European Union: European Data Protection Board adopted rules of procedure for informal panel of EU Data Protection Authorities according to the EU-US Data Privacy Framework

On 15 January 2026, the European Data Protection Board adopted version 2.0 of the rules of procedure for the informal panel of EU Data Protection Authorities according to the EU-US Data Privacy Framework. The rules establish procedural arrangements for the handling of unresolved complaints concerning compliance by US organisations self-certified under the EU-US Data Privacy Framework, in relation to personal data transferred from the European Union and the European Economic Area. The rules define the competence of the Informal Panel, the conditions under which a complaint qualifies as a Data Privacy Framework complaint, and the designation of a Lead Data Protection Authority and co-reviewer Data Protection Authorities. The rules set out the duties of the complaint-receiving authority, the Lead authority, and the co-reviewers, including cooperation, communication, and decision-making procedures. They provide indicative timelines for issuing binding advice and specify escalation pathways to the United States Department of Commerce, the Federal Trade Commission, and the Department of Transportation in cases of non-compliance. The rules apply without prejudice to enforcement powers under Regulation (EU) 2016/679 and replace Version 1.0 adopted on 17 April 2024.