EDPB guidance
Guidelines, recommendations and opinions of the European Data Protection Board, and the Article 29 Working Party documents the EDPB endorsed, newest first. Checked against the EDPB website on 28 October 2026.
- Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR
EDPB 04/2026Draft for consultationFirst published 21 September 2026
Consultation open until 13 November 2026.
- Guidelines 3/2025 on the interplay between the DSA and the GDPR
EDPB 03/2025FinalFirst published 12 September 2025Final version 17 September 2026
Version 2 is final.
- Guidelines 03/2026 on web scraping in the context of generative AI
EDPB 03/2026Draft for consultationFirst published 8 July 2026
Consultation open until 30 October 2026. Articles indicative.
- Guidelines 02/2026 on anonymisation
EDPB 02/2026Draft for consultationFirst published 8 July 2026
Consultation open until 30 October 2026.
- Guidelines 02/2025 on processing of personal data through blockchain technologies
EDPB 02/2025FinalFirst published 14 April 2025Final version 7 July 2026
Version 2 is final.
- Guidelines 1/2026 on processing of personal data for scientific research purposes
EDPB 01/2026Draft for consultationFirst published 16 April 2026
Consultation closed 25 June 2026; final version not yet published.
- Recommendations 1/2026 on the application for approval and on the elements and principles to be found in Processor Binding Corporate Rules
EDPB Rec 01/2026Draft for consultationFirst published 19 January 2026
Consultation closed; final not yet published. Whether it will replace WP29 WP257 rev.01 and WP265 is not stated on the EDPB listing.
- Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites
EDPB Rec 02/2025Draft for consultationFirst published 4 December 2025
Consultation closed; final not yet published.
- Joint Guidelines (European Commission and EDPB) on the interplay between the Digital Markets Act and the GDPR
EDPB-COM DMA/GDPRDraft for consultationFirst published 9 October 2025
Joint text; consultation closed 4 December 2025; final not yet published.
- Guidelines 02/2024 on Article 48 GDPR
EDPB 02/2024FinalFirst published 3 December 2024Final version 5 June 2025
Version 2 is final.
- Guidelines 01/2025 on pseudonymisation
EDPB 01/2025Draft for consultationFirst published 17 January 2025
Consultation closed 14 March 2025; final version not yet published.
- Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models
EDPB Opinion 28/2024FinalFirst published 18 December 2024Final version 18 December 2024
Art. 64(2) opinion; date is EDPB publication date.
- Guidelines 2/2023 on technical scope of Art. 5(3) of the ePrivacy Directive
EDPB 02/2023FinalFirst published 16 November 2023Final version 16 October 2024
Interprets the ePrivacy Directive, not the GDPR.
- Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR
EDPB 01/2024Draft for consultationFirst published 9 October 2024
WP29 Opinion 06/2014 (WP217) interpreted Directive 95/46 and was not part of the EDPB's 2018 endorsement. Consultation closed 20 November 2024; as of 28 October 2026 the EDPB lists no final version.
- Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)
EDPB Opinion 22/2024FinalFirst published 9 October 2024Final version 9 October 2024
Art. 64(2) opinion; date is EDPB publication date.
- Guidelines 01/2023 on Article 37 Law Enforcement Directive
EDPB 01/2023 (LED)FinalFirst published 27 September 2023Final version 19 June 2024
Law Enforcement Directive only; listed for completeness.
- Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms
EDPB Opinion 08/2024FinalFirst published 17 April 2024Final version 17 April 2024
Art. 64(2) opinion; date is EDPB publication date.
- Recommendations 1/2022 on the application for approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)
EDPB Rec 01/2022FinalFinal version 20 June 2023
Supersedes WP29 WP256 rev.01 and WP264.
- Guidelines 04/2022 on the calculation of administrative fines under the GDPR
EDPB 04/2022FinalFirst published 16 May 2022Final version 24 May 2023
Version 2.1 is final. Complements WP29 WP253.
