Data Protection Monitor
Global Privacy & Data Protection Intelligence

European Economic Area (EEA) · Module Detail

European Economic Area: Controller/Processor Duties

← Full European Economic Area overview Build report with European Economic Area Request deeper dive

#

Baseline obligations are stable and well-enforced, but simplification proposals (still in trilogue) will materially change SME/SMC recordkeeping and breach-notification thresholds once adopted.

Primary frameworkGDPR Articles 24-39 (Regulation (EU) 2016/679); Digital Omnibus (COM(2025) 836 final)
Supervisory authorityNational DPAs (e.g. CNIL for the IQVIA health-data fine); EDPB coordination
Traffic-light rationale — AmberBaseline obligations are stable and well-enforced, but simplification proposals (still in trilogue) will materially change SME/SMC recordkeeping and breach-notification thresholds once adopted.

Sub-modules (7)

Category narrative262 words

Chapter IV (Arts. 24–43) GDPR establishes harmonised accountability obligations across all 30 EEA jurisdictions: Data Protection by Design and by Default (Art. 25; enforced in CJEU Case C-446/21 Schrems v Meta as requiring strict purpose-bounded data compartmentalisation), Joint Controller arrangements (Art. 26), mandatory Processor agreements and prior authorisation for sub-processors (Art. 28; reinforced by EDPB Opinion 22/2024 of 7 October 2024 requiring controllers to identify and verify safeguards down the entire sub-processor chain), written electronic Records of Processing Activities (Art. 30 ROPA), risk-based security measures (Art. 32), mandatory DPO designation where Art. 37(1) criteria or stricter national thresholds (such as Germany's § 38 BDSG 20-employee rule) apply, and Data Protection Impact Assessments (Art. 35 DPIA) prior to high-risk processing (the EDPB's 2025 Coordinated Enforcement Framework action focused on Art. 17 erasure, following its 2024 action on Art. 15 access and 2023 action on DPOs). Personal data breaches must be notified to the competent DPA within 72 hours under Art. 33 unless unlikely to result in a risk, and communicated to data subjects without undue delay under Art. 34 where high risk is likely. Under the proposed Digital Omnibus Regulation COM(2025) 837 final (19 November 2025; legislative proposal, NOT yet in force), the Commission has proposed raising the Art. 33 DPA breach-notification threshold to 'high risk', extending the reporting deadline from 72 to 96 hours via the ENISA Single Entry Point built for NIS2/DORA/CER, and expanding the Art. 30(5) ROPA exemption from <250 employees to small mid-cap enterprises (<750 employees) unless processing is likely to result in a high risk under Art. 35.

Sources and claims (4)
  1. ConfirmedEDPB — As part of its 2026-2027 work programme, the EDPB is developing ready-to-use EU templates for legitimate interest assessments, records of processing, privacy notices, data breach notifications and data protection impact assessments to facilitate compliance.observed
  2. Confirmedunavailable — The Commission's Digital Omnibus proposal would amend Article 30(5) GDPR to raise the records-of-processing exemption threshold from enterprises/organisations under 250 employees to those under 750 employees, unless the processing is likely to result in high risk to individuals.
  3. ConfirmedEDPB — EDPB guidance explains how pseudonymisation, alongside encryption, functions as a technical safeguard supporting Article 32 security-of-processing obligations and Article 25 data protection by design.observed
  4. Confirmedunavailable — The EDPB and EDPS support the Digital Omnibus proposal to increase the risk threshold that triggers the Article 33 duty to notify a personal data breach to the competent DPA, and to extend the notification deadline, alongside introducing common breach-notification and DPIA templates.