Предложение по Регламенту Европейского парламента и Совета о внесении изменений в Регламент (ЕС) 2018/1725 о защите физических лиц при обработке персональных данных учреждениями, органами, службами и агентствами Союза и о свободном перемещении таких данных

2026/0173 (COD)

Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulation (EU) 2018/1725 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national Parliaments, Acting in accordance with the ordinary legislative procedure, Whereas:

(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her. This right is also guaranteed under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms.

(2) Regulation (EU) 2018/1725 of the European Parliament and of the Council

3

(1) establishes the legal framework for the processing of personal data by Union institutions, bodies, offices and agencies. However, the data protection rules on the processing of operational personal data of by Union bodies, offices and agencies when carrying out activities which fall within the scope of Chapter 4 o r Chapter 5 of Title V of Part Three TFEU remain laid down in a fragmented manner between Chapter IX of Regulation (EU) 2018/17/25 and other Union legal acts. Article 98 of th at Regulation requires the Commission to review the rules applicable to the processing of operational personal data, with a view to identify ing possible inconsistencies, gaps and divergences. It also provides that the Commission, where appropriate, addresses identified shortcomings by a legislative proposal, in particular to extend the application of Chapter IX to the European Public Prosecutor’s Office ( EPPO ) established by Council Regulation (EU) 2017/1939

4

(2) , as appropriate, and to introduce the necessary adapt at ions to that Chapter. In its first application report on the Regulation (EU) 2018/1725, the Commission confirmed the Regulation's overall effectiveness in ensuring a high level of protection of personal data, while highlighting a number of inconsistencies, divergencies and legal fragmentation arising from the interplay between Chapter IX and the other provisions of Regulation (EU) 2018/1725 , as well as the existence of a standalone data protection regime for the EPPO.

(3) Currently, only Article 3 and Chapter IX of Regulation (EU) 2018/1725 apply to the processing of operational personal data, together with a number of specific data protection rules laid down in the founding acts of the European Union Agency for Law Enforcement Cooperation ( Europol ) and the European Union Agency for Criminal Justice Cooperation ( Eurojust ) . At the same time, the EPPO has its own, standalone data protection regime in its founding act. Therefore, Regulation (EU) 2018/1725 should be amended in order to extend the application of its Chapter IX to all Union bodies, offices and agencies processing operational personal data in the law enforcement and criminal justice sector, to ensure legal certainty by addressing gaps in the current data protection regime, in particular for the European Border and Coast Guard Agency and to streamline the rules on international transfers of personal data, as well as the rules on the powers of the European Data Protection Supervisor. That should not affect the possibility to keep, in Regulation (EU) 2017/1939, the specific data protection rules needed to reflect the unique nature of the EPPO as the independent public prosecutor's office of the Union.

(4) In order to create a harmonised, consistent, simplified and complete legal framework for processing of operational personal data by Union bodies, offices and agencies, the definitions (Chapter I) , the rules on data protection officers (Section 6 of Chapter IV) , the rules on cooperation and consistency (Chapter VII), the rules on remedies, liability and penalties (Chapter VIII) and the rules on processing of operational personal data ( which should be aligned with Directive (EU) 2016/680 of the European Parliament and of the Council 5 (3) – Chapter IX) laid down in Regulation (EU) 2018/1725 should apply to Union bodies, offices and agencies when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU. Th o se rules should apply where they exercise such activities for the purposes of the prevention, detection, investigation or prosecution of criminal offences. Those rules , , should also apply to the processing of operational personal data by the European Border and Coast Guard Agency , rather than only Chapter IX of Regulation (EU) 2018/1725 . The rules of Regulation (EU) 2018/1725 should apply without affecting the specific rules applicable to the processing of operational personal data by Union bodies, offices and agencies when carrying out activities falling within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU , in particular the rules laid down in the founding acts of Europol , Eurojust and EPPO . Such specific rules should be regarded as lex specialis to the provisions of Regulation (EU) 2018/1725 on the processing of operational personal data.

