April 15, 2026 | Order Opinion | Data Governance

On 15 April 2026, the European Data Protection Board (EDPB) adopted Opinion 15/2026 approving the Europrivacy Certification Scheme Extension for Certifying Data Importers under Article 46 of the General Data Protection Regulation (GDPR) (Europrivacy Article 46 Extension) pursuant to Articles 42(5) and 46(2)(f) GDPR. The Europrivacy Article 46 Extension applies to data importers located outside the European Economic Area (EEA) that are not subject to the GDPR pursuant to Article 3. It covers both singular transfers and sets of closely correlated transfers. The certification criteria address the scope and Target of Evaluation, processing operations, data protection principles, obligations of controllers and processors, data subject rights, technical and organisational measures, and criteria for demonstrating appropriate safeguards for transfers. The EDPB will register the Europrivacy Article 46 Extension in the public register of certification mechanisms and data protection seals and marks and make the certification criteria publicly available pursuant to Article 42(8) GDPR.