Policy on Consultations and Authorisations in the Field of Supervision and Enforcement

Replying to consultations from EU institutions, bodies, offices and agencies ('EUIs') in their capacity as controllers (organisations processing personal data) is one of the tasks of the EDPS as supervisory authority for the EUIs. Under Regulation (EU) 2018/1725, the data protection regulation for the EUIs, there are several situations in which EUIs can or have to consult the EDPS. In some cases, EUIs may want to obtain additional guidance on specific questions they face from the EDPS, while in others, they are obliged to consult (and in some cases, obtain authorisation from) the EDPS. This document provides practical tips on consulting the EDPS and on what kind of reply to expect.