- Guidelines 03/2021 on the application of Article 65(1)(a) GDPR
EDPB 03/2021FinalFirst published 16 April 2021Final version 24 May 2023
- Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement
EDPB 05/2022FinalFirst published 16 May 2022Final version 17 May 2023
Mainly the Law Enforcement Directive (EU) 2016/680.
- Guidelines 01/2022 on data subject rights - Right of access
EDPB 01/2022FinalFirst published 28 January 2022Final version 17 April 2023
Version 2.1 is final.
- Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority
EDPB 08/2022FinalFirst published 21 October 2022Final version 17 April 2023
Targeted update of WP29 WP244 rev.01, which it supersedes.
- Guidelines 9/2022 on personal data breach notification under GDPR
EDPB 09/2022FinalFirst published 18 October 2022Final version 4 April 2023
Targeted update of WP29 WP250 rev.01, which it supersedes.
- Guidelines 03/2022 on deceptive design patterns in social media platform interfaces
EDPB 03/2022FinalFirst published 21 March 2022Final version 24 February 2023
Version 1 was titled 'dark patterns'.
- Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
EDPB 05/2021FinalFirst published 19 November 2021Final version 24 February 2023
- Guidelines 07/2022 on certification as a tool for transfers
EDPB 07/2022FinalFirst published 30 June 2022Final version 24 February 2023
- Guidelines 06/2022 on the practical implementation of amicable settlements
EDPB 06/2022FinalFirst published 12 May 2022Final version 12 May 2022
No public consultation.
- Guidelines 02/2022 on the application of Article 60 GDPR
EDPB 02/2022FinalFirst published 14 March 2022Final version 14 March 2022
No public consultation.
- Guidelines 04/2021 on codes of conduct as tools for transfers
EDPB 04/2021FinalFirst published 14 July 2021Final version 22 February 2022
- Guidelines 01/2021 on examples regarding personal data breach notification
EDPB 01/2021FinalFirst published 19 January 2021Final version 3 January 2022
Final date is the EDPB publication date of version 2.0.
- Guidelines 10/2020 on restrictions under Article 23 GDPR
EDPB 10/2020FinalFirst published 18 December 2020Final version 13 October 2021
- Guidelines 07/2020 on the concepts of controller and processor in the GDPR
EDPB 07/2020FinalFirst published 7 September 2020Final version 7 July 2021
- Guidelines 02/2021 on virtual voice assistants
EDPB 02/2021FinalFirst published 12 March 2021Final version 7 July 2021
- Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
EDPB Rec 01/2020FinalFinal version 18 June 2021
Version 2.0 is final; the EDPB's response to C-311/18.
- Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions
EDPB Rec 02/2021FinalFirst published 19 May 2021Final version 19 May 2021
- Guidelines 8/2020 on the targeting of social media users
EDPB 08/2020FinalFirst published 7 September 2020Final version 13 April 2021
- Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679
EDPB 09/2020FinalFirst published 13 October 2020Final version 9 March 2021
- Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications
EDPB 01/2020FinalFirst published 7 February 2020Final version 9 March 2021
Final version 2.0.
- Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR
EDPB 06/2020FinalFirst published 22 July 2020Final version 15 December 2020
- Guidelines 2/2020 on articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies
EDPB 02/2020FinalFirst published 24 February 2020Final version 15 December 2020
- Recommendations 02/2020 on the European Essential Guarantees for surveillance measures
EDPB Rec 02/2020FinalFirst published 10 November 2020Final version 10 November 2020
- Guidelines 4/2019 on Article 25 Data Protection by Design and by Default
EDPB 04/2019FinalFirst published 20 November 2019Final version 20 October 2020
Version 2.0 is final.
- Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)
EDPB 05/2019FinalFirst published 11 December 2019Final version 7 July 2020
- Guidelines 05/2020 on consent under Regulation 2016/679
EDPB 05/2020FinalFirst published 4 May 2020Final version 4 May 2020
Supersedes WP29 WP259 rev.01. Covers children's consent under Art. 8.
- Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak
EDPB 03/2020FinalFirst published 21 April 2020Final version 21 April 2020
Pandemic-specific; may be overtaken by Guidelines 1/2026 when final.
- Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak
EDPB 04/2020FinalFirst published 21 April 2020Final version 21 April 2020
Pandemic-specific.
- Guidelines 3/2019 on processing of personal data through video devices
EDPB 03/2019FinalFirst published 12 July 2019Final version 30 January 2020
- Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
EDPB 03/2018FinalFirst published 23 November 2018Final version 12 November 2019
- Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects
EDPB 02/2019FinalFirst published 12 April 2019Final version 16 October 2019
- Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43
EDPB 01/2018FinalFirst published 30 May 2018Final version 4 June 2019
- Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679
EDPB 01/2019FinalFirst published 19 February 2019Final version 4 June 2019
- Guidelines 4/2018 on the accreditation of certification bodies under Article 43
EDPB 04/2018FinalFirst published 14 December 2018Final version 14 December 2018
Annex consulted publicly from 14 December 2018.
- Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679
EDPB 02/2018FinalFirst published 25 May 2018Final version 25 May 2018
- Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679
WP251 rev.01FinalEndorsed by the EDPB 25 May 2018
Date is the EDPB endorsement date.
- Guidelines on the right to data portability
WP242 rev.01FinalEndorsed by the EDPB 25 May 2018
Date is the EDPB endorsement date.
- Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk'
WP248 rev.01FinalEndorsed by the EDPB 25 May 2018
Date is the EDPB endorsement date.
- Guidelines on Data Protection Officers ('DPO')
WP243 rev.01FinalEndorsed by the EDPB 25 May 2018
- Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679
WP253FinalEndorsed by the EDPB 25 May 2018
Still endorsed; complemented by EDPB Guidelines 04/2022 on calculation of fines.
- Adequacy Referential
WP254 rev.01FinalEndorsed by the EDPB 25 May 2018
- Working document setting up a table with the elements and principles to be found in Processor Binding Corporate Rules
WP257 rev.01FinalEndorsed by the EDPB 25 May 2018
Still listed as endorsed. Draft EDPB Recommendations 1/2026 on processor BCRs are pending.
- Recommendation on the standard application form for approval of Processor Binding Corporate Rules
WP265FinalEndorsed by the EDPB 25 May 2018
- Position paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR
WP29 Art. 30(5) position paperFinalEndorsed by the EDPB 25 May 2018
- Guidelines on transparency under Regulation 2016/679
WP260 rev.01FinalFirst published 11 April 2018Endorsed by the EDPB 11 April 2018
Superseded
Replaced by later guidance. Kept for reference; not listed on article pages.
- Guidelines on consent under Regulation 2016/679
WP259 rev.01Superseded by EDPB 05/2020Endorsed by the EDPB 25 May 2018
- Guidelines on personal data breach notification under Regulation 2016/679
WP250 rev.01Superseded by EDPB 09/2022Endorsed by the EDPB 25 May 2018
- Guidelines for identifying a controller or processor's lead supervisory authority
WP244 rev.01Superseded by EDPB 08/2022Endorsed by the EDPB 25 May 2018
- Working document setting up a table with the elements and principles to be found in Binding Corporate Rules
WP256 rev.01Superseded by EDPB Rec 01/2022Endorsed by the EDPB 25 May 2018
- Recommendation on the standard application for approval of Controller Binding Corporate Rules
WP264Superseded by EDPB Rec 01/2022Endorsed by the EDPB 25 May 2018
- Working document setting forth a co-operation procedure for the approval of BCRs
WP263 rev.01Superseded by the EDPB document on the BCR co-operation procedureEndorsed by the EDPB 25 May 2018