervisory authority must be consulted under Article 36.

Why it matters

It remains the foundational reference for determining when a DPIA is legally required and how to structure one, underpinning national supervisory authority lists of processing operations requiring a DPIA.

Refer to it when

• determining whether a processing operation triggers a mandatory DPIA
• structuring a DPIA methodology
• deciding whether to consult a supervisory authority on residual risk
• assessing DPIA obligations for existing processing operations

Provisions interpreted

• Art. 35

What it covers

This opinion, issued at the request of the Danish supervisory authority under Article 64(2) GDPR, addresses controllers' obligations regarding the identification, verification and documentation of processors and sub-processors, and the wording of controller-processor contracts, including in the context of international transfers.

Why it matters

It provides a harmonised interpretation of controllers' due diligence obligations towards their processing chain and clarifies acceptable contractual wording, which is directly relevant when negotiating or auditing processor agreements.

Refer to it when

• negotiating or reviewing a data processing agreement
• assessing how much verification of sub-processors is required
• drafting a clause on instructions and third-country legal orders
• assessing accountability for a multi-tier processing chain involving transfers

Provisions interpreted

• Art. 28
• Art. 44

What it covers

This opinion addresses the circumstances under which 'consent or pay' models implemented by large online platforms for behavioural advertising can constitute valid, freely given consent under the GDPR, examining detriment, imbalance of power, conditionality, equivalent alternatives, appropriate fees, and the other elements of valid consent.

Why it matters

It sets out the EDPB's position, issued at the request of several supervisory authorities under Article 64(2), on when pay-or-consent designs are compatible with GDPR consent requirements, informing enforcement and design decisions across large platforms.

Refer to it when

• designing or reviewing a consent-or-pay mechanism for behavioural advertising
• assessing whether a paid alternative preserves freely given consent
• evaluating detriment or imbalance of power on a large platform
• determining an appropriate fee for an ad-free alternative

Provisions interpreted

• Art. 4
• Art. 6
• Art. 7

What it covers

This document is a short corrigendum listing editorial corrections to specific paragraphs and footnotes of EDPB Opinion 08/2024 on valid consent in consent-or-pay models operated by large online platforms, including a corrected reference to Articles 6 and 9 GDPR and the DSA definition of a very large online platform.

Why it matters

It ensures researchers cite the corrected text of Opinion 08/2024 rather than the original wording where paragraphs or footnotes have been amended.

Refer to it when

• Checking the corrected wording of Opinion 08/2024 before quoting it
• Confirming which paragraphs of the Opinion were amended
• Citing Opinion 08/2024 in a submission or memo

Provisions interpreted

• Art. 4
• Art. 6
• Art. 7

What it covers

This statement addresses the role that data protection authorities should play under the AI Act enforcement framework following its entry into force, recommending that DPAs be designated as market surveillance authorities for certain high-risk AI systems and highlighting the need for cooperation between market surveillance authorities and data protection authorities.

Why it matters

It records the EDPB's position on how AI Act supervision should be allocated among national authorities and its relationship with existing GDPR enforcement structures, relevant to anyone tracking the institutional interplay between AI regulation and data protection.

Refer to it when

• researching which authority supervises high-risk AI systems in a Member State
• understanding the relationship between DPAs and AI Act market surveillance authorities
• assessing how the AI Act and GDPR enforcement frameworks interact

Provisions interpreted

• Art. 70
• Art. 74

What it covers

This Opinion, adopted under Article 64(2) GDPR at the request of the Irish supervisory authority, addresses when an AI model can be considered anonymous, how controllers can demonstrate the appropriateness of legitimate interest as a legal basis in the development and deployment phases of AI models, and the consequences of unlawful processing during development for subsequent processing or operation of the model.

Why it matters

It is the EDPB's central statement of general application on data protection aspects of AI model development and deployment, guiding how supervisory authorities assess anonymity claims and legitimate interest reliance for AI systems.

Refer to it when

• assessing whether an AI model qualifies as anonymous
• relying on legitimate interest to train or deploy an AI model
• evaluating risks arising from web scraping for AI training data
• determining the effect of unlawful data collection on a subsequently deployed AI model

Provisions interpreted

• Art. 6

What it covers

These guidelines explain the mandatory breach notification obligations under Articles 33 and 34 GDPR, including when a controller becomes 'aware' of a breach, what information must be provided to supervisory authorities and data subjects, and how to assess risk and high risk. They include an annex with a flowchart and worked examples of different breach scenarios and who must be notified.

