EDPB Launches GDPR Consistency Form: Checks for Data-Driven Businesses

On 24 June 2026, the European Data Protection Board announced a dedicated contact form for stakeholders to report possible inconsistencies in how the General Data Protection Regulation (GDPR) is interpreted across Europe. The form is intended to collect information about possible divergences between national positions and between national approaches and EDPB positions.

The initiative does not create a new processing requirement for companies and does not by itself establish whether a particular product complies with GDPR. For businesses, the practical point is to separate confirmed obligations from interpretation issues that may depend on the company’s role, actual processing activities, and the position of the relevant authority.

Check the company role and personal data processing chain

When a digital product uses personal data through multiple providers, a useful preparation step is to map the processing chain before legal review. The map should identify:

• what categories of personal data are processed;
• who decides the purposes of processing;
• which vendors or partners can access information;
• which agreements describe data-processing responsibilities;
• where records of consent, settings, and user actions are stored.

The EDPB initiative addresses consistency of GDPR application, but it does not decide the legal role of a specific business model. Whether an organisation acts as a controller or processor depends on factual activities, not only contractual wording.

Preserve evidence before a regulatory review

Privacy compliance reviews depend not only on policies and agreements. If a company needs to explain its approach to a regulator or authority, practical evidence of how processing works can be important.

Review whether the business preserves:

• versions of user interfaces related to choices and notices;
• records of processing-setting changes;
• agreements with data-processing providers;
• internal access-control process descriptions;
• documents showing allocation of responsibilities between participants.

The EDPB contact form is a channel for collecting stakeholder information and is not an individual response mechanism for each submission. It does not replace a review of a specific situation, where the outcome depends on facts, applicable jurisdiction, contract terms, and the procedure for engagement with data-protection authorities.