--- title: "EDPB guidance on the GDPR" canonical: "https://dposchool.com/gdpr/guidance" source: - "https://www.edpb.europa.eu/documents/guideline/guidelines-042026-on-the-application-of-the-power-to-impose-administrative-0_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-032026-on-web-scraping-in-the-context-of-generative-ai_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-022026-on-anonymisation_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-022025-on-processing-of-personal-data-through-blockchain_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-12026-on-processing-of-personal-data-for-scientific-research_en" - "https://www.edpb.europa.eu/documents/recommendation/recommendations-12026-on-the-application-for-approval-and-on-the-elements_en" - "https://www.edpb.europa.eu/documents/recommendation/recommendations-22025-on-the-legal-basis-for-requiring-the-creation-of_en" - "https://www.edpb.europa.eu/documents/guideline/joint-guidelines-on-the-interplay-between-the-digital-markets-act-and-the_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-022024-on-article-48-gdpr_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-012025-on-pseudonymisation_en" - "https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-282024-on-certain-data-protection-aspects-related-to_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-22023-on-technical-scope-of-art-53-of-eprivacy-directive_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-12024-on-processing-of-personal-data-based-on-article-61f-gdpr_en" - "https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-222024-on-certain-obligations-following-from-the_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-012023-on-article-37-law-enforcement-directive_en" - "https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-082024-on-valid-consent-in-the-context-of-consent-or_en" - "https://www.edpb.europa.eu/documents/recommendation/recommendations-12022-on-the-application-for-approval-and-on-the-elements_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-042022-on-the-calculation-of-administrative-fines-under-the-gdpr_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-032021-on-the-application-of-article-651a-gdpr_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-052022-on-the-use-of-facial-recognition-technology-in-the-area-of_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-82022-on-identifying-a-controller-or-processors-lead-supervisory_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-032022-on-deceptive-design-patterns-in-social-media-platform_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-052021-on-the-interplay-between-the-application-of-article-3-and-the_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-072022-on-certification-as-a-tool-for-transfers_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-062022-on-the-practical-implementation-of-amicable-settlements_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-022022-on-the-application-of-article-60-gdpr_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-042021-on-codes-of-conduct-as-tools-for-transfers_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-012021-on-examples-regarding-personal-data-breach-notification_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-102020-on-restrictions-under-article-23-gdpr_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-022021-on-virtual-voice-assistants_en" - "https://www.edpb.europa.eu/documents/recommendation/recommendations-012020-on-measures-that-supplement-transfer-tools-to_en" - "https://www.edpb.europa.eu/documents/recommendation/recommendations-022021-on-the-legal-basis-for-the-storage-of-credit-card_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-092020-on-relevant-and-reasoned-objection-under-regulation-2016679_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-012020-on-processing-personal-data-in-the-context-of-connected_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-062020-on-the-interplay-of-the-second-payment-services-directive-and_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-22020-on-articles-46-2-a-and-46-3-b-of-regulation-2016679-for_en" - "https://www.edpb.europa.eu/documents/recommendation/recommendations-022020-on-the-european-essential-guarantees-for_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-42019-on-article-25-data-protection-by-design-and-by-default_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-52019-on-the-criteria-of-the-right-to-be-forgotten-in-the-search_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-032020-on-the-processing-of-data-concerning-health-for-the-purpose_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-042020-on-the-use-of-location-data-and-contact-tracing-tools-in-the_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-32019-on-processing-of-personal-data-through-video-devices_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-32018-on-the-territorial-scope-of-the-gdpr-article