# IP Address — legal context bundle

> Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/ip-address
> Sources are cited per item. Verify against the official texts before relying on them.

Internet protocol addresses as personal data

## Overview

## Legal Framework

The classification of IP addresses as personal data flows from [Article 4(1) GDPR](/laws/gdpr/art-4#par-1), which defines personal data as any information relating to an identified or identifiable natural person, directly or indirectly, "in particular by reference to an identifier such as a name, an identification number, location data, an online identifier." Recital 30 makes the link to IP addresses explicit:

> "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags."
> — [GDPR Recital 30](/laws/gdpr/rec-30)

The practical consequence is that collecting, storing, or transmitting an IP address constitutes "processing" under [Article 4(2) GDPR](/laws/gdpr/art-4#par-1), triggering the full suite of GDPR obligations—including lawful basis under Article 6, transparency under Articles 13–14, and security under Article 32. Where the IP address is obtained through access to terminal equipment, the ePrivacy Directive (Article 5(3)) adds a consent requirement before collection occurs, as the EDPB has confirmed that IP addresses fall within that provision's scope.

## Key Developments

The CJEU confirmed in *Bundesverband der Verbraucherzentralen v Planet49* that the Article 4(1) definition of personal data encompasses online identifiers, embedding the broad interpretation into EU precedent. In *Fashion ID*, the Court further noted that embedding third-party content on a website necessarily transmits the visitor's IP address to the third-party server, making the website operator a controller for that transmission.

Dutch courts have applied this reasoning to cookie IDs and analogous identifiers. In the Microsoft/Xandr case, the Rechtbank rejected the argument that a cookie ID alone is insufficient to identify a natural person:

The Norwegian DPA's Grindr decision treated IP addresses alongside GPS data and advertising IDs as personal data requiring a valid lawful basis, fining the company for sharing them without valid consent. The Belgian DPA similarly cited Recital 30 when finding online identifiers fall within the GDPR's material scope.

The EDPB's 2023 guidelines on Article 5(3) ePrivacy Directive clarify the technical threshold: IP addresses originating from a user's terminal equipment trigger the consent requirement, with IPv4 addresses behind CGNAT potentially excluded. The guidelines note that "gaining access to IP addresses would only trigger the application of Article 5(3) ePD in cases where this information originates from the terminal equipment of a subscriber or user."

## Status of the Debate

The core question—whether IP addresses are personal data—is settled at the EU level. Recital 30, Article 4(1), and consistent CJEU and national case law establish that IP addresses are online identifiers capable of indirectly identifying natural persons. What remains actively contested is the boundary: whether dynamic IP addresses behind carrier-grade NAT (CGNAT) qualify, and at what point an IP address held by an intermediary becomes personal data when the intermediary lacks legal means to identify the individual. The EDPB guidelines signal that unless a controller can affirmatively ensure the IP address does not originate from terminal equipment, Article 5(3) ePD applies. A future CJEU reference on CGNAT-specific scenarios would resolve the remaining ambiguity.

## Practical Guidance

- **Treat all IP addresses as personal data by default.** Unless you can demonstrably confirm the address does not originate from a user's terminal equipment (e.g., CGNAT scenarios), apply the full GDPR framework per [Article 4(1)](/laws/gdpr/art-4#par-1) and Recital 30.
- **Obtain ePrivacy consent before collecting IP addresses from terminal equipment.** Article 5(3) of the ePrivacy Directive requires prior informed consent where collection occurs through access to or storage on a user's device, as confirmed by EDPB Guidelines 2/2023.
- **Establish a lawful basis under Article 6 GDPR** for any processing of IP addresses beyond mere transmission. Legitimate interest (Article 6(1)(f)) may suffice for security purposes, but sharing IP addresses with third parties for advertising—per the Grindr decision—typically requires explicit, freely given consent.
- **Minimise retention.** Recital 64 cautions against retaining personal data solely to respond to potential access requests. Apply storage limitation principles to IP logs, retaining only for the duration necessary for the defined purpose.
- **Document your identification analysis.** If you argue an IP address is not personal data in your specific context, record why the holder lacks means to link it to an individual—bearing in mind courts apply a broad, purposive interpretation of "identifiable."

## Legislation (full text of key provisions)

### Recital 30 — online identifiers enabling personal profiling

*Source: GDPR, gdpr-rec-30-en, 2016-04-27 — https://overview.legal/posts/91575*

Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them.

### Recital 64 — data subject identity verification for access

*Source: GDPR, gdpr-rec-64-en, 2016-04-27 — https://overview.legal/posts/91643*

The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.

### Recital 121 — lawful personal data processing for cybersecurity

*Source: NIS2, nis2-rec-121-en, 2022-12-14 — https://overview.legal/posts/96770*

The processing of personal data, to the extent necessary and proportionate for the purpose of ensuring security of network and information systems by essential and important entities, could be considered to be lawful on the basis that such processing complies with a legal obligation to which the controller is subject, in accordance with the requirements of Article 6(1), point (c), and Article 6(3) of Regulation (EU) 2016/679. Processing of personal data could also be necessary for legitimate interests pursued by essential and important entities, as well as providers of security technologies and services acting on behalf of those entities, pursuant to Article 6(1), point (f), of Regulation (EU) 2016/679, including where such processing is necessary for cybersecurity information-sharing arrangements or the voluntary notification of relevant information in accordance with this Directive. Measures related to the prevention, detection, identification, containment, analysis and response to incidents, measures to raise awareness in relation to specific cyber threats, exchange of information in the context of vulnerability remediation and coordinated vulnerability disclosure, the voluntary exchange of information about those incidents, and cyber threats and vulnerabilities, indicators of compromise, tactics, techniques and procedures, cybersecurity alerts and configuration tools could require the processing of certain categories of personal data, such as IP addresses, uniform resources locators (URLs), domain names, email addresses and, where they reveal personal data, time stamps. Processing of personal data by the competent authorities, the single points of contact and the CSIRTs, could constitute a legal obligation or be considered to be necessary for carrying out a task in the public interest or in the exercise of official authority vested in the controller pursuant to Article 6(1), point (c) or (e), and Article 6(3) of Regulation (EU) 2016/679, or for pursuing a legitimate interest of the essential and important entities, as referred to in Article 6(1), point (f), of that Regulation. Furthermore, national law could lay down rules allowing the competent authorities, the single points of contact and the CSIRTs, to the extent that is necessary and proportionate for the purpose of ensuring the security of network and information systems of essential and important entities, to process special categories of personal data in accordance with Article 9 of Regulation (EU) 2016/679, in particular by providing for suitable and specific measures to safeguard the fundamental rights and interests of natural persons, including technical limitations on the re-use of such data and the use of state-of-the-art security and privacy-preserving measures, such as pseudonymisation, or encryption where anonymisation may significantly affect the purpose pursued.