Why it matters

It is the primary operational reference for security and incident response teams and DPOs deciding whether, when and how to notify a personal data breach.

Refer to it when

• responding to a suspected or confirmed data breach
• deciding whether a breach must be notified to a supervisory authority or communicated to data subjects
• handling a cross-border breach involving a lead supervisory authority
• documenting a breach for the internal register required by Article 33(5)

Provisions interpreted

• Art. 33
• Art. 34

What it covers

This is a short quick-reference summary of the EDPB guidelines on personal data breach notification, covering how to identify, document and assess a breach, and when to notify the competent data protection authority and affected individuals, illustrated with simplified examples; the full guidelines carry the detailed analysis.

Why it matters

It offers a fast overview of the breach-notification decision process for practitioners who need a quick answer before consulting the fuller guidelines for detailed examples.

Refer to it when

• needing a quick checklist after discovering a data breach
• deciding at a glance whether a DPA notification is required
• briefing non-specialist staff on breach response steps

Provisions interpreted (from the full document)

• Art. 33
• Art. 34

What it covers

This document, adopted as a version for public consultation, provides practical guidance for designers and users of social media platforms on recognising and avoiding dark patterns that infringe GDPR requirements, covering the account life cycle from registration to closure and an annex categorising dark pattern types.

Why it matters

It gives concrete design-level criteria for assessing whether social media interfaces comply with fairness, transparency and data protection by design obligations, relevant to enforcement against manipulative interface practices.

Refer to it when

• reviewing a social media platform's sign-up or consent flow for manipulative design
• assessing a privacy notice or settings interface against dark pattern categories
• designing account closure or erasure functionality
• evaluating breach notification interfaces for fairness

Provisions interpreted

• Art. 5
• Art. 12
• Art. 25

What it covers

These guidelines interpret Article 23 GDPR on restrictions of data subject rights and controller obligations, covering the requirements for lawful legislative restrictions, the exhaustive grounds on which they may be based, the necessity and proportionality test, the safeguards required, consultation with supervisory authorities, and the consequences of non-observance.

Why it matters

It is the key reference for assessing when and how Member State or Union law may lawfully limit GDPR rights such as access, rectification or erasure, which is essential when analysing national restriction laws.

Refer to it when

• assessing whether a national law restricting data subject rights is GDPR-compliant
• determining what safeguards a restriction must contain
• understanding when a supervisory authority must be consulted on a restriction
• advising on data subject rights after a restriction ends

Provisions interpreted

• Art. 23

What it covers

This document explains the purpose and key concepts of certification under Articles 42 and 43 GDPR, the respective roles of supervisory authorities, certification bodies and the EDPB in approving certification criteria, and how certification criteria should be developed and evaluated, and its Annex 2 sets out a target-of-evaluation framework covering GDPR principles, lawfulness, data subject rights and technical measures.

Why it matters

It is the foundational EDPB guidance on how the voluntary GDPR certification mechanism should operate, relevant to anyone designing, approving or relying on a certification scheme or seal.

Refer to it when

• designing certification criteria for a certification scheme
• understanding the approval process for a European Data Protection Seal
• assessing what a certification body may and may not certify
• considering certification as a factor in an administrative fine

Provisions interpreted

• Art. 42
• Art. 43

What it covers

These guidelines specify the application of Article 40(3) GDPR, explaining how codes of conduct can be used as an appropriate safeguard for international transfers under Article 46(2)(e), including required content, the roles of code owners, monitoring bodies, supervisory authorities and the EDPB, and the adoption process for a transfer-specific code.

Why it matters

It gives organisations a practical route to design and adopt codes of conduct as an alternative to standard contractual clauses or binding corporate rules for framing international data transfers.

Refer to it when

• considering a code of conduct as a transfer mechanism instead of BCRs or standard contractual clauses
• drafting binding commitments for a third-country data importer
• understanding the roles of code owner and monitoring body in a transfer code
• amending an existing GDPR code to also cover transfers

Provisions interpreted

• Art. 40
• Art. 46

What it covers

These guidelines, including their Annex 1, interpret Article 43 GDPR on the accreditation of certification bodies, covering the two accreditation routes, the role of Member States, supervisory authorities and national accreditation bodies, and the detailed legal, structural, resource, process and management system requirements certification bodies must meet.

