EDPB focuses its 2026 coordinated action on transparency in data use

The European Data Protection Board (EDPB) has selected transparency and the duty to inform as the subject of its fifth coordinated supervisory action. The initiative will address the obligations set out in Articles 12, 13 and 14 of the General Data Protection Regulation (GDPR), which specify how people must be informed when their personal data are processed. Announced on 14 October 2025, the initiative places the participating authorities’ work in 2026. It does not introduce a new obligation: it coordinates authorities’ attention to duties that are already part of the GDPR. Source: EDPB.

The distinction matters because the headline of a supervisory initiative can be mistaken for a legal reform, a judgment or a campaign of penalties. The announcement says none of those things is taking place. Instead, it describes a shared priority for data protection authorities, which may choose voluntarily to work on the topic; their national results will later be brought together and analysed. The news, therefore, is the selected focus and the coordination method, not a finding about the compliance status of companies or public bodies. As of the date of this article, the announcement provides no results from the reviews.

Under the GDPR, informing people does not simply mean publishing a long policy on a website. The EDPB links this action to the information duties in Articles 12, 13 and 14. Article 12 addresses how information is provided and how organisations communicate with people; Articles 13 and 14 concern the information that must be supplied when data are collected from the person concerned or obtained from another source. The choice of topic therefore points to an examination of how organisations explain data processing, not merely whether a document titled “privacy” exists. Source: EDPB.

The authority’s announcement presents the right to be informed as central to transparency and as a condition that can help people exercise greater control over their data. This gives the subject practical consequences: an explanation that does not make clear what happens to someone’s data may make it harder for that person to assess their options or exercise their rights. This is an interpretation of the stated objective, not a finding from inspections already published. The announcement does not identify any sectors, companies or specific practices as offenders, so attributing particular findings to it would go beyond the available evidence.

The EDPB explains that, in a coordinated action, the Board sets a priority topic for national authorities to work on in their respective areas. Participation is voluntary. At a later stage, national results are brought together and analysed to provide a broader picture and inform possible follow-up at national or European level. The announcement says the new action will be launched during 2026, but it does not specify a single start date or a shared inspection timetable. Source: EDPB.

This design combines a coordinated theme with implementation by individual authorities. It is not the same as one investigation directed from Brussels, nor does it mean every authority will examine identical cases on the same timetable. It is also useful to distinguish three stages: selecting a topic, the work each authority chooses to carry out, and the subsequent publication of aggregated conclusions. The available text supports the first stage and describes the others as planned steps, but it does not yet provide results from this cycle. Any figure for organisations reviewed or breaches detected would therefore need a specific later source.

For an organisation that processes personal data, the initiative signals supervisory attention to the way information is provided. It does not show that an inspection of that organisation has begun, and it is not a substitute for an individual legal assessment. As general guidance, it is reasonable to review whether explanations of processing are understandable and whether required information is provided at the appropriate time and in the relevant context. That is a practical recommendation arising from the announced topic, not a checklist prescribed by the announcement. The applicable obligation still depends on the GDPR and the circumstances of the processing.

For users, the immediate effect is not a new feature or an additional complaints mechanism announced by the EDPB. Its relevance is that authorities have decided to pay joint attention to whether people receive information about the use of their data. Anyone seeking to understand how a particular company handles their data will not find the answer in this news item alone: they will need to consult that organisation’s information and, where appropriate, contact the competent authority. The selection of a supervisory topic does not by itself establish that an organisation complies or fails to comply with the law.

The announcement dated October 2025 is a primary source for the EDPB’s decision and the framework it outlined. It is not a results report for the 2026 action. The page says that national action results are brought together and analysed to build knowledge and enable follow-up, but it does not say that every action will result in penalties or predict what conclusions will be reached. Until later publications appear, this material cannot substantiate how many authorities will take part, which organisations they will examine or what shortcomings they will find. Source: EDPB.

The most accurate reading is therefore specific but limited: Europe has chosen transparency and information for individuals as the priority for a coordinated action planned for 2026. This is a relevant signal for those designing data-processing procedures and privacy explanations, but it is neither a regulatory amendment nor a compliance assessment. The next useful information will document how the action is carried out and, later, what it finds. Until then, distinguishing what has been announced from what has been established avoids turning a supervisory priority into a conclusion unsupported by the source.