European Data Protection Board
European UnionThe EU body that ensures consistent application of the GDPR across Member States, issues guidelines, opinions and binding decisions, and coordinates national supervisory authorities.
- Jurisdiction (head office)
- European Union
- Scope covered
- EU / EEA
- Type
- Oversight / coordination body
- GRC discipline
- Data protection & privacy
- Statutory / official basis
- Regulation (EU) 2016/679 (GDPR), Art. 68–76
- Status
- Current — verified 15 September 2026
- Members
- The heads of the EU/EEA national supervisory authorities and the European Data Protection Supervisor.
- Secretariat and seat
- Secretariat provided by the EDPS; Brussels.
Why it matters
The EDPB is where EU data-protection interpretation is settled. It issues the guidelines and recommendations national authorities apply (GDPR Article 70), resolves disputes between authorities with binding decisions (Article 65), and adopts the consistency opinions that shape cross-border enforcement. For UK practitioners the position needs stating plainly: EDPB guidance is not binding in the UK — the UK left the consistency mechanism on exit, and the ICO is not a member. But it remains hard to do UK work without it. Pre-exit Article 29 Working Party and EDPB guidelines are part of the interpretive backdrop to UK GDPR, ICO guidance frequently covers the same ground with the same conclusions, and any UK organisation with EU establishments or EU-facing processing answers to authorities who do apply EDPB positions.
Where UK and EDPB positions diverge — as the Data (Use and Access) Act 2025 now makes more likely on automated decision-making and legitimate interests — the divergence is the thing to track, not a reason to read less. Current work in progress includes the common European DPIA template (in public consultation, 2026) and the updated Processor BCR recommendations (Recommendations 1/2026, consulted January–March 2026); the DPIA template is listed in our Publications directory.