-3-version-adopted_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-12018-on-certification-and-identifying-certification-criteria-in_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-12019-on-codes-of-conduct-and-monitoring-bodies-under-regulation_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-42018-on-the-accreditation-of-certification-bodies-under-article-43_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-22018-on-derogations-of-article-49-under-regulation-2016679_en" - "https://www.edpb.europa.eu/documents/guideline/automated-decision-making-and-profiling_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-on-the-right-to-data-portability-under-regulation-2016679-wp242_en" - "https://www.edpb.europa.eu/documents/guideline/data-protection-impact-assessments-high-risk-processing_en" - "https://www.edpb.europa.eu/documents/guideline/data-protection-officer_en" - "https://www.edpb.europa.eu/endorsed-wp29-guidelines_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-on-personal-data-breach-notification-under-regulation-2016679-wp250_en" - "https://www.edpb.europa.eu/documents/guideline/guidelines-for-identifying-a-controller-or-processors-lead-supervisory_en" - "https://www.edpb.europa.eu/documents/guideline/article-29-working-party-guidelines-on-transparency-under-regulation-2016679_en" source_note: "Only the document as published by the EDPB is authoritative." text_as_of: "2026-10-28" language: "en" publisher: "DPO School" --- # EDPB guidance Guidelines, recommendations and opinions of the European Data Protection Board, and the Article 29 Working Party documents the EDPB endorsed, newest first. Checked against the EDPB website on 28 October 2026. ## [Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR](https://dposchool.com/gdpr/guidance/edpb-04-2026) EDPB 04/2026 · Draft for consultation · First published 21 September 2026 Consultation open until 13 November 2026. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-042026-on-the-application-of-the-power-to-impose-administrative-0_en) ## [Guidelines 3/2025 on the interplay between the DSA and the GDPR](https://dposchool.com/gdpr/guidance/edpb-03-2025) EDPB 03/2025 · Final · First published 12 September 2025 · Final version 17 September 2026 Version 2 is final. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en) ## [Guidelines 03/2026 on web scraping in the context of generative AI](https://dposchool.com/gdpr/guidance/edpb-03-2026) EDPB 03/2026 · Draft for consultation · First published 8 July 2026 Consultation open until 30 October 2026. Articles indicative. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032026-on-web-scraping-in-the-context-of-generative-ai_en) ## [Guidelines 02/2026 on anonymisation](https://dposchool.com/gdpr/guidance/edpb-02-2026) EDPB 02/2026 · Draft for consultation · First published 8 July 2026 Consultation open until 30 October 2026. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022026-on-anonymisation_en) ## [Guidelines 02/2025 on processing of personal data through blockchain technologies](https://dposchool.com/gdpr/guidance/edpb-02-2025) EDPB 02/2025 · Final · First published 14 April 2025 · Final version 7 July 2026 Version 2 is final. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022025-on-processing-of-personal-data-through-blockchain_en) ## [Guidelines 1/2026 on processing of personal data for scientific research purposes](https://dposchool.com/gdpr/guidance/edpb-01-2026) EDPB 01/2026 · Draft for consultation · First published 16 April 2026 Consultation closed 25 June 2026; final version not yet published. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-12026-on-processing-of-personal-data-for-scientific-research_en) ## [Recommendations 1/2026 on the application for approval and on the elements and principles to be found in Processor Binding Corporate Rules](https://dposchool.com/gdpr/guidance/edpb-rec-01-2026) EDPB Rec 01/2026 · Draft for consultation · First published 19 January 2026 Consultation closed; final not yet published. Whether it will replace WP29 WP257 rev.01 and WP265 is not stated on the EDPB listing. [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-12026-on-the-application-for-approval-and-on-the-elements_en) ## [Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites](https://dposchool.com/gdpr/guidance/edpb-rec-02-2025) EDPB Rec 02/2025 · Draft for consultation · First published 4 December 2025 Consultation closed; final not yet published. [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-22025-on-the-legal-basis-for-requiring-the-creation-of_en) ## [Joint Guidelines (European Commission and EDPB) on the interplay between the Digital Markets Act and the GDPR](https://dposchool.com/gdpr/guidance/edpb-com-dma-gdpr) EDPB-COM DMA/GDPR · Draft for consultation · First published 9 October 2025 Joint text; consultation closed 4 December 2025; final not yet published. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/joint-guidelines-on-the-interplay-between-the-digital-markets-act-and-the_en) ## [Guidelines 02/2024 on Article 48 GDPR](https://dposchool.com/gdpr/guidance/edpb-02-2024) EDPB 02/2024 · Final · First published 3 December 2024 · Final version 5 June 2025 Version 2 is final. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022024-on-article-48-gdpr_en) ## [Guidelines 01/2025 on pseudonymisation](https://dposchool.com/gdpr/guidance/edpb-01-2025) EDPB 01/2025 · Draft for consultation · First published 17 January 2025 Consultation closed 14 March 2025; final version not yet published. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012025-on-pseudonymisation_en) ## [Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models](https://dposchool.com/gdpr/guidance/edpb-opinion-28-2024) EDPB Opinion 28/2024 · Final · First published 18 December 2024 · Final version 18 December 2024 Art. 64(2) opinion; date is EDPB publication date. [Document on the EDPB website](https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-282024-on-certain-data-protection-aspects-related-to_en) ## [Guidelines 2/2023 on technical scope of Art. 5(3) of the ePrivacy Directive](https://dposchool.com/gdpr/guidance/edpb-02-2023) EDPB 02/2023 · Final · First published 16 November 2023 · Final version 16 October 2024 Interprets the ePrivacy Directive, not the GDPR. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-22023-on-technical-scope-of-art-53-of-eprivacy-directive_en) ## [Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR](https://dposchool.com/gdpr/guidance/edpb-01-2024) EDPB 01/2024 · Draft for consultation · First published 9 October 2024 WP29 Opinion 06/2014 (WP217) interpreted Directive 95/46 and was not part of the EDPB's 2018 endorsement. Consultation closed 20 November 2024; as of 28 October 2026 the EDPB lists no final version. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-12024-on-processing-of-personal-data-based-on-article-61f-gdpr_en) ## [Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)](https://dposchool.com/gdpr/guidance/edpb-opinion-22-2024) EDPB Opinion 22/2024 · Final · First published 9 October 2024 · Final version 9 October 2024 Art. 64(2) opinion; date is EDPB publication date. [Document on the EDPB website](https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-222024-on-certain-obligations-following-from-the_en) ## [Guidelines 01/2023 on Article 37 Law Enforcement Directive](https://dposchool.com/gdpr/guidance/edpb-01-2023-led) EDPB 01/2023 (LED) · Final · First published 27 September 2023 · Final version 19 June 2024 Law Enforcement Directive only; listed for completeness. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012023-on-article-37-law-enforcement-directive_en) ## [Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms](https://dposchool.com/gdpr/guidance/edpb-opinion-08-2024) EDPB Opinion 08/2024 · Final · First published 17 April 2024 · Final version 17 April 2024 Art. 64(2) opinion; date is EDPB publication date. [Document on the EDPB website](https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-082024-on-valid-consent-in-the-context-of-consent-or_en) ## [Recommendations 1/2022 on the application for approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)](https://dposchool.com/gdpr/guidance/edpb-rec-01-2022) EDPB Rec 01/2022 · Final · Final version 20 June 2023 Supersedes WP29 WP256 rev.01 and WP264. [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-12022-on-the-application-for-approval-and-on-the-elements_en) ## [Guidelines 04/2022 on the calculation of administrative fines under the GDPR](https://dposchool.com/gdpr/guidance/edpb-04-2022) EDPB 04/2022 · Final · First published 16 May 2022 · Final version 24 May 2023 Version 2.1 is final. Complements WP29 WP253. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-042022-on-the-calculation-of-administrative-fines-under-the-gdpr_en) ## [Guidelines 03/2021 on the application of Article 65(1)(a) GDPR](https://dposchool.com/gdpr/guidance/edpb-03-2021) EDPB 03/2021 · Final · First published 16 April 2021 · Final version 24 May 2023 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032021-on-the-application-of-article-651a-gdpr_en) ## [Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement](https://dposchool.com/gdpr/guidance/edpb-05-2022) EDPB 05/2022 · Final · First published 16 May 2022 · Final version 17 May 2023 Mainly the Law Enforcement Directive (EU) 2016/680. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-052022-on-the-use-of-facial-recognition-technology-in-the-area-of_en) ## [Guidelines 01/2022 on data subject rights - Right of access](https://dposchool.com/gdpr/guidance/edpb-01-2022) EDPB 01/2022 · Final · First published 28 January 2022 · Final version 17 April 2023 Version 2.1 is final. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en) ## [Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority](https://dposchool.com/gdpr/guidance/edpb-08-2022) EDPB 08/2022 · Final · First published 21 October 2022 · Final version 17 April 2023 Targeted update of WP29 WP244 rev.01, which it supersedes. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-82022-on-identifying-a-controller-or-processors-lead-supervisory_en) ## [Guidelines 9/2022 on personal data breach notification under GDPR](https://dposchool.com/gdpr/guidance/edpb-09-2022) EDPB 09/2022 · Final · First published 18 October 2022 · Final version 4 April 2023 Targeted update of WP29 WP250 rev.01, which it supersedes. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en) ## [Guidelines 03/2022 on deceptive design patterns in social media platform interfaces](https://dposchool.com/gdpr/guidance/edpb-03-2022) EDPB 03/2022 · Final · First published 21 March 2022 · Final version 24 February 2023 Version 1 was titled 'dark patterns'. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032022-on-deceptive-design-patterns-in-social-media-platform_en) ## [Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR](https://dposchool.com/gdpr/guidance/edpb-05-2021) EDPB 05/2021 · Final · First published 19 November 2021 · Final version 24 February 2023 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-052021-on-the-interplay-between-the-application-of-article-3-and-the_en) ## [Guidelines 07/2022 on certification as a tool for transfers](https://dposchool.com/gdpr/guidance/edpb-07-2022) EDPB 07/2022 · Final · First published 30 June 2022 · Final version 24 February 2023 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-072022-on-certification-as-a-tool-for-transfers_en) ## [Guidelines 06/2022 on the practical implementation of amicable settlements](https://dposchool.com/gdpr/guidance/edpb-06-2022) EDPB 06/2022 · Final · First published 12 May 2022 · Final version 12 May 2022 No public consultation. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-062022-on-the-practical-implementation-of-amicable-settlements_en) ## [Guidelines 02/2022 on the application of Article 60 GDPR](https://dposchool.com/gdpr/guidance/edpb-02-2022) EDPB 02/2022 · Final · First published 14 March 2022 · Final version 14 March 2022 No public consultation. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022022-on-the-application-of-article-60-gdpr_en) ## [Guidelines 04/2021 on codes of conduct as tools for transfers](https://dposchool.com/gdpr/guidance/edpb-04-2021) EDPB 04/2021 · Final · First published 14 July 2021 · Final version 22 February 2022 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-042021-on-codes-of-conduct-as-tools-for-transfers_en) ## [Guidelines 01/2021 on examples regarding personal data breach notification](https://dposchool.com/gdpr/guidance/edpb-01-2021) EDPB 01/2021 · Final · First published 19 January 2021 · Final version 3 January 2022 Final date is the EDPB publication date of version 2.0. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012021-on-examples-regarding-personal-data-breach-notification_en) ## [Guidelines 10/2020 on restrictions under Article 23 GDPR](https://dposchool.com/gdpr/guidance/edpb-10-2020) EDPB 10/2020 · Final · First published 18 December 2020 · Final version 13 October 2021 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-102020-on-restrictions-under-article-23-gdpr_en) ## [Guidelines 07/2020 on the concepts of controller and processor in the GDPR](https://dposchool.com/gdpr/guidance/edpb-07-2020) EDPB 07/2020 · Final · First published 7 September 2020 · Final version 7 July 2021 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en) ## [Guidelines 02/2021 on virtual voice assistants](https://dposchool.com/gdpr/guidance/edpb-02-2021) EDPB 02/2021 · Final · First published 12 March 2021 · Final version 7 July 2021 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-022021-on-virtual-voice-assistants_en) ## [Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data](https://dposchool.com/gdpr/guidance/edpb-rec-01-2020) EDPB Rec 01/2020 · Final · Final version 18 June 2021 Version 2.0 is final; the EDPB's response to C-311/18. [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-012020-on-measures-that-supplement-transfer-tools-to_en) ## [Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions](https://dposchool.com/gdpr/guidance/edpb-rec-02-2021) EDPB Rec 02/2021 · Final · First published 19 May 2021 · Final version 19 May 2021 [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-022021-on-the-legal-basis-for-the-storage-of-credit-card_en) ## [Guidelines 8/2020 on the targeting of social media users](https://dposchool.com/gdpr/guidance/edpb-08-2020) EDPB 08/2020 · Final · First published 7 September 2020 · Final version 13 April 2021 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en) ## [Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-09-2020) EDPB 09/2020 · Final · First published 13 October 2020 · Final version 9 March 2021 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-092020-on-relevant-and-reasoned-objection-under-regulation-2016679_en) ## [Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications](https://dposchool.com/gdpr/guidance/edpb-01-2020) EDPB 01/2020 · Final · First published 7 February 2020 · Final version 9 March 2021 Final version 2.0. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-012020-on-processing-personal-data-in-the-context-of-connected_en) ## [Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR](https://dposchool.com/gdpr/guidance/edpb-06-2020) EDPB 06/2020 · Final · First published 22 July 2020 · Final version 15 December 2020 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-062020-on-the-interplay-of-the-second-payment-services-directive-and_en) ## [Guidelines 2/2020 on articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies](https://dposchool.com/gdpr/guidance/edpb-02-2020) EDPB 02/2020 · Final · First published 24 February 2020 · Final version 15 December 2020 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-22020-on-articles-46-2-a-and-46-3-b-of-regulation-2016679-for_en) ## [Recommendations 02/2020 on the European Essential Guarantees for surveillance measures](https://dposchool.com/gdpr/guidance/edpb-rec-02-2020) EDPB Rec 02/2020 · Final · First published 10 November 2020 · Final version 10 November 2020 [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-022020-on-the-european-essential-guarantees-for_en) ## [Guidelines 4/2019 on Article 25 Data Protection by Design and by Default](https://dposchool.com/gdpr/guidance/edpb-04-2019) EDPB 04/2019 · Final · First published 20 November 2019 · Final version 20 October 2020 Version 2.0 is final. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-42019-on-article-25-data-protection-by-design-and-by-default_en) ## [Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)](https://dposchool.com/gdpr/guidance/edpb-05-2019) EDPB 05/2019 · Final · First published 11 December 2019 · Final version 7 July 2020 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-52019-on-the-criteria-of-the-right-to-be-forgotten-in-the-search_en) ## [Guidelines 05/2020 on consent under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-05-2020) EDPB 05/2020 · Final · First published 4 May 2020 · Final version 4 May 2020 Supersedes WP29 WP259 rev.01. Covers children's consent under Art. 8. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en) ## [Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak](https://dposchool.com/gdpr/guidance/edpb-03-2020) EDPB 03/2020 · Final · First published 21 April 2020 · Final version 21 April 2020 Pandemic-specific; may be overtaken by Guidelines 1/2026 when final. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032020-on-the-processing-of-data-concerning-health-for-the-purpose_en) ## [Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak](https://dposchool.com/gdpr/guidance/edpb-04-2020) EDPB 04/2020 · Final · First published 21 April 2020 · Final version 21 April 2020 Pandemic-specific. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-042020-on-the-use-of-location-data-and-contact-tracing-tools-in-the_en) ## [Guidelines 3/2019 on processing of personal data through video devices](https://dposchool.com/gdpr/guidance/edpb-03-2019) EDPB 03/2019 · Final · First published 12 July 2019 · Final version 30 January 2020 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-32019-on-processing-of-personal-data-through-video-devices_en) ## [Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)](https://dposchool.com/gdpr/guidance/edpb-03-2018) EDPB 03/2018 · Final · First published 23 November 2018 · Final version 12 November 2019 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-32018-on-the-territorial-scope-of-the-gdpr-article-3-version-adopted_en) ## [Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects](https://dposchool.com/gdpr/guidance/edpb-02-2019) EDPB 02/2019 · Final · First published 12 April 2019 · Final version 16 October 2019 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in_en) ## [Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43](https://dposchool.com/gdpr/guidance/edpb-01-2018) EDPB 01/2018 · Final · First published 30 May 2018 · Final version 4 June 2019 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-12018-on-certification-and-identifying-certification-criteria-in_en) ## [Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-01-2019) EDPB 01/2019 · Final · First published 19 February 2019 · Final version 4 June 2019 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-12019-on-codes-of-conduct-and-monitoring-bodies-under-regulation_en) ## [Guidelines 4/2018 on the accreditation of certification bodies under Article 43](https://dposchool.com/gdpr/guidance/edpb-04-2018) EDPB 04/2018 · Final · First published 14 December 2018 · Final version 14 December 2018 Annex consulted publicly from 14 December 2018. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-42018-on-the-accreditation-of-certification-bodies-under-article-43_en) ## [Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-02-2018) EDPB 02/2018 · Final · First published 25 May 2018 · Final version 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-22018-on-derogations-of-article-49-under-regulation-2016679_en) ## [Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp251-rev-01) WP251 rev.01 · Final · Endorsed by the EDPB 25 May 2018 Date is the EDPB endorsement date. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/automated-decision-making-and-profiling_en) ## [Guidelines on the right to data portability](https://dposchool.com/gdpr/guidance/wp242-rev-01) WP242 rev.01 · Final · Endorsed by the EDPB 25 May 2018 Date is the EDPB endorsement date. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-on-the-right-to-data-portability-under-regulation-2016679-wp242_en) ## [Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk'](https://dposchool.com/gdpr/guidance/wp248-rev-01) WP248 rev.01 · Final · Endorsed by the EDPB 25 May 2018 Date is the EDPB endorsement date. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/data-protection-impact-assessments-high-risk-processing_en) ## [Guidelines on Data Protection Officers ('DPO')](https://dposchool.com/gdpr/guidance/wp243-rev-01) WP243 rev.01 · Final · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/data-protection-officer_en) ## [Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp253) WP253 · Final · Endorsed by the EDPB 25 May 2018 Still endorsed; complemented by EDPB Guidelines 04/2022 on calculation of fines. [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ## [Adequacy Referential](https://dposchool.com/gdpr/guidance/wp254-rev-01) WP254 rev.01 · Final · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ## [Working document setting up a table with the elements and principles to be found in Processor Binding Corporate Rules](https://dposchool.com/gdpr/guidance/wp257-rev-01) WP257 rev.01 · Final · Endorsed by the EDPB 25 May 2018 Still listed as endorsed. Draft EDPB Recommendations 1/2026 on processor BCRs are pending. [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ## [Recommendation on the standard application form for approval of Processor Binding Corporate Rules](https://dposchool.com/gdpr/guidance/wp265) WP265 · Final · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ## [Position paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR](https://dposchool.com/gdpr/guidance/wp29-art-30-5-position-paper) WP29 Art. 30(5) position paper · Final · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ## [Guidelines on transparency under Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp260-rev-01) WP260 rev.01 · Final · First published 11 April 2018 · Endorsed by the EDPB 11 April 2018 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/article-29-working-party-guidelines-on-transparency-under-regulation-2016679_en) ## Superseded Replaced by later guidance. Kept for reference; not listed on article pages. ### [Guidelines on consent under Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp259-rev-01) WP259 rev.01 · Superseded by [EDPB 05/2020](https://dposchool.com/gdpr/guidance/edpb-05-2020) · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ### [Guidelines on personal data breach notification under Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp250-rev-01) WP250 rev.01 · Superseded by [EDPB 09/2022](https://dposchool.com/gdpr/guidance/edpb-09-2022) · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-on-personal-data-breach-notification-under-regulation-2016679-wp250_en) ### [Guidelines for identifying a controller or processor's lead supervisory authority](https://dposchool.com/gdpr/guidance/wp244-rev-01) WP244 rev.01 · Superseded by [EDPB 08/2022](https://dposchool.com/gdpr/guidance/edpb-08-2022) · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-for-identifying-a-controller-or-processors-lead-supervisory_en) ### [Working document setting up a table with the elements and principles to be found in Binding Corporate Rules](https://dposchool.com/gdpr/guidance/wp256-rev-01) WP256 rev.01 · Superseded by [EDPB Rec 01/2022](https://dposchool.com/gdpr/guidance/edpb-rec-01-2022) · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ### [Recommendation on the standard application for approval of Controller Binding Corporate Rules](https://dposchool.com/gdpr/guidance/wp264) WP264 · Superseded by [EDPB Rec 01/2022](https://dposchool.com/gdpr/guidance/edpb-rec-01-2022) · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ### [Working document setting forth a co-operation procedure for the approval of BCRs](https://dposchool.com/gdpr/guidance/wp263-rev-01) WP263 rev.01 · Superseded by the EDPB document on the BCR co-operation procedure · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) This is reference material, not legal advice. ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / EDPB guidance Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents