Decision 01/2026 of the European Data Protection Supervisor of 16 January 2026 adopting the rules on the application of the requirement of prior consent by the EDPS for the dismissal of Data Protection Officers [2026/199]

Official Journal EN of the European Union L series 2026/199 29.1.2026 DECISION01/2026 OF THE EUROPEAN DATA PROTECTION SUPERVISOR of 16 January 2026 adopting the rules on the application of the requirement of prior consent by the EDPS for the dismissal of Data Protection Officers [2026/199] THE EUROPEAN DATA PROTECTION SUPERVISOR, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC(1)(the ‘Regulation’, or ‘EUDPR’), and in particular Articles 44(8) and 58(1)(a), Having regard to Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA(2) (Europol Regulation), and in particular Articles 41a(8), 43(1) and 43(4)(a) thereof, Having regard to Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA(3)(Eurojust Regulation), and in particular Articles 36(4), 40(1) and (4) thereof, Having regard to Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’)(4) (EPPO Regulation), and in particular Articles 48(1), 77(4), 85(1) and (4) thereof,

Whereas:

(1) The Treaty on the Functioning of the European Union provides that an independent authority is to control the compliance with the rules on protection of personal data processed by Union institutions, bodies, offices and agencies (‘Union institutions and bodies’).

(2) Regulation (EU) 2018/1725 established the European Data Protection Supervisor (EDPS) that is responsible for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies. To this effect, the EDPS monitors and enforces the application of that Regulation by such Union institutions and bodies.

(3) The Regulation provides for the compulsory designation of a Data Protection Officer (‘DPO’) in each Union institution, body, office and agency. This compulsory designation requirement is also provided for by Regulations

(EU) 2016/794, (EU) 2018/1727 and (EU) 2017/1939.

(4) Given the central role of the DPO in advising the controller and monitoring the application of the rules governing the processing of personal data, it is essential that DPOs remain able to perform their tasks independently and effectively in all contexts. This is equally important in relation to the processing of administrative personal data relating to the internal functioning of Union institutions and bodies, as well as for operational personal data processed in the performance of Union institutions and bodies tasks when carrying out activities which fall within the scope of

Chapter 4 or Chapter 5 of Title V of Part Three TFEU to meet the objectives and tasks laid down in the legal acts establishing those bodies, offices or agencies. The DPO’s ability to provide impartial advice, monitor compliance, and act as a point of contact for data subjects and the EDPS should therefore be safeguarded and effectively supported.

(1) OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj.

(2) OJ L 135, 24.5.2016, p. 53, ELI: http://data.europa.eu/eli/reg/2016/794/oj.

(3) OJ L 295, 21.11.2018, p. 138, ELI: http://data.europa.eu/eli/reg/2018/1727/oj.

(4) OJ L 283, 31.10.2017, p. 1, ELI: http://data.europa.eu/eli/reg/2017/1939/oj.

ELI: http://data.europa.eu/eli/proc_rules/2026/199/oj 1/7EN OJ L, 29.1.2026

(5) The independence of the DPO is a structural guarantee essential for ensuring compliance with the applicable provisions on data protection and enabling the DPO to perform their statutory duties without fear of retaliation.

Protecting DPO independence is a prerequisite for an effective data protection governance framework within the Union institutions and bodies and an important safeguard for individuals’ fundamental rights under Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.

(6) To that end, the Regulation provides that a designated DPO may only be dismissed from their post only if they no longer fulfil the conditions required for the performance of their duties, and only with the prior consent of the EDPS. In addition, the Regulation establishes that a DPO may not be dismissed or penalised by the controller or processor for performing their tasks. Equivalent requirements apply to the DPOs of Europol, Eurojust and the EPPO under their respective legal frameworks. The Court of Justice has also clarified that the prohibition of the dismissal, by a controller or processor, of a data protection officer or of the imposition, by a controller or processor, of a penalty on him or her means that that officer must be protected against any decision terminating his or her duties, by which he or she would be placed at a disadvantage or which would constitute a penalty(5).

(7) Any intended dismissal of a DPO should therefore subject to a clear, predictable and fair procedure allowing the EDPS to verify whether the legal conditions are fulfilled, and in particular whether the intended dismissal is based on objective grounds that do not impair the independence or the effective performance of the DPO’s tasks.

