On 23 June 2026, the European Commission published a proposal to amend the EU Data Protection Regulation (EUDPR) for Union institutions, bodies, offices and agencies (Regulation (EU) 2018/1725), aiming to harmonise data protection rules for all EU Justice and Home Affairs bodies processing operational personal data, including Europol, Eurojust, the European Public Prosecutor's Office (EPPO), and Frontex. The proposal is part of a package revising the Europol and Eurojust Regulations, adopted the same day.
The proposal extends Chapter IX of the EUDPR to the EPPO, integrating its standalone data protection regime into the common framework while allowing specific rules in the EPPO Regulation to remain. It adds provisions on Data Protection Officers, records of processing activities, and international transfers of operational personal data to Chapter IX, addressing current gaps. The European Data Protection Supervisor's (EDPS) powers are streamlined and aligned with the 2022 Europol reform model, removing divergent rules from founding acts. The deadline for notifying a personal data breach to the EDPS is extended from 72 to 96 hours, and notification is required only if the breach is likely to result in a high risk to rights and freedoms. Automated decision-making and abusive access requests are clarified, aligning with the Digital Omnibus proposal.
The proposal consolidates fragmented data protection rules for EU law enforcement and judicial bodies into a single, coherent framework, enhancing legal certainty and operational cooperation. It impacts several stakeholders: EU law enforcement and judicial bodies (Europol, Eurojust, EPPO, Frontex) will benefit from clearer rules and reduced administrative burden, but may face adjustment costs to align with new provisions; the EDPS gains streamlined oversight powers, but may see increased workload from new notification requirements; EU citizens benefit from stronger data protection safeguards, but the extended breach notification deadline and risk-based threshold could reduce transparency; and EU legislators (European Parliament and Council) will need to negotiate the proposal, balancing operational efficiency with privacy protections. The proposal now passes to the European Parliament and the Council for adoption under the ordinary legislative procedure.