Source: EDPB
The European Data Protection Board (EDPB) has announced a major coordinated enforcement action for 2026, focused on how businesses inform people about the use of their personal data. According to the EDPB, 25 data protection authorities (DPAs) across Europe are taking part in this initiative, which was launched on 19 March 2026.
The action falls under the EDPB's Coordinated Enforcement Framework (CEF), which brings together DPAs from across EU member states to work on a shared compliance theme each year. This year, the focus is on transparency and information obligations under the GDPR, specifically the requirements set out in Art. 12, Art. 13 and Art. 14.
In plain terms, these articles require businesses to clearly tell people what personal data they collect, why they collect it, how long they keep it and what rights people have. This information typically appears in a privacy policy or privacy notice on a website.
According to the EDPB, the participating DPAs will contact controllers from different sectors across Europe. This contact may take the form of a formal enforcement action or a fact-finding exercise. If a DPA finds issues during a fact-finding exercise, it may decide to take further follow-up action.
Free website scan covering GDPR, copyright, accessibility, security, and more.
Scan your site freeThe Dutch Data Protection Authority (Autoriteit Persoonsgegevens) published its 2025 annual report on 2 April 2026, outlining enforcement actions and priorities across five focus areas.
Later in 2026, the participating DPAs will share their findings with each other. A consolidated report will then be drafted and submitted for adoption by the EDPB. The EDPB has indicated that targeted follow-ups are anticipated at both national and EU levels.
It is not yet known which sectors will be targeted, what criteria DPAs will use to assess compliance, or whether fines or sanctions will result from the actions.
If your website collects any personal data, such as names, email addresses or browsing behaviour, your privacy notice needs to meet the requirements of Art. 12, Art. 13 and Art. 14 of the GDPR. Now is a good time to review whether your privacy policy is complete, written in plain language and easy for visitors to find. You can use our GDPR compliance checklist and privacy policy requirements guide to check whether your current setup holds up.
Source: EDPB, 19 March 2026
The EDPB adopted its work programme for 2026-2027 during its latest plenary on 12 February 2026, focusing on easing compliance and strengthening cooperation.
De Autoriteit Persoonsgegevens ontving in 2025 ruim 13.000 privacyklachten en signalen, een stijging ten opzichte van 7100 in het jaar daarvoor.