Template for Cross-Regulatory Cooperation Agreements

It also seeks to promote best practices as regards cross-regulatory governance and cooperation, an objective underlined during the recent Helsinki high-level meeting. More specifically, this Template pursues the commitment in the Helsinki Statement to foster “structured cooperation with other regulators to share experiences and to address legal and practical challenges to cross- regulatory cooperation on concrete cases”. 2 1 EDPB Strategy for 2024 – 2027, Pillar 3 “Safeguarding data protection in the developing digital and cross-regulatory landscape”, accessible here: < https://www.edpb.europa.eu/system/files/2024-04/edpb_strategy_2024-2027_en.pdf >.

EDPB, The Helsinki Statement on enhanced clarity, support and engagement: A fundamental rights approach to innovation and competitiveness , adopted on 2 July 2025, accessible here: <https://www.edpb.europa.eu/system/files/2025-07/edpb-statement- 20250702-enhanced-clarity-support-engagement_en_0.pdf >. 3 | Adopted COOPERATION AGREEMENT 3 between [DPA] and [Other competent authority] 4 (together, ‘the Signatories’) [PREAMBLE] 5 CHAPTER I INTRODUCTORY PROVISIONS Article 1 Definitions 6 In this Agreement, the following terms will 7 have the following meanings: […] Article 2 Legal Framework 8 This Agreement will apply in accordance with and without prejudice to applicable laws and regulations, in particular [to be included] 9 . Article 3 Purpose of the Agreement The purpose of this Agreement is to set out a framework for cooperation between the Signatories in order to facilitate the effective performance of their respective statutory tasks in a coherent manner.

The title that is chosen for the agreement might vary, depending on the practices in the respective Member States, e.g. whether the use of a certain title might indicate a more/less binding nature. Possible (other) titles could be for example: “Memorandum of Understanding”, “Rules of Procedure” or “Cooperation Protocol”.

This Template is primarily designed for agreements between two parties (i.e. the DPA and another competent authority). In principle, it might also be used for agreements between multiple parties.

The preamble can be used to contextualise the agreement with references to its background and objectives. It may include references to the applicable legal framework, references to national legal bases allowing the authority to conclude cooperation agreements, policy context and rationale for cooperation, recognition of overlapping or complementary competences, the obligations and roles of each party within the context of the cooperation agreement, or an overview of the purpose of the cooperation agreement. Many of these points are also addressed later in the template.

To be added only if necessary.

For the purpose of this Template, the verb “will” was considered appropriate. Signatories may need to change this verb to something more binding (e.g., “shall” or “must”) or less binding (e.g., “should” or “may”).

The Signatories may wish to add specific considerations relating to the specific legal context at hand.

E.g., Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, pp. 1–88 or references to specific provisions in the respective Member State law. 4 | Adopted Article 4 Principles of Cooperation (1) The Signatories commit to working together to ensure effective regulatory coordination. They commit to assisting each other, in full mutual respect, in carrying out their tasks, taking any appropriate measure to ensure fulfilment of their obligations and refraining from any measure which could jeopardise the attainment of the objectives set out in their and the other Signatory’s statutory tasks.

(2) The Signatories agree that cooperation under this Agreement will not have the effect of modifying their statutory tasks and powers or of affecting their responsibility for the performance of their statutory tasks. CHAPTER II COOPERATION Article 5 Regular meetings (1) The Signatories agree to hold regular joint meetings. The purpose of these meetings is to […].

(2) The meetings will be held [define periodicity: annually/biannually/monthly]. (3) The meetings will be attended by […].

(4) The Signatories will take turns hosting and organising the regular meetings. (4) The invitation to the meetings will be sent out no later than [define notice: one week/one month] before the meeting. The organising Signatory will prepare an agenda for the meeting and provide it to the other Signatory [define notice, if desired] in advance of the meeting. (5) The meetings can be held either remotely or in-person. Article 6 Ad hoc meetings (1) Either Signatory may convene an ad hoc meeting if circumstances so require. This applies particularly in the event of [specific scenario].