## Case law

### Court rejects DFW request for Ziggo customer IP addresses due to insufficient transparency

*Source: GHARL, 2019-11-05 — https://overview.legal/posts/122859 — original: https://gdprhub.eu/index.php?title=GHARL_-_200.256.426*

Facts — DFW (a Dutch movie distributor) applies a protocol to its processing of personal data which was approved by the Dutch DPA before the GDPR came into force. DFW asked Ziggo (an internet service provider) to provide IP addresses of customers who according to DFW shared movies illegally. Ziggo refused to provide this information. Dispute — Τhe Court had to assess whose interests prevail in this case: DFW's interest in the protection of its intellectual property rights or Ziggo's interest in the protection of the personal data of its customers. Holding — The Court found that any processing needed to be based on legitimate interests according to Article 6(1)(f) GDPR and that Ziggo had to comply with Article 6(4)(d) GDPR. The Court found that DFW had a legitimate interest and that the processing was necessary. However, the Court pursued a balancing exercise between the interests of DFW and the interests of the data subjects and found that the approved protocol was not transparent enough. Thus, the possible consequences for the data subjects of providing their data to DFW could not be estimated. DFW failed to make clear which action it would take, under which circumstances and in which manner it would inform the data subjects of their rights. The Court is of the opinion that the interests of Ziggo's customers are still insufficiently safeguarded, and it, therefore, rejected DFW’s claims confirming the ruling of the Court of First Instance. The Court based its ruling on the national civil code, Articles 4(2) and 6 GDPR, Articles 17 and 47 of the Charter of Fundamental Rights (CFR), and Articles 8 and 13 ECHR.

### IAB Europe v Gegevensbeschermingsautoriteit

*Source: Court of Justice of the European Union, C-604/22, 2024-03-07 — https://overview.legal/posts/132270 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0604*

In Case C-604/22, the Court of Justice of the European Union ruled on a preliminary reference from the Brussels Court of Appeal in proceedings between IAB Europe and the Belgian Data Protection Authority (Gegevensbeschervingsautoriteit) concerning whether IAB Europe's "Transparency and Consent String" (TC String)—a coded string capturing users' consent preferences—constitutes personal data under GDPR Article 4(1) and whether IAB Europe qualifies as a (joint) controller under Article 4(7). The Court held that the TC String constitutes personal data because it can be linked to an identifiable natural person through reasonably likely means, and that IAB Europe, as a standard-setting sectoral organization determining purposes and means of processing through its framework, acts as a controller even without direct access to the data, with its responsibility extending to subsequent processing by third parties that it does not mandate but facilitates through its rules. No fine was imposed in this preliminary ruling, as the underlying Belgian DPA decision and any sanctions remain before the national court.

### CE - N. 433539

*Source: Supreme Administrative Court, 2026-04-30 — https://overview.legal/posts/122869 — original: https://gdprhub.eu/index.php?title=CE_-_N._433539*

Facts — Several digital rights organisations asked the Prime Minister to repeal Decree No. 2010-236 of 5 March 2010. The decree regulated an automated personal data processing system used by the French authority for freedom of communications (ARCOM, hereinafter the French authority) for France’s online copyright enforcement mechanism, known as the graduated response procedure. Under this system, the French authority could receive IP addresses linked to alleged copyright infringements and request the corresponding subscriber identity data from electronic communications operators. This data could then be used to send warnings to subscribers and, in repeated cases, refer the matter to the public prosecutor. The applicants argued that the decree allowed the French authority to access personal data linked to IP addresses without sufficient safeguards under EU law. The court had previously referred questions to the CJEU, which ruled in Case C-470/21 that such access may be allowed, but only under strict conditions. Following the CJEU judgment, the court reviewed whether the French decree complied with EU law. Holding — The court partly upheld the action. First, the court held that EU law allows the general and indiscriminate retention of IP addresses for combating criminal offences in general only where serious interference with private life is effectively excluded. This requires strict separation between different categories of retained data, secure technical safeguards and regular monitoring by an independent public authority. The court found that French law did not require electronic communications operators to retain subscriber identity data and IP-related data under these conditions. Therefore, the decree was unlawful insofar as it allowed the French authority to process data that had not necessarily been retained in compliance with EU-law safeguards. Second, the court held that the French authority may access subscriber identity data linked to IP addresses in order to identify persons suspected of online copyright infringements and send the first two warnings under the graduated response procedure. However, the court distinguished the third access to such data. At that stage, the authority is no longer dealing with an isolated identification request: it has already linked the same person’s identity twice with alleged unlawful online activity and with the protected works concerned. A third access therefore allows the authority to build a more detailed picture of the person’s conduct and may reveal sensitive aspects of their private life. It also marks a more serious procedural stage, since it may lead to a registered letter and ultimately to referral to the public prosecutor. For that reason, EU law requires prior authorisation by a court or an independent administrative body before this third access takes place. The decree did not provide for such prior review, so the court held that it was unlawful to that extent. For this third access, EU law requires prior authorisation by a court or an independent administrative body. The decree did not provide for such prior review. The court therefore held that the decree was unlawful to that extent. The court annulled the Prime Minister’s refusal to repeal the unlawful parts of the decree and ordered their repeal. It also held that the French authority must stop applying the unlawful provisions. However, the French authority may still access identity data for the first and second warnings, and may request access in serious copyright offence cases under the conditions set out in the judgment.

### Data Protection Commissioner v Facebook Ireland and Maximillian Schrems

*Source: CJEU, C-311/18, 2020-07-16 — https://overview.legal/posts/51470 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311&ref=51470*

Invalidated Privacy Shield adequacy decision and upheld validity of Standard Contractual Clauses with additional safeguards required.

### European Data Protection Supervisor v Single Resolution Board

*Source: Court of Justice of the European Union, C-413/23, 2025-09-04 — https://overview.legal/posts/132136 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0413*

The European Data Protection Supervisor (EDPS) appealed a General Court judgment that annulled its decision finding the Single Resolution Board (SRB) had failed to fulfil its obligations under Regulation (EU) 2018/1725 regarding the processing of personal data in a banking resolution compensation procedure. The core legal issues concerned whether pseudonymised data transmitted to a third party constitutes "personal data" under Article 3(1), the proper interpretation of "pseudonymisation" under Article 3(6), and the scope of the controller's obligation to inform data subjects under Article 15(1)(d). The Court of Justice (First Chamber) ruled on these interpretive questions in deciding whether to set aside the General Court's judgment.

### La Quadrature du Net and Others v Premier ministre and Ministère de la Culture

*Source: Court of Justice of the European Union, C-470/21, 2024-04-30 — https://overview.legal/posts/132259 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0470*

In Case C-470/21, the CJEU addressed a preliminary reference from the French Conseil d'État concerning La Quadrature du Net and others v. Premier ministre and Ministre de la Culture, which challenged France's "graduated response" system allowing public authorities to access civil identity data associated with IP addresses retained by ISPs for the purpose of combating online copyright infringement. The Court ruled that while such access may be justified under Article 15(1) of Directive 2002/58/EC (the ePrivacy Directive) for intellectual property protection, it requires strict safeguards including prior review by a court or independent administrative body, and must be limited to what is strictly necessary, proportional, and subject to substantive and procedural protections against abuse. No fine was imposed as this was a preliminary ruling.

