On October 14, 2025, the European Data Protection Board (“EDPB”) announced that its 2026 coordinated enforcement action (“CEA”) will focus on transparency and information obligations — the rules that require organizations to clearly explain how they collect, use, and share personal data — under Articles 12-14 of the General Data Protection Regulation (“GDPR”).

Each year, the EDPB selects a GDPR-related topic for national data protection authorities across Europe to examine jointly. These actions allow authorities to work together — sharing insights, aligning approaches, and sometimes conducting joint investigations — to ensure consistent enforcement of the GDPR across the EEA. Previous topics have included the designation and role of data protection officers, as well as the implementation of the rights of access and erasure by controllers.

What Can Companies Expect from the 2026 CEA?

If your company is subject to the GDPR, here’s what you might expect from the upcoming CEA on transparency:

  • You may receive a questionnaire from your national data protection authority. This will ask how your organization informs individuals about the use of their personal data, for example, through privacy notices or other communications.
  • The questionnaire may be mandatory or optional, depending on how your authority decides to use it, either as part of an investigation or simply to gather information.
  • Authorities will review the responses to identify common issues or gaps in compliance. Based on what they find, they may publish guidance, offer training, or take further action.
  • Some companies may face investigations if their responses raise concerns. These investigations can lead to formal warnings, orders to change practices, or fines.

In short, companies should be prepared to explain how they meet transparency requirements under the GDPR, and to take action if their practices fall short.

What’s Next?

Authorities are expected to join the transparency-focused CEA in the coming weeks, with the initiative launching in 2026. Since transparency has long been a priority for regulators, this year’s action may lead to more investigations and stricter penalties than in previous years.

Recent enforcement decisions have also highlighted growing regulatory expectations around the level of detail required in privacy notices. For example, some authorities have taken the position that organizations should explicitly identify each third country to which personal data is transferred. These developments suggest that transparency obligations under Articles 13 and 14 GDPR may be interpreted more stringently going forward.

*          *          *

Covington’s Data Privacy and Cybersecurity team regularly advises companies on GDPR compliance, including transparency obligations and data subject rights. We’re happy to assist with responding to supervisory authority questionnaires and other inquiries.

Photo of Dan Cooper Dan Cooper

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing…

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing clients in regulatory proceedings before privacy authorities in Europe and counseling them on their global compliance and government affairs strategies. Dan regularly lectures on the topic, and was instrumental in drafting the privacy standards applied in professional sport.

According to Chambers UK, his “level of expertise is second to none, but it’s also equally paired with a keen understanding of our business and direction.” It was noted that “he is very good at calibrating and helping to gauge risk.”

Dan is qualified to practice law in the United States, the United Kingdom, Ireland and Belgium. He has also been appointed to the advisory and expert boards of privacy NGOs and agencies, such as the IAPP’s European Advisory Board, Privacy International and the European security agency, ENISA.

Read more about Dan Cooper
Show more Show less
Photo of Anna Sophia Oberschelp de Meneses Anna Sophia Oberschelp de Meneses

Anna Sophia Oberschelp de Meneses advises on EU data protection, cybersecurity, and consumer law. Her practice covers the full range of Europe’s digital regulatory framework, including GDPR, ePrivacy, NIS2, the Cyber Resilience Act, the AI Act, the Digital Services Act, the Data Act…

Anna Sophia Oberschelp de Meneses advises on EU data protection, cybersecurity, and consumer law. Her practice covers the full range of Europe’s digital regulatory framework, including GDPR, ePrivacy, NIS2, the Cyber Resilience Act, the AI Act, the Digital Services Act, the Data Act, the European Health Data Space, and EU consumer protection law, including product safety, product liability, and consumer rights legislation. She focuses on the operational side of compliance — helping clients design policies and processes, draft documentation, and build the internal frameworks needed to meet regulatory requirements in practice.

She also advises on contentious matters, drawing on experience managing investigations before national regulators and proceedings before national courts and the Court of Justice of the European Union. She works closely with Covington’s disputes teams on matters at the intersection of regulatory compliance and litigation.

Read more about Anna Sophia Oberschelp de MenesesAnna Sophia's Linkedin Profile
Show more Show less
Photo of Alix Bertrand Alix Bertrand

Alix advises clients on EU data protection and technology law, with a particular focus on French privacy and data protection requirements. She regularly assists clients in relation to international data transfers, direct marketing rules as well as IT and data protection contracts. Alix…

Alix advises clients on EU data protection and technology law, with a particular focus on French privacy and data protection requirements. She regularly assists clients in relation to international data transfers, direct marketing rules as well as IT and data protection contracts. Alix is a member of the Paris and Brussels Bars.

Read more about Alix Bertrand
Show more Show less