(2) Ad hoc meetings are held and organised by the Signatory convening the meeting. The organising Signatory invites the other Signatory and provides the agenda as well as the organisational details 14 of the meeting as early as possible in advance of the meeting. 10 See Judgement of the Court of Justice of 4 July 2023, Meta Platforms Inc and Others v Bundeskartellamt , C-252/21, ECLI:EU:C:2023:537, paragraph 53. 11 If desired, the purpose or content of the meetings could be further specified here, e.g., discussions on ongoing cases, current developments, general questions on a specific topic, etc. 12 If included, this subparagraph may specify which persons would attend the meetings (e.g., commissioner level or working level). 13 Here, Signatories may further specify under which conditions ad hoc meetings can or should be held. This enables the Signatories to limit ad hoc meetings to, for example, “urgent circumstances”. Reference to the rules on ad hoc meetings in Article 6(2) may also be made in the context of other specific provisions in the Agreement (see, for example, Article 11(5) of this Template).

Organisational details could include the required attendance (e.g., working level or commissioner level), whether the meeting is to be held in-person or remote, etc. 5 | Adopted Article 7 Exchange of knowledge (1) The Signatories will exchange knowledge on a regular basis to further enhance their understanding of each other’s area of competence and thereby foster effective cooperation. (2) To that end, each Signatory will 15 a) deliver regular training sessions and workshops to the other Signatory on matters relating to its fields of expertise; b) facilitate the temporary exchange or secondment of staff members, subject to its applicable legal and internal requirements; c) […] Article 8 Joint guidance and events (1) The Signatories will cooperate to identify the need for, and to develop, joint policy positions, guidance or best practices on issues of common interest related to their competences. (2) The Signatories will cooperate to identify the need for, and to organise, joint events or public outreach in areas relating to the competences of both Signatories. Article 9 Referral of cases and parties 16 (1) Where a Signatory is approached by an interested party whose questions or concerns fall exclusively or primarily within the competence of the other Signatory, it will direct that interested party to the other Signatory and provide the relevant contact information. (2) Where a Signatory establishes that a case falls exclusively or primarily within the other Signatory’s competence, it will refer the case to that Signatory and abstain from pursuing the case, unless it is prevented from doing so under the applicable legal framework. 17 Article 10 Exchange of information 18 (1) If not prevented from doing so by legal restrictions on the disclosure of information, the Signatories will inform each other of facts and information of which they become aware in the exercise of their tasks when such facts or information are deemed relevant for the tasks and duties of the other Signatory, in particular for opening administrative procedures and

If Signatories wish to do so, they can use this paragraph to list the formats they would like to use to achieve their goal of training and/or knowledge exchange. The formats provided for in this Template serve as examples of typical formats found in existing cooperation agreements in the Member States. If desired, the listed formats could then be further outlined and/or specified in designated provisions or subparagraphs.

The subparagraphs in this article are designed to be complementary. The first subparagraph relates to a situation in which the signatory is approached by an interested party outside of enforcement proceedings. This may, for example, be an information request, or a request for clarification of the interpretation of a legal provision. The second subparagraph relates specifically to a situation in which the Signatory establishes, during an enforcement procedure, that the case falls under the competence of the other Signatory. This may happen when, for example, an investigation by a competition law authority leads to the conclusion that the conduct in practice is primarily regulated by data protection rather than competition law.

If the applicable legal framework is clear on this point, it may be unnecessary to add this qualifying clause. Whilst the Template must remain general and applicable in all Member State jurisdictions, the Signatories will conclude the agreement in a concrete context. In the interest of legal certainty, it is advisable to check possible limitations deriving from the legal framework to the obligations established in the Template before concluding the agreement so as to adjust the relevant provisions accordingly, as highlighted in the introduction.

