# GDPR Article 68: European Data Protection Board

- Source: https://support.icompaas.com/support/solutions/articles/62000236414-gdpr-article-68-european-data-protection-board
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GDPR](https://support.icompaas.com/support/solutions/62000112722) › [Chapter VII: Cooperation and Consistency](https://support.icompaas.com/support/solutions/folders/gdpr-chapter-7-cooperation-and-consistency)
- Last updated: 2026-07-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Overview**

This article establishes the European Data Protection Board (EDPB) as a Union body with legal personality, composed of the heads of each Member State’s supervisory authority and the European Data Protection Supervisor (EDPS). The Chair of the Board represents it and communicates its activities to the European Commission, which participates without voting rights except in specific cases outlined under Article 65.

  

### **Key Principles**

-   Legal Personality: EDPB operates as an independent EU body.
    
-   Composition: Includes heads of all Member State supervisory authorities and the EDPS.
    
-   Representation: The Chair represents the Board and communicates with the Commission.
    
-   Commission Participation: Engages in Board activities without voting rights, except where Article 65 applies.
    
-   Coordination and Oversight: Facilitates consistent GDPR enforcement across the EU.  
      
    

### **Organizational Applicability**

This article applies to:

-   The European Data Protection Board and its members.
    
-   Supervisory authorities across all EU Member States.
    
-   The European Data Protection Supervisor and Commission representatives.
    
-   Teams supporting GDPR compliance, coordination, and cross-border enforcement.  
      
    

### **Implementation Requirements**

-   Formally establish the EDPB with legal personality under Union law.
    
-   Include all Member State supervisory authority heads and the EDPS in the Board.
    
-   Appoint a Chair to represent the Board and communicate with the Commission.
    
-   Define participation rights of the Commission, including voting exceptions under Article 65.  
      
    

### **Implementation Guidance**

-   Document the structure, roles, and responsibilities of the EDPB.
    
-   Establish procedures for communication with the Commission and supervisory authorities.
    
-   Train staff on Board functions, decision-making, and coordination protocols.
    
-   Periodically review Board operations to ensure effective GDPR oversight.  
      
    

### **Periodic Review**

-   Frequency: Annually or when structural, procedural, or membership changes occur.
    
-   Responsible Role: EDPB Chair, Board Secretariat, Compliance Teams.
    
-   Outcome: Ensure the Board functions effectively, represents Member States, and coordinates GDPR enforcement consistently.  
      
    

### **Non-Compliance Risks**

-   Fines: Up to €20 million or 4% of global annual turnover for supervised entities failing GDPR obligations.
    
-   Legal Exposure: Challenges arising from inconsistent GDPR application or Board procedural failures.
    
-   Reputational Damage: Loss of trust in the Board’s independence and effectiveness.
    
-   Operational Risk: Ineffective coordination may impede consistent cross-border GDPR enforcement.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): How the Regulation fits together as a programme — lawful bases, Article 28/30/32/33 obligations, transfers and the DPIA process.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If you also serve users in India, the DPDP Act borrows GDPR concepts but differs on consent, breach reporting and transfers.