The EDPS, like other EU institutions, bodies, agencies and offices (EU institutions), may process your personal data (also known as personal information) for a number of reasons, from dealing with public requests for information, staff matters, visitor information to the handling of complaints, to name but a few.
All EU institutions, including the EDPS, are obliged to comply with the data protection law specifically applicable to them.
In this section of our website, you will find information on how the EDPS processes personal data, on your rights when the EDPS processes your personal data and on our Data Protection Officer (DPO) team.
The EDPS, as all the other EU institutions, must maintain a register of records of activities under its responsibility involving processing (collection, storage, use etc.) of personal data.
The register has to be publicly accessible and must contain certain pieces of information explaining the purpose and conditions of the processing operations.
You can consult the register to understand how the EDPS processes personal data in the course of its activities.
When your personal information is processed by the EDPS (or any EU institution), you have the right to know about it.
You have the right to access the information and have it rectified without undue delay if it is inaccurate or incomplete.
Under certain conditions, you have the right to ask that we delete your personal data or restrict its use. Where applicable, you have the right to object to our processing of your personal data, on grounds relating to your particular situation, at any time, and the right to data portability. We will consider your request, take a decision and communicate it to you without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary.
You can request that we communicate, as possible, any changes to your personal data to other parties to whom your data have been disclosed.
You have also the right not to be subject to automated decisions (made solely by machines) affecting you, as defined by law.
You have, in any case, the right to have recourse to the EDPS as a supervisory authority.
You rights on your personal data are stated in Articles 17 to 24 of Regulation (EU) 2018/1725.
If the EDPS is processing your personal data and you would like to exercise your data protection rights, please send us a written enquiry.
In principle, we cannot accept verbal enquiries (telephone or face-to-face) as we may not be able to deal with your request immediately without first analysing it and reliably identifying you.
Your request should contain a detailed, accurate description of the personal data you want access to.
You must provide a copy of an identification document to confirm your identity, for example, an ID card or passport. The document should contain an identification number, country of issue, period of validity, your name, address and date of birth.
Any other data contained in the copy of the identification document such as a photo or any personal characteristics, may be blacked out.
Our use of the information on your identification document is strictly limited: we will only use the data to verify your identity and will not store them for longer than needed for this purpose.
In principle, we will not accept that you use other means to give evidence of your identity. Should you wish to propose alternatives, we will assess their adequacy on a case-by-case basis.