The subparagraphs of this article are designed to be either complementary or alternative. They can be retained as is, but – with minor adjustments – individual subparagraphs can be removed so that the article provides exclusively for information sharing on specific cases, or information sharing along general lines. 6 | Adopted investigations into possible violations of legislation in the competence of the receiving Signatory. (2) In particular, [Signatory 1] will inform [Signatory 2] in case of [include specific circumstances 19 . [Signatory 2] will inform [Signatory 1] in case of [include specific circumstances]. [Additional option: The Signatory sharing information with the other Signatory commits to inform the party under investigation about the sharing of information collected from that party during legal proceedings, and, if necessary, to obtain authorisation from that party before the sharing.] 20 (3) Without prejudice to paragraph (1), and unless prevented from doing so according to legal restrictions on the disclosure of information, 21 the Signatories will maintain a regular exchange of non-confidential information on their activities and general lines of action. (4) Pursuant to [legal basis for information sharing] [Signatory 1] will provide data and information to [Signatory 2] insofar as this is necessary for […]. Article 11 Consultation 22 (1) Where data protection rules and […] 23 apply or are invoked in relation to the same or similar circumstances, in particular in the context of an enforcement case, the Signatories will consult each other to ensure a coherent application of both sets of rules. (2) If either Signatory is called upon, in order to exercise its respective statutory tasks, to assess whether a specific conduct or a similar conduct is consistent with provisions that fall under the other Signatory’s competence, it will first ascertain whether that conduct or similar conduct has already been the subject of a decision by the other Signatory. If that is the case, the respective Signatory cannot depart from that decision. This is without prejudice to each Signatory’s competence to draw its own conclusions from the point of view of the application of its respective field of law. (3) In accordance with subparagraph (1), Signatories may consult each other to ascertain whether there are proceedings pending before the other Signatory regarding the same or a similar conduct. Where a Signatory has doubts as to the scope of the assessment carried out by the other Signatory, where the subject matter in question is simultaneously under examination by the other Signatory, or where, in the absence of investigation by the other Signatory, it takes the view that the conduct or a similar conduct is not consistent with the provisions of […], that fall under the other Signatory’s competence, it must consult and seek the cooperation of the other Signatory in order to dispel its doubts or to determine whether it must wait for the other Signatory to make a decision. (4) The consulted Signatory must respond to the consultation within a reasonable period of time, providing the information in its possession capable of dispelling the consulting Signatory’s doubts as to the scope of the assessment carried out by the consulted Signatory. In the absence of a reply within a reasonable time defined by the consulting Signatory in its request, the consulting Signatory may continue its own investigation. The same applies if the

For example, “opening a case that relates to conduct that also falls within the competence of Signatory 2.”

In some jurisdictions, the competent authority will be required to inform the party under investigation (or to obtain a waiver) before sharing information. In such cases, the signatories should consider adding this sentence.

See Footnotes 17 and 25 on the inclusion of caveats referring to possible restrictions in respective Member State law.

Cf. Judgment of the Court of Justice of 4 July 2023, Meta Platforms Inc and Others v Bundeskartellamt, C-252/21, ECLI:EU:C:2023:537, paragraph 56 and following.

Here, the respective field of law of the other Signatory (e.g. competition law) should be added. 7 | Adopted consulted Signatory has no objection to such an investigation being continued without having to wait for a decision on its part. (5) Each Signatory may convene an ad hoc meeting pursuant to Article 6(2) if deemed necessary to clarify any ambiguities arising during a proceeding. Article 12 Common enforcement strategy (1) The Signatories may develop a common enforcement strategy. (2) Such a common enforcement strategy will be adopted by mutual agreement and will be reviewed at least every [include] years. (3) The common enforcement strategy may address: (a) […]

(4) The common enforcement strategy, or a summary thereof, may be made public, subject to the agreement of both Signatories. (5) The common enforcement strategy will not be binding on either Signatory and will not limit each Signatory's authority to determine its own enforcement priorities and allocate its own resources. Article 13 Joint procedures (1) The Signatories may, by mutual agreement, if not prevented from doing so according to applicable law 25 [OR: pursuant to [legal basis]], decide to open a joint procedure where the conduct in question falls within the competence of both Signatories. (2) To facilitate the conduct of a joint procedure, the Signatories may establish a joint procedure handling team, composed of designated staff from each Signatory. (3) The Signatories will agree on the practical arrangements governing the operation of the joint procedure, including coordination, information gathering and sharing, joint visits or other on-site activities, and decision-making processes. (4) Each Signatory retains full responsibility for its own investigative acts and procedural decisions. Participation in a joint procedure does not affect each Signatory's independent authority to open or close procedures under its own legal framework. (5) A joint procedure will result in separate decisions, each adopted by the competent Signatory within its own legal framework and in accordance with its applicable procedural rules. 24 For example: “shared or complementary enforcement priorities; sectors, markets, or conduct that warrant coordinated attention; and joint outreach or awareness-raising activities.”