Why it matters

It is the reference for national accreditation bodies, supervisory authorities and certification bodies establishing a harmonised, GDPR-compliant accreditation scheme under Article 43.

Refer to it when

• setting up or assessing an accreditation scheme for certification bodies
• determining whether a supervisory authority may act as a certification body
• reviewing a certification body's impartiality, resource or complaints-handling arrangements
• understanding the additional requirements a supervisory authority may impose on accreditation

Provisions interpreted

• Art. 43

What it covers

This document sets out a standard application form and the required elements and principles for controller binding corporate rules (BCR-C) under Article 47 GDPR, replacing prior WP29 guidance WP256 rev.01 and WP264, and clarifying the approval process led by a BCR Lead supervisory authority.

Why it matters

It is the operative reference for corporate groups seeking to use BCR-C as an appropriate safeguard for intra-group international transfers and for supervisory authorities assessing such applications.

Refer to it when

• preparing or updating a controller BCR application
• identifying the required content and elements of BCR-C
• determining which supervisory authority is the BCR Lead
• assessing onward transfer and processor obligations within a corporate group's BCR

Provisions interpreted

• Art. 47

What it covers

These guidelines interpret the territorial scope of the GDPR under Article 3, explaining the establishment criterion in Article 3(1) and the targeting criterion in Article 3(2), processing subject to Member State law by virtue of public international law, and the requirement to appoint an EU representative.

Why it matters

It is the primary reference for determining whether a controller or processor, particularly one based outside the EU, is subject to the GDPR for a given processing activity.

Refer to it when

• assessing whether a non-EU company falls within GDPR scope
• distinguishing establishment-based from targeting-based application
• deciding whether an EU representative must be appointed
• evaluating whether offering goods or services or monitoring behaviour triggers Article 3(2)

Provisions interpreted

• Art. 3

What it covers

This document analyses the use of facial recognition technology by law enforcement authorities, covering the technology's functions and risks, and the applicable legal framework under the EU Charter of Fundamental Rights and the Law Enforcement Directive, including lawfulness, special category data, automated decision-making, data subject rights and safeguards such as DPIAs, prior consultation and logging, illustrated with practical scenarios.

Why it matters

It is the primary EDPB guidance setting out when and how facial recognition may lawfully be deployed by police and other law enforcement authorities, addressing a technology with significant fundamental rights impact.

Refer to it when

• assessing the lawfulness of a proposed law enforcement FRT deployment
• conducting a necessity and proportionality analysis for biometric surveillance
• determining whether a DPIA or prior consultation is required for FRT
• evaluating data subject rights limitations in a law enforcement biometric processing context

Provisions interpreted

• Art. 4
• Art. 8
• Art. 10
• Art. 11

What it covers

These guidelines explain the purpose and benefits of codes of conduct under Articles 40 and 41 GDPR, the admissibility and approval criteria for national and transnational codes, the accreditation requirements for monitoring bodies that oversee compliance, and the procedures for approval, monitoring, and revocation.

Why it matters

It is the primary EDPB reference for organisations or sector bodies wishing to develop, submit or monitor a GDPR code of conduct, and for supervisory authorities assessing such submissions.

Refer to it when

• drafting a code of conduct for approval
• assessing whether a code meets GDPR approval criteria
• seeking accreditation as a monitoring body
• understanding the transnational code approval process involving the Board

Provisions interpreted

• Art. 40
• Art. 41

What it covers

These guidelines analyse the technical scope of Article 5(3) of the ePrivacy Directive, identifying the three key elements for its applicability - information, terminal equipment, and storage or gaining access - and applying that analysis to specific tracking use cases including URL and pixel tracking, local processing, IP-only tracking, IoT reporting, and unique identifiers.

Why it matters

It updates and extends the WP29's device fingerprinting opinion to modern tracking techniques, helping organisations determine when consent is required under the ePrivacy Directive for technologies that replace or supplement cookies.