### BGH: GDPR not exhaustive on injunctive relief; online store data transfer case remanded

*Source: Federal Court of Justice, 2026-07-21 — https://overview.legal/posts/354169 — original: https://gdprhub.eu/index.php?title=BGH_-_VI_ZR_144/23*

Facts — The operator of an online store (the controller) had embedded third-party features in its website. As a result of this practice, the data of users accessing the website (the data subjects) was stored on servers operated by third parties. A data subject who had ordered goods from the controller's online store argued that his name, address, IP address, and numerous pieces of usage data from the ordering process had been unlawfully transferred to third parties. The data subject filed a lawsuit requesting an injunction to stop these transfers of personal data. The court of first instance dismissed the lawsuit on the grounds that it was inadmissible due to a lack of specificity. It also held the lawsuit was without merit. The data subject appealed this decision. The court of appeals dismissed the data subject's claim in March 2023: it held that the provisions of the GDPR are exhaustive and that national law may only be invoked if an opening clause is provided for in the GDPR. There was no applicable opening clause concerning injunctive relief. The data subject subsequently appealed the case further to the Federal Court of Justice. Holding — The Federal Court of Justice set the appealed decision aside and referred the case back to the court of appeals for a new hearing and decision. First, the court stated that the court of appeals had correctly found the lawsuit admissible. The requirement of sufficient specificity was met, as it was unambiguous which conduct of the controller was to be prohibited. The data subject was undoubtedly seeking legal protection to prohibit the controller from designing websites in a way that leads to unlawful transfers of personal data to third parties. Second, the court held that the claim for injunctive relief could not be denied on the merits. It found that the court of appeals had been incorrect in assuming that a claim for an injunction regarding the unlawful transfer of personal data was precluded under national law because the provisions of the GDPR are exhaustive. The court referred to the CJEU's decision in the case C-655/23 Quirin Privatbank, where the CJEU held that the GDPR does not prevent Member States from providing a legal remedy requiring the controller to refrain from further unlawful processing on a national level . The court emphasised such remedies may improve the level of protection for data subjects. It could therefore not be ruled out that the plaintiff could be entitled to an injunction under national law. Moreover, it could not be assumed that the data subject could have achieved their objective of preventing unlawful transfers of their personal data to third parties by asserting any of the data subject rights provided for in the GDPR, particularly the right to erasure laid down in Article 17 GDPR.

### Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija

*Source: Court of Justice of the European Union, C-683/21, 2023-12-05 — https://overview.legal/posts/132280 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0683*

The CJEU Grand Chamber issued a preliminary ruling in Case C-683/21, arising from a dispute between Lithuania's National Public Health Centre (NVSC) and the State Data Protection Inspectorate (VDAI) regarding a fine imposed for GDPR infringements related to a mobile IT application. The Court addressed the interpretation of key GDPR concepts including "processing," "controller," joint control under Article 26, and the conditions for imposing administrative fines under Article 83, particularly the requirement that infringements be intentional or negligent and the liability of controllers for processing carried out by processors. No specific fine amount was addressed in this portion of the judgment, as the ruling provides interpretive guidance to the referring Lithuanian court rather than resolving the underlying penalty.

### Proceedings brought by J.M

*Source: Court of Justice of the European Union, C-579/21, 2023-06-22 — https://overview.legal/posts/132284 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0579*

In Case C-579/21, the Court of Justice of the European Union ruled on a preliminary reference from the Itä-Suomen hallinto-oikeus (Administrative Court of Eastern Finland) concerning a dispute between J.M. and Pankki S, a Finnish bank, after the Apulaistietosuojavaltuutettu (Assistant Data Protection Supervisor) rejected J.M.'s request for access to certain log data. The core issue was the scope of the right of access under Article 15 of the GDPR, specifically whether log data containing information about who accessed personal data and when constitutes "personal data" and whether the controller must communicate the identities of recipients. The Court held that log data relating to consultations of a data subject's personal data constitutes personal data under Article 4(1) of the GDPR, and that a data subject is entitled to obtain the identities of recipients of their data, subject only to exceptions expressly provided by law or overriding rights of third parties. No fine was imposed as this was a preliminary ruling proceeding.

### OLG München - 36 U 1054/25 e

*Source: Higher Regional Court Munich, 2026-06-26 — https://overview.legal/posts/184545 — original: https://gdprhub.eu/index.php?title=OLG_München_-_36_U_1054/25_e*

Facts — The data subject had used a social media platform operated by the controller, an Irish company, since 2013. The controller provided “Business Tools” to third-party website operators and app providers. These tools enabled the controller to obtain data concerning how users interacted with third-party websites and apps, including information about page visits, purchases and advertisements clicked. In November 2023, the data subject requested that the controller recognize that the processing of his personal data was contrary to the parties’ contract, erase or anonymize the personal data, provide access to the personal data and pay compensation. The data subject subsequently brought an action before the Regional Court of Munich II, seeking a declaration that the parties’ user contract did not permit the processing, cessation of the processing of personal data collected through the Business Tools on third-party websites and apps, restriction of further processing, erasure or anonymization of previously collected data and at least €5,000 in non-material damages. The relevant data included direct and indirect identifiers, such as his name, contact details, IP address and internal identifiers, as well as website URLs, visit times, app names and information about his interactions with websites and apps. The Regional Court of Munich II dismissed the action, holding that the declaratory and erasure or anonymization claims were inadmissible, the cessation claims were legally unavailable and the damages claim had not been sufficiently substantiated. In relation to the damages claim, it found that the data subject had not identified specific third-party websites or apps through which his personal data had been processed. The data subject accordingly appealed to the Higher Regional Court of Munich. Holding — The Higher Regional Court of Munich partially upheld the appeal. First, the court held that the Controller processed the data subject’s personal data under Articles 4(1) and 4(2) GDPR by receiving data transmitted through its Business Tools, associating it with a user account and storing it. The data subject was not required to identify every website, app or individual transmission because the relevant information was principally within the controller’s knowledge and it was sufficiently probable that he had been affected. Second, referring to CJEU C‑40/17 concerning the broad interpretation of “controller”, the court held that the controller was a joint controller under Articles 4(7) and 26 GDPR for the collection and transmission of the personal data. It controlled the programming of the Business Tools and participated in determining the purposes and means of processing. Allocating certain obligations to third-party website and app operators did not remove its responsibility. Third, referring to CJEU C‑252/21, the court held that the controller had not established a lawful basis for the processing of the personal data. The processing was not justified by consent under Article 6(1)(a), contractual necessity under Article 6(1)(b), a legal obligation under Article 6(1)(c), a public-interest task under Article 6(1)(e), or legitimate interests under Article 6(1)(f) GDPR. Accordingly, the court held that the controller's processing infringed Articles 5(1)(a), 5(1)(b), 5(1)(c) and 6 GDPR. Relying on CJEU C‑655/23, the court granted an injunction against future unlawful processing under German law. It also ordered restriction pending erasure under Article 18(1)(b) and erasure under Article 17(1)(d) GDPR. The court upheld the dismissal of the separate declaratory claim and also rejected anonymization of the website and app interaction data. Finally, relying on BGH VI ZR 10/24, the court awarded €1,500 in non-material damages under Article 82(1) GDPR for the data subject’s loss of control over his personal data.