Signatories should reflect on whether qualifying statements such as this one are appropriate in their cooperation agreement. The Template must remain general and applicable in all Member State jurisdictions, whereas the Signatories will conclude the agreement in a concrete context. In the interest of legal certainty, it is advisable to check possible limitations deriving from the legal framework to the obligations established in the Template before concluding the agreement so as to adjust the relevant provisions accordingly, as highlighted in the introduction. 8 | Adopted CHAPTER III DATA PROTECTION AND CONFIDENTIALITY Article 14 Processing of personal data (1) The Signatories will process the personal data related to the performance of this agreement in compliance with Regulation (EU) 2016/679 (the ‘GDPR’) [and/or Regulation (EU) 2018/1725, as applicable] and other applicable laws. (2) Within the scope of this agreement, the legal basis for the processing of personal data is Article 6(1)(e) of the GDPR. (3) The Signatories will, in principle, determine the purposes and means of the processing separately, pursuant to the execution of their individual competences and mandates. To the extent that the Signatories jointly determine the purposes and means of the processing, 26 they agree to determine their respective responsibilities for compliance with the GDPR pursuant to Article 26 GDPR. 27 Article 15 Confidentiality (1) All information exchanged pursuant to this Agreement will be treated as confidential unless specified otherwise. Information exchanged will be marked with an appropriate security classification. (2) The Signatories will inform each other before using non-confidential information received from the other Signatory in proceedings or public communication. If a Signatory intends to use confidential information received from the other Signatory in proceedings or public communication, it will seek an authorisation from that Signatory. 28 CHAPTER IV MISCELLANEOUS Article 16 Evaluation and amendment (1) The Signatories will jointly evaluate this agreement every […] years, starting from its entry into force. They will prepare [and publish] a report with the results of such evaluation. (2) Each Signatory can request an ad hoc evaluation of the agreement. (3) Amendments to this agreement will be made in writing with mutual agreement. Article 17 Suspension and withdrawal 29 (1) The Signatories can partially or fully suspend the operation of this agreement by written letter with a notice period of […] months. (2) The Signatories can withdraw from this agreement by written letter with a notice period of […] months.

This might be the case particularly in the context of joint procedures (Article 13 of this template) of or joint events (Article 8(2) of this template).

Signatories might wish to specify how this agreement should be concluded, for example in an annex to this agreement or a in a separate agreement. In this case the provision could be amended accordingly.

Signatories might wish to remove this second sentence. The requirement to ask for the other Signatory’s permission might conflict with applicable laws obliging the Signatory to act upon certain information.

An additional possibility not provided for in this Template is to require the Signatory suspending or withdrawing from the agreement to state reasons for doing so. Signatories may also wish to specify which grounds may be considered as valid grounds for a suspension or withdrawal (e.g., a change in the legal framework or obligations or budgetary changes). 9 | Adopted Article 18 Financial commitments and costs (1) Each Signatory will bear the costs that it incurs pursuant to this Agreement. (2) This Agreement will not entail any budgetary commitments for either Signatory.

Article 19 Communications and contact persons (1) Except where provided otherwise in this Agreement, the Signatories agree that all communications under the Agreement will take place via [electronic mail].

(2) Each Signatory will designate a contact person responsible for the communication between the Signatories. [ Or (2) The contact persons responsible for the communication between the Signatories are: (a) for Signatory 1: (b) for Signatory 2:] (3) Any changes to the designated contact persons will be communicated promptly. Article 20 Publication and entry into force This agreement will enter into force on the date of its signature by the [Commissioners/Directors/Heads] of the Signatories, and will be published in […]. [Signed] 30 This disclaimer reflects a common practice within the cooperation agreements analysed by the EDPB. Like all the provisions in this Template, it is merely a suggestion subject to change based on the needs of the Signatories. Provisions which may be read as implying budgetary commitments without this disclaimer include the provisions on a common enforcement strategy, joint procedures and joint events. Staff exchanges or secondments may also have indirect budgetary effects. 31 Depending on the practices and requirements in the respective Member States, the Signatories might wish to specify another means of communication to be used, such as (encrypted) email or the use of a specific infrastructure.