EDPB outlines GDPR rules for COVID-19 data processing
The European Data Protection Board issued a statement confirming GDPR permits processing health and location data for pandemic response under specific legal bases, while stressing necessity, proportionality, and transparency.
Executive briefing: The EDPB clarified that GDPR provides legal grounds—such as public interest in public health and vital interests—for processing personal data during COVID-19. It reminded controllers that emergency measures must respect necessity and proportionality and include safeguards like transparency and data minimization.
Why it matters
- Organizations assisting public health authorities need clear legal bases for handling health and location data.
- The statement underscores that GDPR is flexible during emergencies but still requires purpose limitation, data minimization, and transparency to data subjects.
- Employers collecting employee health status or travel history must apply appropriate legal grounds and safeguards.
Operator actions
- Document the legal basis (e.g., public interest in public health, vital interests, employment law obligations) for any COVID-19 data collection.
- Limit collection to necessary data, set retention schedules, and inform data subjects about processing purposes and rights.
- Engage DPOs to review emergency measures and ensure DPIAs are updated where high-risk processing is introduced.
Key sources
- EDPB Statement on processing personal data in the context of COVID-19 (lays out legal bases and proportionality requirements).
- EDPB news release (summarizes controller obligations and key safeguards).
Continue in the Compliance pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Third-Party Risk Oversight Playbook — Zeph Tech
Operationalize OCC, Federal Reserve, EBA, and MAS outsourcing expectations with lifecycle controls, continuous monitoring, and board reporting.
-
Compliance Operations Control Room — Zeph Tech
Implement cross-border compliance operations that satisfy Sarbanes-Oxley, DOJ guidance, EU DORA, and MAS TRM requirements with verifiable evidence flows.
-
SOX Modernization Control Playbook — Zeph Tech
Modernize Sarbanes-Oxley (SOX) compliance by aligning PCAOB AS 2201, SEC management guidance, and COSO 2013 controls with data-driven testing, automation, and board reporting.