### HvJ EU 9 januari 2025, C‑394/23 (Mousse).

*Source: CJEU, 2025-01-09 — https://overview.legal/posts/50377 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0394*

HvJ EU 9 januari 2025, C‑394/23 (Mousse). Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20 (Vyriausioji tarnybinės etikos komisija), maar dat had hier ook heel logisch geweest.

### RK v Ministerstvo zdravotnictví

*Source: Court of Justice of the European Union, C-659/22, 2023-10-05 — https://overview.legal/posts/132282 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0659*

The Court of Justice of the European Union issued a preliminary ruling in Case C-659/22, RK v Ministerstvo zdravotnictví, addressing whether the use of a mobile application to verify EU Digital COVID Certificates constitutes "processing" of personal data under Article 4(2) of the GDPR. The request originated from the Czech Supreme Administrative Court in the context of the Ministry of Health's extraordinary COVID-19 access measures. The Court's judgment clarifies the interpretation of the concept of "processing" within the scope of Regulation (EU) 2016/679 as it applies to the verification of COVID certificates issued pursuant to Regulation (EU) 2021/953.

## Guidance

### Guidelines 07/2020 on the concepts of controller and processor in the GDPR

*Source: EDPB, edpb-guidelines-on-the-concepts-of-controller-and-processor-in-the-gdpr, 2021-07-07 — https://overview.legal/posts/38069 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en*

The concepts of controller, joint controller and processor play a crucial role in the application of the General Data Protection Regulation 2016/679 (GDPR), since they determine who shall be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. The precise meaning of these concepts and the criteria for their correct interpretation must be sufficiently clear and consistent throughout the European Economic Area (EEA). The conc...

### Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679

*Source: EDPB, edpb-guidelines-on-codes-of-conduct-and-monitoring-bodies, 2019-06-04 — https://overview.legal/posts/38051 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-12019-on-codes-of-conduct-and-monitoring-bodies-under-regulation_en*

The European Data Protection Board (EDPB) issued these guidelines to clarify the framework for codes of conduct and monitoring bodies under Articles 40 and 41 of the GDPR. The guidelines address the admissibility, content, and approval requirements for draft codes of conduct, as well as the criteria and accreditation process for monitoring bodies responsible for verifying compliance with such codes. This version (2.0) was adopted on 4 June 2019 following public consultation.

### Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)

*Source: EDPB, edpb-guidelines-on-the-territorial-scope-of-the-gdpr, 2019-11-12 — https://overview.legal/posts/38074 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-32018-on-the-territorial-scope-of-the-gdpr-article-3-version-adopted_en*

The European Data Protection Board (EDPB) issued Guidelines 3/2018 to clarify the territorial scope of the GDPR under Article 3, addressing the "establishment" criterion in Article 3(1), the "targeting" criterion in Article 3(2), and the representative requirements under Article 27. The guidelines emphasize that Article 3 applies to specific processing activities rather than to legal entities as a whole, meaning a single controller or processor may have some processing activities subject to the GDPR and others not. The EDPB adopted Version 2.0 on 12 November 2019 following public consultation, providing detailed interpretation to ensure consistent application by data protection authorities across the EU.

### Guidelines 8/2020 on the targeting of social media users

*Source: EDPB, edpb-guidelines-on-the-targeting-of-social-media-users, 2021-04-13 — https://overview.legal/posts/38073 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en*

The EDPB adopted Guidelines 8/2020 on the targeting of social media users to clarify the roles, responsibilities, and legal obligations of the various actors involved in social media targeting, including social media providers, targeters, and users. The guidelines analyze different targeting mechanisms—based on provided, observed, and inferred data—and address controller determinations, legal bases, transparency requirements, DPIAs, and the processing of special categories of data. No fines are imposed, as this is interpretive guidance intended to assist stakeholders in achieving GDPR compliance.

### Guidelines 05/2020 on consent under Regulation 2016/679

*Source: EDPB, edpb-guidelines-on-consent, 2020-05-04 — https://overview.legal/posts/38053 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en*

The European Data Protection Board (EDPB) adopted Guidelines 05/2020 on consent under Regulation 2016/679 to provide detailed interpretive guidance on the requirements for valid consent under the GDPR, including the elements of freely given, specific, informed, and unambiguous consent, as well as the conditions for explicit consent and the obligation to demonstrate consent. The guidelines address practical issues such as power imbalances, conditionality, granularity, detriment, and the minimum content requirements for informing data subjects. No fines are imposed, as this is a guidance document rather than an enforcement decision.

### Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation

*Source: EDPB, edpb-guidelines-on-certification-and-identifying-certification-criteria, 2019-06-04 — https://overview.legal/posts/38048 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-12018-on-certification-and-identifying-certification-criteria-in_en*

The EDPB issued Guidelines 1/2018 to clarify the framework for data protection certification and the identification of certification criteria under Articles 42 and 43 of the GDPR. The guidelines address key concepts such as the interpretation of "certification," the roles of supervisory authorities and certification bodies, and the process for approving certification criteria. This document provides practical guidance to stakeholders on how GDPR certification mechanisms, seals, and marks should be established and operated.

### Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020

*Source: EDPB, edpb-guidelines-on-data-protection-by-design-and-by-default, 2020-10-20 — https://overview.legal/posts/38054 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-42019-on-article-25-data-protection-by-design-and-by-default_en*

The European Data Protection Board (EDPB) adopted these guidelines (Version 2.0) to provide interpretive guidance on Article 25 of the GDPR, which mandates data protection by design and by default. The guidelines address controllers' obligations to implement appropriate technical and organizational measures and necessary safeguards into processing operations, including the dimensions of data minimization required by default. No fines or enforcement actions are at issue, as this is a guidance document intended to assist controllers in complying with their Article 25 obligations.

### Guidelines 01/2022 on data subject rights - Right of access

*Source: EDPB, edpb-guidelines-on-data-subject-rights---right-of-access, 2023-04-17 — https://overview.legal/posts/38055 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en*

The right of access of data subjects is enshrined in Art. 8 of the EU Charter of Fundamental Rights. It has been a part of the European data protection legal framework since its beginning and is now further developed by more specified and precise rules in Art. 15 GDPR.