(8) In light of the experience acquired by the EDPS concerning enforcement of the provisions concerning DPOs, and in particular in order to ensure the consistent application of the EDPS prior consent requirement for the dismissal of DPOs across all Union institutions and bodies, and to prevent any circumvention of the mandatory requirement for prior EDPS consent, the information to be provided to allow the EDPS to perform its task should be laid down in advance for all Union Institutions and bodies in a clear and foreseeable manner.

(9) In the interest of legal certainty, the EDPS should also clarify how the right to be heard of the DPO concerned and of the Union institution and body should be ensured and should also specify the conditions under which the EDPS will give or refuse consent.

(10) It is also necessary to clarify how the EDPS will ensure a rapid intervention where the independence of the DPO concerned may be at imminent risk, for instance in situations involving possible retaliatory action, threats of dismissal or other circumstances requiring immediate EDPS action in the public interest and in the interest of the DPO concerned. In these situations, the importance of ensuring that consent is correctly requested and thus ensuring the lawfulness of the dismissal justifies a swift exercise of the powers of the EDPS, without prejudice to any legal remedy available.

(11) It is therefore appropriate to set out in a single instrument the information that EUIs should provide for the EDPS to assess requests for prior consent to DPO dismissals, together with the rules governing the submission and examination of such requests, the applicable deadlines, transparency and publication requirements, and the corrective measures typically applied in case of non-compliance,

HAS ADOPTED THIS DECISION:

Article 1 The rules on the application of the requirement of prior consent by the EDPS for the dismissal of Data Protection Officers are laid down in the Annex to this Decision.

Article 2 These rules apply to all Union institutions and bodies under the supervisory competence of the EDPS.

(5) Judgment of the Court of 22 June 2022, C-534/20, Leistritz AG, ECLI:EU:C:2022:495, paragraph 21.

2/7 ELI: http://data.europa.eu/eli/proc_rules/2026/199/ojEN OJ L, 29.1.2026 Article 3 This Decision shall enter into force on the twentieth day following its publication in the Official Journal of the European Union.

Done at Brussels, 16 January 2026.

For the EDPS Wojciech Rafał WIEWIÓROWSKI European Data Protection Supervisor

ELI: http://data.europa.eu/eli/proc_rules/2026/199/oj 3/7EN OJ L, 29.1.2026 ANNEX Rules on the application of the requirement of prior consent by the EDPS for the dismissal of Data Protection Officers

1. Purpose and scope

1.1. This procedure governs the modalities through which a Union institution, body, office or agency (‘EUI’) can obtain the prior consent of the European Data Protection Supervisor (‘EDPS’) before dismissal of its designated Data Protection Officer (‘the DPO concerned’) from its post, pursuant to Article 44(8) of Regulation (EU) 2018/1725 (EUDPR).

1.2. This procedure shall also apply to:

(a) the European Union Agency for Law Enforcement Cooperation (Europol) in application of Article 41a(8) of Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA(1)(Europol Regulation);

(b) the European Union Agency for Criminal Justice Cooperation (Eurojust) in application of Article 36(4) of Regulation

(EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA(2) (Eurojust Regulation);

(c) the European Public Prosecutor’s Office (the EPPO) in application of Article 77(4) of Council Regulation

(EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’)(3)(EPPO Regulation).

1.3. ‘Dismissal’ shall refer to an official administrative decision by the EUI to terminate the DPO’s term before its natural expiry as set out in the DPO’s designation decision, taken on the initiative of the EUI and not of the DPO.

1.4. This procedure shall apply to any act or decision of an EUI that removes the designated DPO from their functions, irrespective of whether the underlying employment relationship continues.

2. Obligation to request the EDPS consent

2.1. Where an EUI intends to dismiss its DPO concerned, it shall request the EDPS’s prior consent for that intended dismissal (‘request’) without delay. The EUI should inform the DPO concerned of the submission of the request.

2.2. The EUI shall submit the request to the EDPS by encrypted email (supervision@edps.europa.eu) or by any other secure communication channel agreed with the EDPS.

2.3. The request must be complete and shall contain all information necessary for the EDPS to assess whether the conditions for consent are fulfilled. The request shall include, as a minimum:

(a) the name and contact details of the EUI;

(b) the name and contact details of the DPO concerned;

(c) the term of the DPO’s designation and its scheduled expiry date;

(d) the EUI’s justification for its intention to dismiss the DPO concerned;

(e) the EUI’s explanation as to why the DPO concerned no longer fulfils the conditions required for the performance of their duties;

(1) OJ L 135, 24.5.2016, p. 53, ELI: http://data.europa.eu/eli/reg/2016/794/oj.

