Skip to content
‹ All stories
ST-008MovingRule-making

EDPB guidelines open for consultation

What do the draft guidelines on anonymisation, web scraping and GDPR fines say, and when do comments close?

EUPrivacy & data

3 records since 7 July 2026 · last moved 17 September 2026 · next 30 October 2026

The matter file · as at 26 October 2026

The European Data Protection Board has three sets of draft guidelines out for comment. Comments on anonymisation and on web scraping close at 23:59 CET on 30 October 2026. Comments on when to impose a fine close at 23:59 CET on 13 November 2026. All three are drafts, not final guidance.

How it got here, what comes next, the open questions and the reading. Read the matter file ›

Position over time

Each line says where the matter stood on that date, in 25 words or fewer. Step back to see an earlier position; the timeline below fades what came after it.

Position as at 17 September 2026

A third consultation, on when a GDPR fine should be imposed, closes on 13 November 2026.

7 July 2026latest17 September 2026

Timeline

  1. 7 July 2026
    EUguidancePrivacy & data

    EDPB consults on Guidelines 02/2026 on anonymisation — closes 30 October 2026

    The European Data Protection Board is consulting on Guidelines 02/2026 on anonymisation until 23:59 CET on 30 October 2026; it adopted the draft on 7 July 2026.

    Primary source: European Data Protection Board ↗
  2. 7 July 2026
    EUguidancePrivacy & data

    EDPB consults on Guidelines 03/2026 on web scraping to train generative AI — closes 30 October 2026

    The European Data Protection Board is consulting on Guidelines 03/2026 on web scraping to train generative AI until 23:59 CET on 30 October 2026; it adopted the draft on 7 July 2026.

    Primary source: European Data Protection Board ↗
  3. 17 September 2026 · +72 days
    EUguidancePrivacy & data

    EDPB consults on Guidelines 04/2026 on when a GDPR fine should be imposed — closes 13 November 2026

    The European Data Protection Board is consulting on Guidelines 04/2026 on when a GDPR fine should be imposed, until 23:59 CET on 13 November 2026; it adopted the draft on 17 September 2026.

    Primary source: European Data Protection Board ↗