Guidelines (EDPB)

EDPB and endorsed WP29 guidelines interpreting the GDPR — the curated Level 3 layer for the GDPR space.

The Level 3 layer for the GDPR: guidelines and recommendations adopted by the European Data Protection Board (EDPB), plus Article 29 Working Party documents the EDPB has endorsed. EDPB material is interpretive soft law — it is not itself binding legislation, but supervisory authorities apply it consistently.

This is a deliberately curated core, not the full EDPB corpus (curation rationale: _research/platform/gdpr-l3-curation-2026-07.md in the repo). Each document below has a hosted page with source links and status.

Document	Status	Page
WP260 rev.01 — Transparency under Regulation 2016/679	EDPB-endorsed WP29	EDPB WP260
Guidelines 05/2020 — Consent	Adopted (final)	EDPB 05/2020
Guidelines 07/2020 — Controller and processor	Final	EDPB 07/2020
Guidelines 1/2024 — Legitimate interest (Article 6(1)(f))	Public-consultation draft	EDPB 1/2024
WP248 rev.01 — Data Protection Impact Assessment	EDPB-endorsed WP29	EDPB WP248
Guidelines 9/2022 — Personal data breach notification	Final	EDPB 9/2022
Guidelines 01/2022 — Right of access	Final	EDPB 01/2022
Recommendations 01/2020 — Supplementary transfer measures	Final	EDPB 01/2020
Guidelines 4/2019 — Data protection by design and by default (Article 25)	Final	EDPB 4/2019
Guidelines 01/2025 — Pseudonymisation	Public-consultation draft	EDPB 01/2025

Related (ePrivacy, frequently read together with GDPR consent material): Guidelines 2/2023 — Technical scope of Article 5(3) of the ePrivacy Directive.