(2) OJ L 295, 21.11.2018, p. 138, ELI: http://data.europa.eu/eli/reg/2018/1727/oj.

(3) OJ L 283, 31.10.2017, p. 1, ELI: http://data.europa.eu/eli/reg/2017/1939/oj.

4/7 ELI: http://data.europa.eu/eli/proc_rules/2026/199/ojEN OJ L, 29.1.2026

(f) any grounds for dismissal unrelated to the performance of DPO duties;

(g) all relevant supporting documentation (e.g. DPO designation, decisions, performance appraisals, organisational charts, job descriptions, codes of conduct, internal correspondence or minutes that would justify the dismissal decision and, where applicable, any ongoing or concluded internal/external investigations or court proceedings);

(h) the EUI’s formal commitment not to proceed with the dismissal pending the EDPS’s decision under this procedure and to maintain the DPO’s functions, access, responsibilities and resources unchanged.

2.4. If available, the request shall also include any evidence demonstrating that the intended dismissal does not amount to a penalisation of the DPO for performing their tasks, in line with Article 44(3) EUDPR;

2.5. If a request does not comply with any of the requirements set out in points 2.2 and 2.3, the EDPS shall issue a formal notice to comply with those provisions within a prescribed time limit.

2.6. If the EUI fails to put the request in order within the time limit prescribed under point 2.5, the EDPS shall consider the request formally inadmissible and shall deny the consent.

2.7. Following submission of a complete request, the EDPS shall not take into account further submissions by the concerned EUIs.

2.8. By way of derogation from point 2.7, the EDPS may take into account submissions subsequent to the request submitted in accordance with point 2.3 where they contain:

(a) relevant facts which were not known to the EUI at the moment of submitting the request; or

(b) a reasoned justification for submitting the relevant facts following submission of a complete request.

3. Right to be heard

3.1. The EDPS may request additional information from the EUI and from the DPO concerned and shall prescribe a time limit for reply in writing. The EUI and the DPO concerned shall cooperate fully and within the time limits set by the EDPS.

3.2. Before deciding on its consent, the EDPS shall give the DPO concerned the opportunity to be heard by communicating the intended decision to them, together with a summary of the reasons justifying that decision.

3.3. Before deciding on its consent, the EDPS may give the EUI concerned the opportunity to be heard upon a reasoned request detailing the reasons for which the submissions under Section 2 are not sufficient to present the concerned EUI’s views.

3.4. The EDPS may hold a hearing on its own initiative or upon a reasoned request from the EUI or the DPO concerned, submitted together with comprehensive written observations.

3.5. The EDPS may refuse a hearing where, after assessing the completeness of written submissions and the usefulness of an oral hearing for establishing the relevant facts, it deems the EUI’s or the DPO concerned have already been able to present all relevant facts, or where their views can be or have been effectively presented in writing.

3.6. Where a hearing is held, the EDPS Decision of 27 September 2023 on the Rules on the Hearing in EDPS Investigations(4)applies by analogy.

(4) Available on the EDPS website: https://www.edps.europa.eu/data-protection/our-work/publications/investigations/2023-09-27-rules- hearing-edps-investigations_en.

ELI: http://data.europa.eu/eli/proc_rules/2026/199/oj 5/7EN OJ L, 29.1.2026

4. Conditions to be assessed by the EDPS

4.1. The EDPS assesses whether at the time of the request the DPO concerned no longer fulfils the conditions required for the performance of their duties, including as regards the following:

(a) absence of professional qualities and expertise in data protection law and practice sufficient to perform the role (Article 43(3) EUDPR);

(b) inability to perform the tasks assigned to DPOs under the EUDPR (Article 45 EUDPR) (e.g. informing/advising, monitoring compliance, cooperating with the EDPS);

(c) whether the intended dismissal does not aim to penalise the DPO for performing their tasks (Article 44(3), last sentence EUDPR).

4.2. Where applicable, the EDPS will also take into consideration grounds unrelated to the performance of DPO duties that the EUI may put forward to justify the intended dismissal.

5. Decision on consent

5.1. Where the EDPS finds that the DPO concerned no longer fulfils the conditions required for the performance of their duties, it shall give consent to the intended dismissal. Where the EDPS finds that the DPO concerned continues to fulfil the conditions required for the performance of their duties, the EDPS shall refuse consent to the intended dismissal.

