Overview

This article requires supervisory authorities to submit draft decisions to the European Data Protection Board (EDPB) for an opinion on key matters, including Data Protection Impact Assessments (DPIAs), codes of conduct, certification criteria, standard contractual clauses, and Binding Corporate Rules (BCRs). The Board issues opinions within 8–14 weeks, and authorities must consider these opinions before finalizing decisions.


Key Principles

  • Board Consultation: Draft decisions are reviewed by the EDPB to ensure consistency.

  • Scope of Review: Includes DPIAs, codes of conduct, certifications, standard clauses, BCRs, and cross-border cooperation matters.

  • Timely Response: EDPB provides opinions within a defined period (8–14 weeks).

  • Consideration of Opinions: Supervisory authorities must take the Board’s opinions into account before finalizing decisions.

Organizational Applicability

This article applies to:

  • Supervisory authorities preparing draft decisions on GDPR compliance matters.

  • The European Data Protection Board reviewing draft decisions.

  • Controllers and processors impacted by draft decisions on DPIAs, codes, certifications, or BCRs.

  • Teams involved in compliance, legal review, and cross-border processing oversight.

Implementation Requirements

  • Submit draft decisions to the EDPB when required by GDPR Articles 35, 40, 41, 42, 43, 46, 47, 61, and 62.

  • Track EDPB opinions within the 8–14 week timeframe.

  • Document the Board’s opinions and how they were considered in the final decision.

  • Ensure draft decisions reflect compliance with GDPR and best practices.

Implementation Guidance

  • Maintain a register of draft decisions submitted to the EDPB.

  • Train staff on submission procedures, timelines, and incorporating feedback.

  • Review Board opinions thoroughly before finalizing and issuing decisions.

  • Coordinate with legal and compliance teams to ensure alignment with GDPR obligations.

Periodic Review

  • Frequency: Annually or when new draft decisions are prepared.

  • Responsible Role: Supervisory authority leadership, Compliance Team, or Legal.

  • Outcome: Ensure decisions are consistent, consider Board opinions, and comply with GDPR.

Non-Compliance Risks

  • Fines: Up to €20 million or 4% of global annual turnover for supervised entities.

  • Legal Exposure: Enforcement challenges if draft decisions ignore Board opinions.

  • Reputational Damage: Loss of trust due to inconsistent or non-compliant supervisory decisions.

  • Operational Risk: Delays or disputes in finalizing decisions may impact compliance and regulatory certainty.