DATA PROTECTION | EDPB approves first EU data protection seal for data transfers

On 15 April 2026, the European Data Protection Board (EDPB) adopted Opinion 14/2026 and Opinion 15/2026 concerning the Europrivacy certification scheme, further advancing the operational use of certification mechanisms under the GDPR.

Through Opinion 14/2026, the EDPB approved version 82 of the Europrivacy certification criteria (the certification criteria) as a European Data Protection Seal under Article 42(5) GDPR. Originally recognised through EDPB Opinion 28/2022 as the first European data protection seal, the updated scheme now extends to controllers and processors established outside the EEA but subject to Article 3(2) GDPR, including organisations offering goods or services to individuals in the EU or monitoring their behaviour. The updated criteria further introduce additional requirements concerning further processing assessments, Article 27 GDPR representatives and legal assessments of third-country laws and practices affecting GDPR compliance.

In parallel, through Opinion 15/2026, the EDPB recognised Europrivacy, for the first time, as a certification mechanism that may be used as international data transfers under Articles 42 and 46 GDPR. The scheme is specifically addressed to non-EEA data importers not directly subject to the GDPR and may serve as an “appropriate safeguard” for international transfers, provided that binding and enforceable commitments are undertaken by the importer. The transfer-oriented criteria require organisations to, inter alia: (a) map data flows, (b) identify onward transfers; (c) conduct Transfer Impact Assessments (TIAs); (d) assess third-country legislation; and (e) implement supplementary safeguards where necessary. The EDPB clarified that certification remains voluntary and does not exempt organisations from broader GDPR accountability obligations or supervisory scrutiny.

Newsletter n. 118 – May 2026