On October 14, 2025, the European Data Protection Board (“EDPB”) announced that its 2026 coordinated enforcement action (“CEA”) will focus on transparency and information obligations — the rules that require organizations to clearly explain how they collect, use, and share personal data — under Articles 12-14 of the General Data Protection Regulation (“GDPR”).

Each year, the EDPB selects a GDPR-related topic for national data protection authorities across Europe to examine jointly. These actions allow authorities to work together — sharing insights, aligning approaches, and sometimes conducting joint investigations — to ensure consistent enforcement of the GDPR across the EEA. Previous topics have included the designation and role of data protection officers, as well as the implementation of the rights of access and erasure by controllers.

What Can Companies Expect from the 2026 CEA?

If your company is subject to the GDPR, here’s what you might expect from the upcoming CEA on transparency:

• You may receive a questionnaire from your national data protection authority. This will ask how your organization informs individuals about the use of their personal data, for example, through privacy notices or other communications.
• The questionnaire may be mandatory or optional, depending on how your authority decides to use it, either as part of an investigation or simply to gather information.
• Authorities will review the responses to identify common issues or gaps in compliance. Based on what they find, they may publish guidance, offer training, or take further action.
• Some companies may face investigations if their responses raise concerns. These investigations can lead to formal warnings, orders to change practices, or fines.

In short, companies should be prepared to explain how they meet transparency requirements under the GDPR, and to take action if their practices fall short.

What’s Next?

Authorities are expected to join the transparency-focused CEA in the coming weeks, with the initiative launching in 2026. Since transparency has long been a priority for regulators, this year’s action may lead to more investigations and stricter penalties than in previous years.

Recent enforcement decisions have also highlighted growing regulatory expectations around the level of detail required in privacy notices. For example, some authorities have taken the position that organizations should explicitly identify each third country to which personal data is transferred. These developments suggest that transparency obligations under Articles 13 and 14 GDPR may be interpreted more stringently going forward.

*          *          *

Covington’s Data Privacy and Cybersecurity team regularly advises companies on GDPR compliance, including transparency obligations and data subject rights. We’re happy to assist with responding to supervisory authority questionnaires and other inquiries.