In a major Judgement delivered on 10 February 2026, the
Court of Justice of the European Union
(‘CJEU') held that binding decisions
of the European Data Protection Board
(‘EDPB') can be challenged directly
before the Courts of the European Union.
The EDPB, the EU body responsible for ensuring the consistent
application of the General Data Protection Regulation
(‘GDPR'), has the power to issue
binding decisions directed at national data protection supervisory
authorities, under the GDPR's dispute resolution mechanism.
Until now, companies could only challenge the national supervisory
authorities' decisions, which were based on the EDPB's
decisions, before the national courts. On Tuesday, the CJEU opened
the door for companies to contest the EDPB binding
decisions directly and in EU courts,
marking a significant development in the enforcement of data
protection law.
