EDPB - European Data Protection Board

The European Data Protection Board (EDPB) is the independent European Union body responsible for ensuring the consistent application of the General Data Protection Regulation (GDPR) across the European Economic Area. EDPB publishes binding guidelines, opinions, and recommendations that supervisory authorities and controllers across the EU must take into account.

What the EDPB Does

• Publishes guidelines on the interpretation and application of GDPR provisions
• Issues binding decisions in cross-border GDPR enforcement disputes
• Provides opinions on national supervisory authority decisions affecting multiple member states
• Approves codes of conduct and certification mechanisms
• Promotes cooperation and consistency among national supervisory authorities

Key EDPB Guidance for Incident Response

EDPB Guidelines 9/2022 on personal data breach notification (final version April 2023) replaces the earlier WP29 guidance and is the authoritative reference for GDPR Article 33 and 34 obligations. The document covers when the 72-hour clock starts, what counts as "becoming aware," when notification to individuals is required, and how to handle breaches across multiple jurisdictions.

EDPB vs National DPAs

Each EU/EEA member state has its own Data Protection Authority (DPA) that enforces GDPR within its jurisdiction. The EDPB is composed of the heads of all member-state DPAs plus the European Data Protection Supervisor. EDPB issues binding guidance; DPAs enforce it. In cross-border cases EDPB acts as a dispute-resolution mechanism under the GDPR consistency procedure.