## Enforcement decisions

### DSB (Austria) - 2026-0.043.390

*Source: DSB (Austria), 2026-01-16 — https://overview.legal/posts/144040 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_2026-0.043.390*

Facts — Following the first COVID-19 outbreak in March 2020, a limited liability company (the controller) decided to offer protective masks to the general public. It set up an online shop within a few days and made it publicly accessible to its customers on 28 March 2020. On 1 April 2020, a customer (the data subject) visited the controller’s online shop. They discovered that it had placed 14 cookies on their device without displaying any cookie consent banner. The customer lodged a complaint with the North Rhine-Westphalian DPA, arguing that the cookies had been stored on their device without prior opportunity for refusal. The German authority transmitted the complaint to the Austrian DPA (DSB). The controller acknowledged that, because the online shop had been set-up rapidly, it did not yet meet all technical requirements at the time of the customer’s visit, including the absence of a cookie consent pop-up. It further admitted that although a privacy policy had already been drafted, it was not publicly accessible to the users when the data subject visited the site. The controller explained that the online shop had been established as a matter of urgency due to the shortage of protective masks. It claimed it had not previously offered any business-to-consumer sales, and given the closure of physical stores and the absence of other direct sales channels, online sales were the best option under the circumstances. The controller stated during proceedings that the deficiencies had subsequently been remedied. The website was no longer accessible on 24 November 2025. Holding — The DPA found that, when the data subject accessed the online shop, the controller processed the data subject’s IP address in connection with the 14 cookies placed on their device. The cookies contained a unique user identifier and were processed for purposes including user recognition, advertising, marketing and the creation of a digital shopping cart. It acknowledged that the website had been created at short notice, that the deficiencies existed only for a brief period and that the controller had subsequently implemented a cookie banner and made a privacy policy available. The DPA held that the controller failed to transparently inform any user about the cookies that were placed, whether the cookies were technically necessary or not, since neither a cookie banner nor a publicly accessible privacy policy was available at the relevant time. The DPA emphasised that the principle of transparency requires data subjects to be able to understand which personal data concerning them are processed, for which purposes and to what extent, as well as the associated risks, rights and safeguards. This enables data subjects to exercise their rights against the controller and to demand processing that is fair and consistent with their reasonable expectations. Moreover, the DPA noted that the principle of transparency constitutes an integral part of numerous GDPR provisions, including the controller's obligation to inform data subjects about the processing of their personal data where personal data are collected directly from the data subjects pursuant to Article 13 GDPR as well as the communications standards under Article 12 GDPR. It concluded that the controller had therefore infringed Article 13 GDPR by failing to provide the required information in a concise, transparent, intelligible and easily accessible form, as required by Article 12 GDPR. The DPA considered unnecessary to further examine whether the processing was based on a valid legal basis under Article 6 GDPR, as the processing already infringed the principles laid down in Article 5 GDPR. The DPA upheld the complaint and found that the controller had infringed the principle of transparency under Article 5(1)(a) GDPR and the data subject’s right to information under Article 13 GDPR. However, it did not issue an order under Article 58(2) GDPR as it took into account that the controller had remedied the deficiencies shortly after the incident and that the website was no longer accessible.

### AEPD fines DGT for unnecessary data transmission via DGT mobile app push notifications

*Source: AEPD (Spain), 2026-10-03 — https://overview.legal/posts/449830 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_ps-00287-2025*

Facts — A data subject lodged a complaint with the DPA against the Dirección General de Tráfico (DGT), the controller, the Spanish public authority responsible for traffic management, road safety and the administration of driving licences and vehicle records, after discovering that its mobile app transmitted numerous categories of personal and device data to a third-party service provider, the processor. The controller explained that the processor's software was integrated into the app to provide push notifications. However, the integration also enabled an optional functionality which transmitted usage and device data that were not necessary for providing those notifications. During its investigation, the DPA found that different versions of the app transmitted data including IP addresses, device information, country, language, app identifiers and information concerning the user's mobile network operator. The controller acknowledged that older versions of the app had transmitted personal data unnecessarily and implemented technical changes aimed at stopping the collection and transmission of such data. Holding — The DPA held that the controller violated Article 5(1)(c) GDPR because the app collected and transmitted personal data that were not necessary for its intended purposes. In particular, the DPA considered that information such as IP addresses, country and mobile network operator data exceeded what was necessary for the app's functionality. The DPA also considered IP addresses to be personal data because they can allow a user to be identified when combined with other information. The controller's subsequent technical changes did not remove the infringement that had already occurred. Therefore, the DPA found a violation of Article 5(1)(c) GDPR. Since the controller was a public authority subject to Article 77 LOPDGDD, the DPA found the infringement without imposing an administrative fine.

### Datatilsynet (Norway)- 20/02254

*Source: Datatilsynet (Norway), 2020-09-07 — https://overview.legal/posts/122844 — original: https://gdprhub.eu/index.php?title=Datatilsynet_(Norway)-_20/02254*

Facts — The Norwegian Consumer Council (Forbrukerrådet) filed three complaints against the gay/bi dating app Grindr and five adtech companies that received personal data through the app. Subsequently, Datatilsynet sent a request for more information from one of the adtech companies; OpenX. OpenX refused to respond on the basis that Datatilsynet does not have legal grounds to impose such a request on them, because, in their opinion, the issue relates to the Electronic Communications Act § 2(7)(b) (cf. Article 5(3) ePrivacy Directive 2002/58/EC), where the Norwegian Communications Authority is the right supervisory authority (and not Datatilsynet), and filed a complaint to the Privacy Appeals Board. Dispute — Does the Datatilsynet have the legal grounds (as a supervisory authority) to impose a request for information on OpenX? Holding — The Privacy Appeals Board rejected OpenX's complaint as they concluded that Datatilsynet has legal grounds to impose such requests for information as per Article 58(1) GDPR.

### NAIH (Hungary) - NAIH-11443-3/2026

*Source: NAIH (Hungary), 2026-07-22 — https://overview.legal/posts/156361 — original: https://gdprhub.eu/index.php?title=NAIH_(Hungary)_-_NAIH-11443-3/2026*

Facts — The DPA initiated an investigation into the GDPR compliance of an online store (the controller) processing the data of its customers (the data subjects) in April 2025. The processing activities in question included, inter alia, cookies, registration, billing, shipping, consumer complaint, and processing of orders. The privacy notice of the company operating the online store had been in force unchanged from May 2018 to May 2025, and the period under investigation extended from 1 January 2020 to 27 June 2025. Holding — The DPA held that the controller had violated Articles 12(1), 13(1)(c), (d) and (f), and 13(2)(a) GDPR and issued the controller a fine of HUF 2,000,000 (€5,500). In addition, the DPA ordered the controller to bring its data processing operations into compliance with the GDPR and to amend the content of its privacy notice. First, the DPA found an infringement of Article 12(1) GDPR: the structure of the privacy notice was confusing and difficult to follow. The privacy notice also contained incomplete, incorrect, and unnecessary information as well as repetitive details. Based on this, the DPA concluded that the controller had failed to provide data subjects with information regarding the processing of personal data that was sufficiently concise, transparent, intelligible and easily accessible. Second, the DPA held that the controller had also violated Articles 13(1)(c), (d) and (f) GDPR by failing to specify a legal basis for certain processing operations such as the use of cookies, not specifying its legitimate interests when relying on Article 6(1)(f) GDPR as a legal basis, and not providing detailed information regarding the safeguards ensuring the lawfulness of data transfers to the United States. Finally, the DPA found a violation of Article 13(2)(a) GDPR as the controller had also failed to provide the data subjects information on the period for which the personal data processed would be stored.

### EDPS: European Parliament is sole controller for COVID testing website and failed

*Source: EDPS, 2022-01-05 — https://overview.legal/posts/122849 — original: https://gdprhub.eu/index.php?title=EDPS_-_2020-1013*

Facts — In January 2021, noyb filed a complaint against the European Parliament on behalf of six Members of the European Parliament over an internal coronavirus testing website. The issues raised were: confusing and unclear cookie banners, vague and unclear data protection notices, and the illegal transfer of data to the US. Holding — On data controllership — According to the EDPS, the processor may enjoy a considerable degree of autonomy in providing its services and may identify the ‘non-essential’ elements of the processing operation. Furthermore, the processor may advise or propose certain measures in this respect, but it is up to the controller to decide whether to accept such advice or proposals. The analysis of the EDPS shows that the European Parliament (EP) delegated some aspects on the setting up and functioning of the website to Ecolog. The EDPS considers the EP acts as the sole data controller for the processing in question (i.e. the operation of the Parliament’s dedicated website) whereas Ecolog acts as a processor. After having assessed the instructions given by the EP to the processor, the EDPS concluded that the EP did not show the necessary diligence required from a data controller and, ultimately, failed to comply with the Regulation on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data 2018/1725 (hereafter Regulation 2018/1725), in particular with Articles 26(1) and 29(1). Moreover, the EDPS considered that the EP failed to provide the necessary detailed instructions to Ecolog for the setting up of the website, including the drafting of the data protection notice. The absence of documented instructions is therefore in violation of Article 29(3) Regulation 2018/1725. Transparency and information requirements — The EDPS confirmed that the data protection notice published at the time of the complaint did not reflect the processing done by the EP, since it merely consisted of a copy of the testing center of Zaventem's airport. Moreover, the reference made in the document to Article 6(1)(f) GDPR was wrong since it stems from the same error. The EDPS confirmed that the EP did not meet its transparency requirements. The EDPS also analysed the updated version of the data protection notice during the procedure and raised several remaining -and even new- inconsistencies and issues. Among other things, the following problems persisted after the data protection notice was updated: a mere reference to Article 15 and 16 Regulation 2018/1725 is misleading as it should apply in its entirety; the reference to the processing of health data is not correct since no such data are processed in the case at hand; the retention period mentioned is not precise enough; the sections of the data protection notices relating to the recipients of the personal data fail to make any reference to the processor; inconsistencies between the different linguistic versions of the data protection notices were still observed: The English and German versions refer to Ecolog and the Laboratory van Poucke as processors under Article 29 Regulation 2018/1725, whereas the French version refers to them as controllers (‘responsables du traitement’). Moreover, the DPO’s contact details on the website refer to Ecolog in all three linguistic versions of the website, when they should be referring to the Parliament Cookies and transfers of personal data to the US — The EDPS confirmed that tracking cookies, such as the Stripe and the Google analytics cookies, are considered personal data, even if the traditional identity parameters of the tracked users are unknown or have been deleted by the tracker after collection. In the same vein, the EDPS rejected the EP's argument and confirmed that upon installation on a device, a cookie cannot be considered ‘inactive’. Every time a user visited Ecolog’s website, personal data was transferred to Stripe through the Stripe cookie, which contained an identifier. The EDPS reached the conclusion that a transfer of data was taking place to the US, via the use of Google and Stripe cookies, since Google Analytics is hosted in the US and the data protection notice referred to a Standard Contractual Clause (SCC) for the transfer of data outside of the EU. However, the Parliament provided no documentation, evidence or other information regarding the contractual, technical or organisational measures in place to ensure an essentially equivalent level of protection to the personal data transferred to the US in the context of the use of cookies on the website. Cookie banner on the Parliament’s dedicated website — The EDPS reminded that: before setting cookies or any other technology falling within the scope of Article 5(3) ePrivacy Directive 2002/58/EC (hereafter ePrivacy Directive), the EU institution must provide the user with adequate information on what is accessed or stored on the user’s terminal equipment, on the purposes of this action and the means for expressing their consent; no action may be performed before the consent is collected. In addition, users must be enabled to withdraw their consent at any time; ‘cookie walls’ are not in line with Regulation 2018/1725, meaning that for consent to be freely given, access to the website’s service and functionalities should not depend on the users’ consent for cookies that are not strictly necessary in the sense described above; in case personal data collected through the cookies are shared with third parties such as analytics partners, the cookie banner should draw the user's attention to it. The EDPS reached the conclusion that the cookie banners in all three languages were not in line with the definition of consent under Article 3(15) Regulation 2018/1725, nor did they meet the requirements of Article 37 Regulation 2018/1725 and Article 5(3) ePrivacy Directive. The cookie banner further failed to provide transparent information regarding the processing of personal data in relation to the cookies on the website. Request for access to personal data — The Parliament was aware that the complainants’ personal data had been processed through the cookies, which were present on the website for the period between 30 September to 4 November 2020, since transfers of personal data had taken place. Consequently, and especially following the EDPS’ inquiry on the matter, the Parliament should have replied to the complainants’ access to personal data request. The Parliament should have provided the relevant information even if it was aware that the processing of the personal data in question was unlawful, as the main purpose of the right of access under Article 15 GDPR is precisely to enable data subjects to become aware of the processing and verify the lawfulness thereof, or exercise other data subject rights. Conclusion — The EDPS concludes that the Parliament has infringed the following articles of Regulation 2018/1725: Articles 26(1) and 29(1) due to its failure to fulfil its responsibilities as controller and use a processor providing sufficient guarantees to implement appropriate technical and organisational measures; Article 29(3) due to its failure to provide documentation relating to the detailed instructions given to the processor for the setting up and functioning of the website; Articles 4(1)(a) and 14, 4(2), and 15 due to its failure to respect the principle of transparency, accountability and the data subjects’ right to information because of the inaccurate data protection notice and cookie banner on the dedicated website; Article 46 and Article 48(2)(b) of the Regulation, due to its reliance on the Standard Contractual Clauses in the absence of a demonstration that data subjects’ personal data transferred to the US were provided an essential equivalent level of protection; Article 37 read in the light of Article 5(3) of the ePrivacy Directive, due to its failure to protect information (the cookies) transmitted to, stored in, related to, processed by and collected from the users’ terminal equipment; Articles 17 and 14(4) due to its failure to reply to the data subjects’ request for access to their personal data. On the basis of the above, the EDPS decides: to issue a reprimand to the Parliament in accordance with Article 58(2)(b) Regulation 2018/1725 for the above infringements; to order the Parliament, pursuant to Article 58(2)(b) Regulation 2018/1725:, to update its data protection notices in the dedicated website in order to provide all relevant information relating to the processing of personal data. The Parliament should address this order within one month from the date of the decision.

### DSB (Austria) - DSB-D124.2437/25

*Source: DSB (Austria), 2026-01-09 — https://overview.legal/posts/291441 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_DSB-D124.2437/25*

Facts — The controller, an Austrian registered association, operates a therapy centre for psychosomatic illnesses. The data subject was a patient of the controller. On 28 July 2025, the data subject sent an access request by email under Article 15 GDPR, asking for full information on all personal data processed about him including specific categories of data, processing purposes, recipients, storage periods, data origin, any automated decision-making, a copy of his data in electronic format and what data had been processed by two named individuals (a doctor and a body therapist working for the controller) and whether either had disclosed his data to third parties. The controller's chairperson replied by email on 12 August 2025, attaching a PDF of the data collected from the data subject and a list of medications, noting the data originated from a named doctor and that there was no planned retention period. The reply stated that data recorded by the body therapist existed only in handwritten form and had not been electronically processed and offered to send the data subject a copy by post or email. The reply did not include information on the purposes of processing, categories of data, recipients or categories of recipients, or the criteria used to determine retention periods. The data subject filed a complaint with the Austrian DPA, alleging that the access provided was incomplete. Despite being invited to comment twice by the DPA, the controller did not respond at any point during the proceedings, although a delivery receipt confirmed it had received the correspondence. Holding — First, addressing the controller's failure to participate in the proceedings, the DPA held that although it is required to investigate matters on its own initiative, a party's persistent failure to cooperate despite repeated invitations may properly be taken into account in the DPA's free assessment of evidence, rather than obliging the DPA to conduct further investigations of its own accord. On this basis, the DPA treated the data subject's account of events, including that no further information had been provided beyond the 12 August 2025 email, as established. Second, on the scope of the complaint, the DPA reiterated that in a complaint-based procedure, the content of the complaint itself defines and limits the subject matter of the proceedings. The DPA can only rule on what was actually raised. The data subject's complaint was based on the incompleteness of the access provided, specifically regarding the handwritten notes and the missing meta-information. Third, on the handwritten notes, the DPA held that the GDPR's material scope extends not only to automated processing but also to non-automated processing where the data form part of a "filing system" under Article 4(6) GDPR defined broadly by the CJEU case-law C-740/22 as any structured collection of personal data accessible according to specific criteria that make data easily retrievable. The DPA held that although the controller had not specified how the therapist's handwritten notes were organised, it could reasonably be assumed that such clinical notes on patients are typically structured by criteria such as name or treatment period to ensure future retrievability, consistent with professional standards of care in the therapeutic field. On this basis, the DPA held that the notes fell within the GDPR's material scope and that the data subject was entitled to access the personal data they contained, so the complaint was well-founded on this point. Fourth, on the missing meta-information, the DPA held that Article 15(1) GDPR entitles a data subject not only to the specific personal data processed but also to the accompanying information listed in Article 15(1)(a)-(h) GDPR, including processing purposes, categories of data, recipients or categories of recipients and criteria for determining storage periods. Since the controller's response of 12 August 2025 included none of this information, the complaint was also well-founded on this point. The DPA accordingly upheld the complaint and found a violation of the right of access. Citing CJEU case-law C-46/23 on the DPA's obligation to adopt appropriate corrective measures once a violation is established, the DPA ordered the controller, under Article 58(2)(c) GDPR, to fully comply with the data subject's access request including disclosure of the handwritten notes and the outstanding meta-information within four weeks.

### Austrian DSB: Employee who shared customer's phone number acted as GDPR controller

*Source: DSB (Austria), 2026-08-18 — https://overview.legal/posts/291289 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_DSB-D550.1284*

Facts — An employee (controller) of a company shared the telephone number of a costumer (data subject) with a third person. The third person who was a personal acquaintance of the controller, asked the controller to share the telephone number of the data subject, who was the third person’s ex-partner, in order to gift her a present. In reality, the third person used the information to repeatedly call the data subject. The controller’s employer had rules in place to avoid such data transmissions. Those company rules were overstepped by the controller by providing the third person with the telephone number of the data subject without asking for the password connected to the data subject’s account held with the company. The controller stated that he acted out of benevolence to do the third person a favour, believing that the third person intended to make the data subject a gift. Holding — The DPA held that the employee acted as controller pursuant to Article 4(7) GDPR because he acted on his own initiative and not on behalf of the company. The controller could not rely on any legal basis for his processing of personal data. “Benevolence” is not a legitimate interest as provided for by Article 6(1)(f) GDPR. Neither can the controller rely on a legitimate interest of the third person, as “overwhelming a person with phone calls” is not a legitimate interest. The DPA held that in order to determine the legitimate interest of a third person, what matters is the actual interest, not the interest the controller believes the third person to have. The DPA held that the controller has to act with intent or negligence for the DPA to issue a fine. The controller intentionally shared the personal data without requesting the credentials to the data subject’s account and misused his competences as an employee. The DPA issued a fine of €1,000. In the DPA’s publication of the decision, it is pointed out that the fine was reduced to €700 upon appeal of the controller with the Federal Administrative Court (Bundesverwaltungsgericht).

### HDPA investigates Greek Infrastructure Ministry for SMS sent without consent or

*Source: HDPA (Greece), 2026-09-15 — https://overview.legal/posts/354164 — original: https://gdprhub.eu/index.php?title=HDPA_(Greece)_-_17/2026*

Facts — The DPA started an investigation, after receiving 83 complaints from data subjects, against the Ministry of Infrastructure and Transportation (the controller). Particularly, regarding the sending of an SMSs, prior to the national holiday on October 28th, to mobile phone subscribers (the data subjects) without prior information or consent. The complaints included: The violation by the controller of Article 14 GDPR as the data subjects were not priorly informed that their phone numbers would be processed for this purpose, leaving them without information and the subsequent right to object. The processing of all mobile phone subscriber’s data regardless of whether they are drivers. Contrary to the principle of purpose limitation and data minimisation. The wrong application by the controller of legal basis, that is, processing for the public interest. Claiming that the controller lacks the jurisdiction for the purpose of raising awareness to also process personal data. The fact that the controller should have initiated the procedure through the Ministry of Digital Governance, which applies to the citizens which have consented to the sending of messages by public agencies. The data subjects claimed that the controller actually was the Ministry of Data Governance, and the mobile phone companies which ultimately sent out the message acted as processors. In that regard, such a relationship should have been governed by contract, however the controller (in the present case) was unable to present such to the DPA. The controller clarified that the purpose of this campaign was as a preventative/awareness-raising tool within its broader safety strategy, and based in accident statistics. The transmission of the SMSs was carried out by mobile phone operators, in cooperation with the controller, without disclosing the data to the controller. Such communication was authorised by national law which allowed for processing beyond the purpose for which the data was collected when necessary to protect national security and public safety. In that regard, processing was carried out in accordance with Article 6(1)(e) GDPR. The controller deemed sending SMSs as the appropriate communication method which is non-intrusive, immediate and universally accessible. Finally, in light of the national holiday on the 28th of October there was an increased risk, rendering the implementation of such SMSs necessary and proportionate to protect human life. Holding — The DPA held the processing activities of the controller in compliance with the principles of lawful processing pursuant to Article 5(1) GDPR. Particularly, as a result of the increased risk posed by the national holiday, the DPA found it necessary to take action raise awareness for drivers regarding road safety, and deemed the means, immediately through SMS, appropriate. The DPA further found that in light of proportionality and data minimisation, the one-time notification without the controller gaining access to the data subject’s personal data was compliant. As regards the legal basis, the DPA agreed with the controller, that they were pursuing a public interest, namely to promote road safety and safe mobility. Similarly, the DPA held that national law permits private entities to process data for purposes beyond that for what it was originally collected, provided it prevents threats to public safety and is made at the request of a public authority. Therefore, the DPA held that the sending of this SMS was lawful and in compliance with the GDPR. Nonetheless, it advised the controller, for future initiatives, to inform data subjects in accordance with Article 14 GDPR, provide them an option to opt-out. Furthermore, when such messages are outsourced to processors, to ensure such is established through a contract (defining nature and purpose of processing, and type of data and categories of data subjects) in accordance with Article 28 GDPR, and to subsequently inform data subjects of such.

