European Data Protection Board

What the EDPB is

The European Data Protection Board (EDPB) is an independent European body with legal personality. It works to make sure the EU's General Data Protection Regulation (GDPR) is applied consistently. It does the same for the Law Enforcement Directive, which covers how criminal law enforcement authorities use personal data. The European Commission says the board was established by the GDPR. The Commission takes part in the board's meetings without a vote.

The board replaced the Article 29 Working Party. That group had handled privacy and data protection questions until May 25, 2018, when the GDPR began to apply.

Who sits on the board

The EDPB is made up of representatives of the EU's national data protection authorities and the European Data Protection Supervisor (EDPS). The EDPS monitors how EU institutions and agencies apply data protection rules. The regulators of Iceland, Liechtenstein and Norway are also members for GDPR matters. They cannot vote or be elected chair or deputy chair.

Anu Talus, Finland's Information Commissioner, has chaired the board since May 2023. Its two deputy chairs are Jelena Virant Burnik and Zdravko Vukić. The board's secretariat is based in Brussels and provided by the EDPS.

What the board does

National regulators enforce data protection law and cooperate on cross-border cases. The EDPB's listed tasks include:

• binding decisions that settle disputes between national regulators enforcing the GDPR
• guidelines, recommendations and best practices that explain EU data protection law
• opinions for the European Commission and for national regulators

One binding decision concerned Meta. In April 2023 the board settled a dispute over Meta's transfers of Facebook users' data outside the EU and the European Economic Area. The decision addressed whether a fine and a compliance order were warranted. On May 12, 2023, Ireland's regulator fined Meta €1.2 billion over those transfers, Meta's annual report says. Meta said in that report that it was appealing.

AI and smart glasses

The board has also issued guidance on AI. In December 2024 it adopted an opinion on using personal data to develop and deploy AI models. It covered when a model can be considered anonymous and when legitimate interest can serve as a legal basis. In July 2026 it announced guidelines on web scraping for generative AI. They are open for public comment until October 30, 2026.

On October 13, 2026, the board adopted Statement 1/2026 on smart glasses. It calls the text preliminary guidance for users, makers and service providers. It says makers and providers of linked apps cannot transfer their GDPR duties to users. Talus said the glasses should make recording obvious, for example with bright LED lights or audio signals. The board also published an outside expert's report on how people use the glasses. The smart glasses bans and rules tracker follows related steps by governments and regulators.