(5) A data protection officer within all Union institutions and bodies should ensure that all data protection rules, including Regulation (EU) 2018/1725 are applied. Officers should also advi s e controllers and processors as to their obligations. In order to ensure consistency and prevent duplication, in matters of both administrative and operational personal data, there should be only one set of rules for data protection officers.

(6) The European Data Protection Supervisor should, as a measure of last resort, have the power to impose administrative fines, including for processing of operational personal data by Union bodies, offices and agencies active in the area of law enforcement and criminal justice.

(7) In order to avoid duplication within Regulation (EU) 2018/1725, Article 70 thereof should be deleted, as the scope of Chapter IX is already regulated in Article 2 of Regulation (EU) 2018/1725.

(8) In order to ensure the alignment with Regulation (EU) …/… [ the Digital Omnibus proposal ] , it should be clarified in Article 77 of Regulation (EU) 2018/1725 that decisions based solely on automated processing of operational personal data are allowed when specific conditions are met.

(9) In order to ensure the alignment with Regulation (EU) …/… [ the Digital Omnnibus proposal ] , it should be clarified in Article 78 of Regulation (EU) 2018/1725 that the right of access, which is from the outset favourable to data subjects , should not be abused in the sense that the data subjects abuse them for purposes other than the protection of their data.

(10) In order to demonstrate compliance with Regulation (EU) 2018/1725, Union bodies, offices and agencies active in the area of law enforcement and criminal justice should have uniform rules on maintaining records regarding all categories of processing activities under their responsibility. Each controller and processor should be obliged to cooperate with the European Data Protection Supervisor and make those records available to it on request, so that they might serve for monitoring those processing operations.

(11) Union bodies, offices and agencies should not be able to modify logs. Where Union bodies, offices and agencies receive operational personal data from national competent authorities, the Union bodies, offices and agencies should communicate the logs to those authorities, when they are necessary for internal data protection compliance investigations.

(12) In order to ensure the alignment with Regulation (EU) …/… [ the Digital Omnibus proposal ] , the threshold should be higher and a deadline should be prolonged, for notifying a personal data breach to the European Data Protection Supervisor.

(13) Union bodies, offices and agencies active in the area of law enforcement and criminal justice should all benefit from a uniform set of rules on international transfers of operational personal data, aligned with Directive (EU) 2016/680.

(14) The Commission may decide, under Article 36 of Directive (EU) 2016/680, that a third country, a territory or specified sector within a third country or an international organisation offers an adequate level of data protection. In such cases, transfers of operational personal data to that third country or international organisation by Union bodies, offices and agencies can take place without the need to obtain any further authorisation.

(15) Transfers not based on such an adequacy decision should be allowed only where appropriate safeguards have been provided in a legally binding instrument which ensures the protection of personal data or where the controller has assessed all the circumstances surrounding the data transfer and, on the basis of that assessment, considers that appropriate safeguards with regard to the protection of personal data exist. Such legally binding instruments could, for example, be cooperation agreements between Eurojust and a third country concluded before 12 December 2019 in accordance with Article 26a of Decision 2002/187/JHA , cooperation agreements between Europol and a third country concluded before 1 May 2017 in accordance with Article 23 of Decision 2009/371/JHA , or international agreements concluded between the Union and a third country pursuant to Article 218 TFEU.

(16) Where no adequacy decision or appropriate safeguards exist, a transfer or a category of transfers could take place by derogation in specific situations. D erogations should be interpreted restrictively and should not allow frequent, massive and structural transfers of personal data, or large-scale transfers of data, but should be limited to strictly necessary data. Such transfers should be documented and should be made available to the European Data Protection Supervisor on request in order to monitor the lawfulness of the transfer.

(17) In specific individual cases, the regular procedures requiring contacting a competent authority in a third country may be ineffective or inappropriate, in particular because the transfer could not be carried out in a timely manner, or because that authority in the third country does not respect the rule of law or international human rights norms and standards. T his may be the case where there is an urgent need to transfer personal data to a private company in a third country i n order to receive information about an unknown perpetrator of an online crime, or to save the life of a person who is in danger of becoming a victim of a criminal offence , or in the interest of preventing an imminent perpetration of a crime, including terrorism. In such cases, under specific conditions, Union bodies, offices and agencies could decide to transfer operational personal data directly to recipients which are not competent authorities, established in those third countries.