## Recent developments

### Coordinated Enforcement Framework: EDPB selects topic for 2026

*Source: EDPB, 2025-10-14 — https://overview.legal/posts/49129 — original: https://www.edpb.europa.eu/news/news/2025/coordinated-enforcement-framework-edpb-selects-topic-2026_en*

Brussels, 14 October - During its October plenary, the European Data Protection Board (EDPB) picked the topic for its fifth coordinated enforcement action, which will concern compliance with the obligations of transparency and information under the General Data Protection Regulation (GDPR). The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more

### Stakeholder event on anonymisation and pseudonymisation: express your interest

*Source: EDPB, 2025-11-17 — https://overview.legal/posts/49125 — original: https://www.edpb.europa.eu/news/news/2025/stakeholder-event-anonymisation-and-pseudonymisation-express-your-interest_en*

Brussels, 17 November - The EDPB organises a remote event to collect stakeholders’ input on anonymisation and pseudonymisation on implications of the judgement of the Court of Justice of the European Union (CJEU) in EDPS v Single Resolution Board (SRB). The event will take place on 12 December 2025 (time to be confirmed). This will be an opportunity to inform and support the EDPB’s ongoing work on these topics as per its work programme 2024-2025 and it reflects the EDPB’s commitment to stakehold

### When the data relates to us.

*Source: European Digital Rights, 2025-12-04 — https://overview.legal/posts/52048*

The ruling concerning the relationship between the European Data Protection Supervisor (EDPS) and the Single Resolution Board (SRB) addresses the core of the fundamental right to data protection within the EU and determines how artificial intelligence, data spaces, and so-called privacy-enhancing technologies (PETs) will be regulated in practice. The judgment of the Court of Justice of the European Union (CJEU) comes at a crucial moment to reiterate what constitutes personal data and emphasizes the importance of the protection that the General Data Protection Regulation (GDPR) aims to guarantee. The post "When data relates to us..."

### AEPD publishes GDPR Risk Assessment

*Source: AEPD, 2022-10-11 — https://overview.legal/posts/6259 — original: https://evalua-riesgo.aepd.es/index_en.html#entry-1032*

> GDPR RISK ASSESSMENT is intended to assist controllers and processors to identify the risk factors for the rights and freedoms of data subjects whose data are present in the processing, to make an initial assessment of the intrinsic risk, including the need to perform a DPIA, and to estimate the residual risk if measures and safeguards are used to mitigate the specific risk factors.

### What Happened to the Risk-Based Approach to Data Transfers?

*Source: Future of Privacy Forum, 2022-09-27 — https://overview.legal/posts/6271 — original: https://fpf.org/blog/what-happened-to-the-risk-based-approach-to-data-transfers/#entry-912*

The GDPR incorporates the RBA for all obligations of the controller in the GDPR. Where the transfer rules are stated as obligations of the controller (rather than as absolute principles), the RBA of Article 24 therefore applies. Other than the DPAs assume, this is not contradicted by the ECJ in Schrems II nor by the EDPB recommendations on additional measures following the Schrems II judgment, according to Lokke Moerel, Professor of Global ICT Law at Tilburg University and a Dutch Cyber Security

## Literature

### GDPR: A new challenge for personal data protection

*Source: Bankarstvo, 2017-01-01 — https://overview.legal/posts/132473 — original: https://doi.org/10.5937/bankarstvo1704166m*

stručni članak Erne Mraznica Raiffeisen banka ad Beograd erne.mraznica@raiffeisenbank.rs GDPR - NOVI IZAZOV ZAŠTITE PODATAKA O LIČNOSTI Rezime Dana 4. maja 2016. godine objavljena je Opšta Uredba o zaštiti podataka o ličnosti u Sl. glasniku EU, koja će se primenjivati od 25. maja 2018. godine. Cilj propisa je harmonizacija zaštite podataka o ličnosti na nivou EU, veći stepen kontrole za lica čiji se podaci obrađuju i unapređeno upravljanje savremenim rizicima iz ove oblasti. Banke, po prirodi svog poslovanja, spadaju među najveće rukovaoce podataka o ličnosti i u postupku usklađivanja sa obavezama utvrđenih Uredbom biće u prilici da izvrše punu analizu svog postojećeg regulatornog i infrastrukturnog okvira zaštite podataka o ličnosti. Istovremeno, pruža im se prilika da isprave eventualne nedostatke u postojećim procesima, odnosno da značajno povećaju svest organizacije o standardima zaštite podataka o ličnosti, posebno imajući u vidu zaprećene stroge sankcije za slučaj neusklađenosti. Ključne reči : GDPR, podatak o ličnosti, osnovni principi, prava lica, rukovalac, obrada podataka, transfer podataka, sankcije, usklađivanje JEL : F52, G14 doi: 10.5937/bankarstvo1704166M 166 Bankars

### Building data management capabilities to address data protection regulations: Learnings from EU-GDPR

*Source: Journal of Information Technology, 2023-01-19 — https://overview.legal/posts/132524 — original: https://doi.org/10.1177/02683962221141456*

The European Union’s General Data Protection Regulation (EU-GDPR) has initiated a paradigm shift in data protection toward greater choice and sovereignty for individuals and more accountability for organizations. Its strict rules have inspired data protection regulations in other parts of the world. However, many organizations are facing difficulty complying with the EU-GDPR: these new types of data protection regulations cannot be addressed by an adaptation of contractual frameworks, but requir

### GDPR Implementation Series ∙ Cyprus: A Look into the Law for the Effective Application of the GDPR

*Source: European Data Protection Law Review, 2019-01-01 — https://overview.legal/posts/132507 — original: https://doi.org/10.21552/edpl/2019/3/13*

### GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection

*Source: European Data Protection Law Review, 2019-01-01 — https://overview.legal/posts/132426 — original: https://doi.org/10.21552/edpl/2019/4/11*

### GDPR Implementation Series ∙ Austria: A Brief Overview Concerning the Implementation of the GDPR

*Source: European Data Protection Law Review, 2017-01-01 — https://overview.legal/posts/132489 — original: https://doi.org/10.21552/edpl/2017/2/12*

## Related topics

- **Personal Data** — https://overview.legal/topics/personal-data
  Information relating to identified or identifiable natural persons
- **Processing** — https://overview.legal/topics/processing
  Any operation performed on personal data
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing
- **Law Enforcement** — https://overview.legal/topics/law-enforcement
  Processing for law enforcement purposes
- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Public Authority** — https://overview.legal/topics/public-authority
  Government bodies and their data processing activities

---
Generated by overview.legal · https://overview.legal/topics/ip-address · 2026-10-13