European Data Protection Board (EDPB)
The European Data Protection Board (EDPB) is the independent EU body established by Art. 68 GDPR to ensure the consistent application of the GDPR and the Law Enforcement Directive across the EU and EEA. It is composed of the heads of the national supervisory authorities and the European Data Protection Supervisor, with the European Commission attending without voting rights. It succeeded the Article 29 Working Party on 25 May 2018.
The EDPB adopts guidelines, recommendations and best practices; issues opinions on draft decisions of national authorities (for example on DPIA lists, BCRs and codes of conduct); and adopts binding decisions in disputes between authorities under the consistency mechanism (Art. 65), as it did in the Meta and TikTok cases. It has also issued opinions on adequacy decisions, including the EU-US Data Privacy Framework.
For life sciences, the key EDPB texts are Opinion 3/2019 on the interplay between the CTR and the GDPR (legal bases for clinical trial data), Guidelines 05/2020 on consent, Guidelines 07/2020 on controller and processor roles, Recommendations 01/2020 on supplementary measures for transfers, Guidelines 05/2021 on the notion of international transfer, the 2021 document on processing health data for research (in response to Commission questions), Guidelines 01/2025 on pseudonymisation and the 2025 Guidelines on the interplay between the AI Act and the GDPR. EDPB guidance is not binding on courts but is followed closely by authorities and is the reference against which DPIAs and policies are assessed.