(18) The European Data Protection Supervisor should have a uniform set of powers applicable to the processing of operational personal data by Union bodies, offices and agencies active in the area of law enforcement and criminal justice. Such powers have already been applicable to Europol since 2022, for example , order ing the data controller to ensure compliance with Regulation (EU) 2018/1725, order ing the suspension of data flows to a recipient in a Member State, a third country or an international organisation, or imposing an administrative fine in the case of non-compliance by its order.

(19) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered its opinion on XX XX 2026 .

HAVE ADOPTED THIS REGULATION:

Article 1

Amendments to Regulation (EU) 2018/1725

Regulation (EU) 2018/1725 is amended as follows:

1. Article 2 is amended as follows:

(a) paragraph 2 is replaced by the following:

'2. Only Articles 3, 43, 44, 45 and Chapters VII, VIII and IX of this Regulation shall apply to the processing of operational personal data by Union bodies, offices and agencies when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEUs, without affecting specific data protection rules applicable to such a Union body, office or agency.'

(b) paragraph 3 is deleted ;

2. i n Article 45 (1) , points d), e) and (f) are replaced by the following:

‘ d) to provide advice where requested as regards the necessity for a notification or a communication of a personal data breach pursuant to Articles 34 and 35, or Articles 92 and 93;

e) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 39 or Article 89 and to consult the European Data Protection Supervisor in case of doubt as to the need for a data protection impact assessment;

f) to provide advice where requested as regards the need for prior consultation of the European Data Protection Supervisor pursuant to Article 40 or Article 90; to consult the European Data Protection Supervisor in case of doubt as to the need for a prior consultation;'

3. i n Article 66 (1) , the first sentence is replaced by the following:

‘1. The European Data Protection Supervisor may impose administrative fines on Union institutions and bodies, depending on the circumstances of each individual case, where a Union institution or body fails to comply with an order by the European Data Protection Supervisor pursuant to Article 58(2), points (d) to (h) and (j), or pursuant to Article 95a(3), points (c), (e), (f), (j) and (k).’

4. Article 70 is deleted.

5. In Article 77, paragraph 1 is replaced by the following:

‘1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision is authorised by Union law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller.’

6. I i n Article 78, paragraph 4 is replaced by the following:

‘4. The controller shall provide the information under Article 79 and any communication made or action taken pursuant to Articles 80 to 84 and 92 free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character or, for requests under Article 80 where the data subject abuses the right of access for purposes other than the protection of their data, the controller may refuse to act on the request. The controller shall bear the burden of demonstrating that the request is manifestly unfounded or that there are reasonable grounds to believe that it is excessive.’

7. t he following Article 87a is inserted:

‘Article 87a Records of categories of processing activities of operational personal data

1. Each controller shall maintain a record of all categories of processing activities of operational personal data under its responsibility. That record shall contain all of the following information:

(a) the controller’s contact details and the name and the contact details of the Data Protection Officer, and, where applicable, the contact details of the joint controller;

(b) the purposes of the processing;

(c) the categories of recipients to whom the personal data have been or will be disclosed including private parties, and recipients in third countries or international organisations;

(d) a description of the categories of data subjects and of the categories of personal data;

(e) where applicable, the use of profiling;

(f) where applicable, the categories of transfers of personal data to a private party, a third country or an international organisation;

(g) an indication of the legal basis for the processing operation, including transfers, for which the personal data are intended;

(h) where possible, the envisaged time limits for erasure of the different categories of data;

(i) where possible, a general description of the technical and organisational security measures referred to in Article 91(1).