Refer to it when

• assessing whether a new tracking technology falls within Article 5(3) ePD
• evaluating consent requirements for pixel or URL tracking
• determining whether IP-only or IoT-based tracking requires consent
• designing cookieless tracking solutions

What it covers

These guidelines apply GDPR requirements to the processing of personal data through video devices, covering scope and the household exemption, lawful bases including legitimate interest and consent, disclosure of footage to third parties and law enforcement, processing of biometric data captured by cameras, data subject rights, layered transparency notices, storage periods and technical and organisational measures.

Why it matters

It is the primary reference for organisations deploying CCTV or smart camera systems to determine lawful basis, transparency and safeguards, including for biometric analytics such as facial recognition.

Refer to it when

• designing or auditing a CCTV or video surveillance deployment
• assessing whether the household exemption applies to a home camera
• evaluating the legal basis for smart cameras using biometric analytics
• drafting layered privacy notices for camera-monitored areas

Provisions interpreted

• Art. 6
• Art. 9

What it covers

These guidelines interpret the Article 25 obligation of data protection by design and by default, analysing the design and default elements of Article 25(1) and (2), and explaining how to implement each of the Article 5 data protection principles through design and default measures, with additional sections on certification and enforcement.

Why it matters

It is the principal reference for translating the GDPR's abstract principles into concrete technical and organisational design choices when building or configuring systems that process personal data.

Refer to it when

• designing a new product or service that processes personal data
• reviewing default privacy settings
• advising engineering teams on embedding data protection principles
• assessing whether a legacy system meets Article 25 requirements

Provisions interpreted

• Art. 25

What it covers

This document is a short quick-reference summary of the obligation to implement data protection by design and by default under Article 25 GDPR, covering when to act, the four assessment factors, the four dimensions of default data minimisation, and a practical action checklist; the full guidelines carry the detailed legal analysis.

Why it matters

It gives organisations, particularly small businesses, an accessible checklist for applying Article 25 obligations without needing to work through the full guidelines first.

Refer to it when

• quickly orienting staff on data protection by design and default duties
• checking default settings against the four necessity dimensions
• using the action checklist during procurement or system design
• before consulting the full guidelines for detailed analysis

Provisions interpreted (from the full document)

• Art. 25

What it covers

This document provides detailed interpretation of the concepts of controller, joint controller, processor and third party/recipient under the GDPR, and explains the consequences of these roles, including the required content of processor contracts under Article 28 and the arrangements joint controllers must put in place under Article 26.

Why it matters

Correctly identifying controller, joint controller and processor roles determines which party bears which GDPR obligations, making this a foundational reference for structuring data processing relationships and contracts.

Refer to it when

• determining whether an entity is a controller, joint controller or processor
• drafting or reviewing a data processing agreement
• allocating responsibilities in a joint controllership arrangement
• assessing whether a processor has become a controller by exceeding instructions

Provisions interpreted

• Art. 4
• Art. 26
• Art. 28

What it covers

These guidelines clarify the scope and objective of Article 48 GDPR, which governs recognition or enforcement of third country judgments and decisions requiring disclosure of personal data, and set out the conditions under which controllers and processors in the EU may respond to such requests, including compliance with Article 6 and Chapter V of the GDPR.

Why it matters

It is the key reference for organisations facing direct requests from foreign courts or authorities for personal data, clarifying that such disclosures are transfers requiring both a legal basis and a transfer ground.

Refer to it when

• receiving a request from a third country court or regulator for personal data
• assessing whether an international agreement provides a valid basis for disclosure
• determining which transfer ground applies to a disclosure request
• distinguishing Article 48 situations from other cross-border data flows

Provisions interpreted

• Art. 48

What it covers

These guidelines, published in a consultation version, explain the legal definition and objectives of pseudonymisation under the GDPR, its role in meeting data minimisation, purpose limitation, security and data protection by design obligations, and its use as a supplementary measure for international transfers. They also set out technical measures and safeguards for pseudonymising transformations and for preventing unauthorised attribution or linkage of pseudonymised data.

Why it matters

It provides controllers and processors with detailed technical and legal criteria for using pseudonymisation effectively to reduce risk and support compliance, an area where the GDPR definition had previously received limited detailed guidance.

Refer to it when

• designing a pseudonymisation scheme to reduce processing risk
• relying on pseudonymisation to support a legitimate interest assessment
• using pseudonymisation as a supplementary measure for international data transfers
• assessing security measures needed to prevent re-identification

Provisions interpreted

• Art. 4
• Art. 25
• Art. 32