5.2. The EDPS shall also give consent to the intended dismissal where the EDPS is satisfied that the EUI demonstrates objective and proportionate grounds, unrelated to the performance of DPO duties, which do not directly or indirectly undermine the independence and effective performance of DPO tasks within the EUI.

5.3. The EDPS shall not give retroactive consent; any consent given applies for the future.

6. Timing and notification

6.1. The EDPS shall notify the EUI and the DPO concerned of its decision, as a general rule within six weeks of the receipt of the complete request or of the expiry of the time limit referred to in point 2.5.

6.2. Where necessary, taking into account the complexity of the request and the level of cooperation of the EUI, the period referred to in point 6.1 may be extended by the EDPS by up to two further periods of eight weeks.

7. Publication and annual reporting

7.1. The EDPS shall inform the DPOs of the EUIs of its decisions taken on the basis of Article 44(8) EUDPR, Article 41a(8) Europol Regulation, Article 36(4) Eurojust Regulation and Article 77(4) EPPO Regulation, as applicable.

7.2. The EDPS shall make a redacted or summarised version of its decision public, taking into account any legitimate interests, in particular as regards the protection of personal data, rights and freedom of others, confidentiality, professional and business secrecy or public security.

7.3. The EDPS shall report in its annual report pursuant to Article 60 EUDPR on the operation of the present Rules.

8. Corrective measures

8.1. Where the EDPS has sufficiently substantiated reasons to believe that an EUI intends to dismiss its designated DPO from their post without first obtaining the EDPS’s prior consent, including on the basis of information from the DPO concerned, the EDPS shall take an immediate decision to refer the matter to the EUI in accordance with Article 58(2)(c) EUDPR, Article 43(3)(g) of the Europol Regulation, Article 40(3)(b) of the Eurojust Regulation or Article 85(3)(d) of the EPPO Regulation, as applicable. In doing so, the EDPS shall indicate that any dismissal by the EUI of its designated DPO without having obtained the EDPS’s prior consent would constitute an infringement of Article 44(8) EUDPR, Article 41a(8) of the Europol Regulation, Article 36(4) of the Eurojust Regulation or Article 77(4) of the EPPO Regulation, as applicable.

6/7 ELI: http://data.europa.eu/eli/proc_rules/2026/199/ojEN OJ L, 29.1.2026

8.2. An immediate decision is warranted, in particular, where:

(a) the DPO concerned faces imminent dismissal;

(b) there is credible evidence of retaliation linked to the performance of DPO tasks;

(c) delay would risk causing irreversible harm to the independence of the DPO function; or

(d) any other measure is taken or envisaged that could impair the independence or the effective performance of DPO tasks.

8.3. Where the EDPS finds that an EUI has dismissed its designated DPO from their post without having obtained the EDPS’s prior consent, the EDPS shall:

(a) notify the EUI of the EDPS finding that the dismissal of its designated DPO without having obtained the EDPS’s prior consent constitutes an infringement of Article 44(8) EUDPR, Article 41a(8) of the Europol Regulation, Article 36(4) of the Eurojust Regulation or Article 77(4) of the EPPO Regulation, as applicable, as well as of any other relevant provisions found to be breached; and

(b) order the EUI to bring the situation into compliance by annulling the dismissal and by submitting a consent request in accordance with the present procedure, within a specified period, in accordance with Article 58(2)(e) EUDPR or Article 43(3)(j) of the Europol Regulation, as applicable; and

(c) inform the EUI that failure to comply with an order by the EDPS pursuant to Article 58(2)(e) EUDPR or Article 43(3)(j) of the Europol Regulation, as applicable are, subject to administrative fines of up to EUR 25 000 per infringement and up to a total of EUR 250 000 per year, in accordance with Article 66(1) and (2) EUDPR, or Article 43(3)(l) of the Europol Regulation, as applicable; and

(d) use any other EDPS corrective powers necessary in light of the particular circumstances of the specific case.

8.4. Article 18(1) to (6) and (8) of the EDPS Rules of Procedure shall not apply to the corrective powers exercised in accordance with points 8.1 and 8.3.

8.5. The provisions of this section are without prejudice to the use of any other EDPS corrective powers considered appropriate in light of the particular circumstances of the specific case.

ELI: http://data.europa.eu/eli/proc_rules/2026/199/oj 7/7