2. The processor shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing:

(a) the processor’s or processors’ contact details, of each controller on behalf of which the processor is acting and the contact details of the Data Protection Officer;

(b) the categories of processing carried out on behalf of each controller;

(c) where applicable, transfers of personal data to a private party, a third country or an international organisation where explicitly instructed to do so by the controller, including the identification of that third country or international organisation;

(d) where possible, a general description of the technical and organisational security measures referred to in Article 91(1).

3. The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form. The controller and the processor shall make those records available to the European Data Protection Supervisor on request.’

8. i n Article 88 (1) , the following sentence is added :

‘It shall not be possible to modify logs.’

9. i n Article 88(3) , the following sentence is added:

‘If required by the national competent authority for a specific investigation related to compliance with data protection rules, the logs referred to in paragraph 1 shall be communicated to that authority.’

10. In Article 92, paragraph 1 is replaced by the following:

‘1. In the case of a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall without undue delay and, where feasible, not later than 96 hours after having become aware of it, notify the personal data breach to the European Data Protection Supervisor. Where the notification to the European Data Protection Supervisor is not made within 96 hours, it shall be accompanied by reasons for the delay.’

11. Article 94 is replaced by the following:

'Article 94

General principles for transfers of operational personal data to third countries and international organisations

1. The controller may transfer operational personal data to a third country or to an international organisation, subject to compliance with the applicable data protection rules and the other provisions of this Regulation, and only where the following conditions are met:

(a) the transfer is necessary for the performance of the controller’s tasks;

(b) the authority of the third country or the international organisation to which the operational personal data are transferred is competent in law enforcement or criminal justice matters;

(c) where the operational personal data to be transferred have been transmitted or made available to the controller by a Member State or Union body, office and agency, the controller shall obtain prior authorisation for the transfer from the relevant competent authority of that Member State or from the Union body, office and agency in compliance with its applicable law, unless that Member State or Union body, office and agency has authorised such transfers in general terms or subject to specific conditions ;

(d) in the case of an onward transfer to another third country or international organisation by a third country or international organisation, the controller shall require the transferring third country or international organisation to obtain the prior authorisation of the controller for that onward transfer ;

(e) t he controller shall only provide authorisation under point (d) with the prior authorisation of the Member State or the Union body, office and agency from which the data originate, where applicable, after taking due account of all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data were originally transferred and the level of personal data protection in the third country or international organisation to which the operational personal data are to be transferred onward.

2. Subject to the conditions set out in paragraph 1 of this Article, the controller may transfer operational personal data to a third country or to an international organisation where the conditions of Articles 94a, 94b, 94c or 94d are fulfilled.

3. Without affecting Article 94c, the controller may transfer operational personal data to a competent authority of a country associated with the implementation, application and development of the Schengen acquis that has implemented and effectively applies the provisions of Directive (EU) 2016/680

, and the provisions on the exchange of information laid down in Directive (EU) 2023/977

.

4. The controller may in urgent cases transfer operational personal data without prior authorisation from a Member State or Union body, office and agency in accordance with paragraph 1, point (c). The controller shall only do so if the transfer of the operational personal data is necessary for the prevention of an immediate and serious threat to the public security of a Member State or of a third country or to the essential interests of a Member State, and where the prior authorisation cannot be obtained in good time. The authority responsible for giving prior authorisation shall be informed without delay.

5. All provisions on international transfers in this Chapter shall be applied in order to ensure that the level of protection of natural persons ensured by this Regulation is not undermined.’

12. t he following a rticle s are inserted:

'Article 94a Transfers on the basis of an adequacy decision

The controller may transfer operational personal data to a third country or to an international organisation where the Commission has decided in accordance with

Article 36 of Directive (EU) 2016/680 that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.

Article 94b

Transfers subject to appropriate safeguards

1. In the absence of an adequacy decision, the controller may transfer operational personal data to a third country or an international organisation where:

(a) appropriate safeguards with regard to the protection of operational personal data are provided for in a legally binding instrument;

(b) or the controller has assessed all the circumstances surrounding the transfer of operational personal data and has concluded that appropriate safeguards exist with regard to the protection of operational personal data.

2. The legally binding instrument under paragraph 1, point (a) shall be:

(a) an international agreement between the Union and the third country or international organisation pursuant to

Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy, data protection and other fundamental rights and freedoms of individuals;

(b) a cooperation agreement allowing for the exchange of operational personal data concluded before 12 December 2019 between Eurojust and that third country or international organisation, in accordance with

Article 26a of Decision 2002/187/JHA

; or

(c) a cooperation agreement allowing for the exchange of operational personal data concluded before 1 May 2017 between Europol and that third country or international organisation in accordance with

Article 23 of Decision 2009/371/JHA

.

3. Union bodies, offices and agencies may enter into working arrangements to set out modalities to implement the agreements referred to in paragraph 2.

4. The controller shall inform the European Data Protection Supervisor about categories of transfers under paragraph 1, point (b).

5. When a transfer is based on paragraph 1, point (b), such a transfer shall be documented and the documentation shall be made available to the European Data Protection Supervisor on request. The documentation shall include a record of the date and time of the transfer and information about the receiving competent authority, about the justification for the transfer and about the operational personal data transferred.

Article 94c

Derogations for specific situations

1. In the absence of an adequacy decision, or of appropriate safeguards pursuant to Article 94b, the controller may transfer operational personal data to a third country or an international organisation only on the condition that the transfer is necessary:

(a) in order to protect the vital interests of the data subject or another person;

(b) to safeguard legitimate interests of the data subject;

(c) for the prevention of an immediate and serious threat to public security of a Member State or a third country;

(d) or in individual cases, for the performance of the tasks of the controller, unless the controller determines that the fundamental rights and freedoms of the data subject concerned override the public interest in the transfer.

2. Where a transfer is based on paragraph 1, such a transfer shall be documented and the documentation shall be made available to the European Data Protection Supervisor on request. The documentation shall include a record of the date and time of the transfer, and information about the receiving competent authority, about the justification for the transfer and about the operational personal data transferred.

Article 94d

Transfer of operational personal data to recipients established in third countries

1. By way of derogation from Article 94(1), point (b), and without affecting any international agreement referred to in paragraph 2 of this Article, the controller, in individual and specific cases, may transfer operational personal data directly to recipients established in third countries only if all of the following conditions are fulfilled:

(a) the transfer is strictly necessary for the performance of the controller’s tasks, for the purposes for which is allowed to process operational personal data;

(b) the controller determines that no fundamental rights and freedoms of the data subject concerned override the public interest necessitating the transfer in the case at hand;

(c) the controller considers that the transfer to a competent authority in the third country is ineffective or inappropriate, in particular because the transfer cannot be achieved in good time;

(d) the competent authority in the third country is informed without undue delay, unless this is ineffective or inappropriate;

(e) the controller informs the recipient of the specified purpose or purposes for which the operational personal data are only to be processed by the latter provided that such processing is necessary.

2. An international agreement referred to in paragraph 1 shall be any bilateral or multilateral international agreement in force between the Union and third countries in the field of judicial cooperation in criminal matters and police cooperation.

3. Where a transfer is based on paragraph 1, such a transfer shall be documented and the documentation shall be made available to the European Data Protection Supervisor on request, including the date and time of the transfer, and information about the receiving competent authority, about the justification for the transfer and about the operational personal data transferred.’

13. t he following A rticle 95a is inserted:

'Article 95a Supervision by the European Data Protection Supervisor

1. The European Data Protection Supervisor shall be responsible for monitoring and ensuring the application of the provisions relating to the protection of fundamental rights and freedoms of natural persons with regard to the processing of operational personal data by Union bodies, offices and agencies, and for advising them and data subjects on all matters concerning the processing of operational personal data. To that end, he or she shall fulfil the duties set out in paragraph 2 and exercise the powers laid down in paragraph 3, while closely cooperating with the national supervisory authorities.

2. The European Data Protection Supervisor shall have the following duties:

(a) hearing and investigating complaints, and informing the data subject of the outcome within a reasonable period; conducting inquiries either on his or her own initiative or on the basis of a complaint, and informing the data subject of the outcome within a reasonable period;

(b) monitoring and ensuring the application of this Regulation and any other Union act relating to the protection of natural persons with regard to the processing of operational personal data by Union bodies, offices and agencies;

(c) advising Union bodies, offices and agencies, either on his or her own initiative or in response to a consultation, on all matters concerning the processing of operational personal data, in particular before they draw up internal rules relating to the protection of fundamental rights and freedoms with regard to the processing of operational personal data;

(d) keeping a register of new types of processing operations notified to him or her;

(e) carrying out a prior consultation on processing notified to him or her.

3. The European Data Protection Supervisor may pursuant to this Regulation:

(a) give advice to data subjects on the exercise of their rights;

(b) refer a matter to the Union body, office and agency in the event of an alleged breach of the provisions governing the processing of operational personal data, and, where appropriate, make proposals for remedying that breach and for improving the protection of the data subjects;

(c) order that requests to exercise certain rights in relation to operational personal data be complied with where such requests have been refused in breach of the applicable rules on data subject rights;

(d) warn or admonish the Union body, office or agency;

(e) order the Union body, office or agency to carry out the rectification, restriction, erasure or destruction of personal data which have been processed in breach of the provisions governing the processing of operational personal data and to notify such actions to third parties to whom such data have been disclosed;

(f) impose a temporary or definitive ban on processing operations by the Union body, office or agency which are in breach of the provisions governing the processing of operational personal data;

(g) refer a matter to the Union body, office or agency and, if necessary, to the European Parliament, the Council and the Commission;

(h) refer a matter to the Court of Justice of the European Union under the conditions provided for in the TFEU;

(i) intervene in actions brought before the Court of Justice of the European Union;

(j) order the controller or processor to bring processing operations into compliance with this Regulation and, where applicable, with data protection rules laid down in the founding act of the Union body, office or agency, where appropriate, in a specified manner and within a specified period;

(k) order the suspension of data flows to a recipient in a Member State, a third country or to an international organisation;

(l) impose an administrative fine under Article 66 in the case of non-compliance by the Union body, office and agency with one of the measures referred to in points (c), (e), (f), (j) and (k) of this paragraph, depending on the circumstances of each individual case.

4. The European Data Protection Supervisor shall have the power to:

(a) obtain from the Union body, office and agency access to all operational personal data and to all information necessary for his or her enquiries;

(b) obtain access to any premises in which the Union body, office or agency carries on its activities when there are reasonable grounds for presuming that an activity covered by this Chapter is being carried out there.

5. The European Data Protection Supervisor shall prepare an annual report on his or her supervisory activities in relation to the controllers under this Chapter. That report shall be part of the annual report of the European Data Protection Supervisor referred to in Article 60.

The EDPS shall invite the national supervisory authorities to submit observations on that part of the annual report before the annual report is adopted. The EDPS shall take utmost account of those observations and shall refer to them in the annual report.

The part of the annual report referred to in the second subparagraph shall include statistical information regarding complaints, inquiries, and investigations, as well as regarding transfers of operational personal data to third countries and international organisations, cases of prior consultation of the European Data Protection Supervisor, and the use of the powers laid down in paragraph 3 of this Article.

6. The European Data Protection Supervisor, the officials and the other staff members of the European Data Protection Supervisor's Secretariat shall be bound by the obligation of confidentiality, in accordance with Article 95.'

Article 2

Entry into force

1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .

2. However, this Regulation shall apply to processing of operational personal data by the European Public Prosecutors' Office from [ day of entry into application of the new EPPO Regulation ].

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, For the European Parliament For the Council

The President The President

[...] [...]

(1) (1) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus), 19.11.2025, COM(2025)837 final.

(2) (2) Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, pp. 1–71, ELI: http://data.europa.eu/eli/reg/2017/1939/oj)

(3) (1) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj).

(4) (2) Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1, ELI: http://data.europa.eu/eli/reg/2017/1939/oj).

(5) (3) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89, ELI: http://data.europa.eu/eli/dir/2016/680/oj).