← Regulators
GDPR EU 2016/679 EU-wide

Who is the EDPS: the EU institutions' own data protection supervisor

The European Data Protection Supervisor (EDPS) is the independent authority that watches how the EU's own institutions — the Commission, Parliament, Council, Europol and the rest — handle personal data. What it does, how it differs from the EDPB it is constantly confused with, and who runs it. Every fact sourced.

Published June 10, 2026 · Updated June 10, 2026 · 5 min read · 5 sources cited

You have read about the EDPB — the body that coordinates the national data-protection regulators. The EDPS is the one everyone mixes it up with, and it does something different: it polices how the EU’s own institutions handle your data. When the Commission, Europol or the Court of Justice processes personal data, the EDPS is the regulator watching them. This is a profile of the body, with every fact sourced.

Quick facts

  • Full name: European Data Protection Supervisor (EDPS)
  • What it supervises: the EU’s own institutions, bodies, offices and agencies (EUIs) — the Commission, Parliament, Council, Court of Justice, Europol, Frontex, the ECB and dozens more — when they process personal data
  • Governing law: Regulation (EU) 2018/1725 — the EUDPR, the EU institutions’ equivalent of the GDPR (EDPS Annual Report 2024)
  • In operation since: 2004 (first Supervisor took office January 2004)
  • Supervisor: Wojciech Wiewiórowski — took office 6 December 2019 for a five-year term; he remains in office on an interim basis as of June 2026 while the Parliament and Council finalise a successor (EDPS; Euronews)
  • Relationship to the EDPB: the EDPS is a member of the EDPB and provides its Secretariat — but it is a separate body with its own mandate
  • Headquarters: Brussels
  • Website: edps.europa.eu

What the EDPS is

The EDPS is the EU’s internal data-protection regulator. Every national DPA — CNIL, Garante, AKI — supervises companies and public bodies inside its country under the GDPR. The EDPS does the same job, but its “jurisdiction” is the EU’s own administration: when the European Commission runs a staff database, when Europol processes police data, when Frontex handles migration data, the EDPS is the authority that supervises them — under Regulation (EU) 2018/1725, often called the EUDPR, which mirrors the GDPR for EU institutions.

It is an independent authority (EDPS Annual Report 2024): no EU institution can tell it how to handle a case — the same independence guarantee that protects national DPAs.

EDPS vs EDPB — the constant confusion

The two acronyms differ by one letter and are mixed up constantly. The clean distinction:

  • EDPB (European Data Protection Board) — coordinates the national DPAs across the EEA, writes pan-EU GDPR guidelines, and resolves cross-border disputes. It watches how companies and member states apply GDPR. See the EDPB profile.
  • EDPS (European Data Protection Supervisor) — supervises the EU institutions themselves when they process personal data, under the EUDPR. It watches Brussels, not companies.

They are linked: the EDPS sits as a member of the EDPB and runs the EDPB’s Secretariat in Brussels. But their mandates are separate — one supervises the EU’s administration, the other coordinates the national regulators.

What the EDPS actually does

Per its Annual Report 2024, the work falls into a few headline functions:

1. Supervise and enforce against EU institutions

It investigates complaints against EUIs, runs inspections, and can order corrective measures — for an EU body that mishandles personal data, the EDPS is the enforcement authority.

2. Issue Supervisory Opinions

When an EU institution plans a new processing operation — a new database, a data transfer, an integration of IT systems — it consults the EDPS, which issues a Supervisory Opinion advising on whether and how it complies with the EUDPR. This is the EDPS’s day-to-day bread and butter.

3. Advise the EU legislator

The EDPS issues opinions on proposed EU laws that touch personal data — from AI and law-enforcement files to financial-data rules — shaping legislation before it passes.

4. Run the EDPB Secretariat and represent data protection internationally

It provides the administrative backbone of the EDPB and engages with regulators and bodies outside the EU.

Leadership

The Supervisor is appointed through a joint decision of the European Parliament and the Council, after a public call and hearings, for a five-year term.

  • Current Supervisor: Wojciech Wiewiórowski. A former head of the Polish data-protection authority, he was Assistant Supervisor before taking office as Supervisor on 6 December 2019. His five-year term ran to December 2024; as of June 2026 he continues on an interim basis while the Parliament and Council resolve the appointment of a successor (EDPS; Euronews).
  • Predecessors: Giovanni Buttarelli (Supervisor December 2014 – 2019) and Peter Hustinx (the first Supervisor, January 2004 – 2014) (EDPS).

If you have a memory of an earlier name as “the current” Supervisor, check the EDPS site — the appointment of Wiewiórowski’s successor has been delayed and the seat is in transition.

What this means for you

  • If you work inside an EU institution or agency: the EDPS is your data-protection regulator. New processing operations go through a Supervisory Opinion, and complaints about your handling of personal data land here, not at a national DPA.
  • If you are a citizen: complaints about how an EU body (not a national authority or a company) handled your data go to the EDPS. Complaints about a company or a national public body go to your national DPA instead.
  • If you follow EU privacy policy: EDPS opinions on draft EU legislation are an early signal of where the law is heading — they often pre-empt the final shape of AI, security and financial-data rules.

TL;DR

The EDPS is the EU’s internal data-protection regulator: it supervises the EU’s own institutions and agencies under Regulation (EU) 2018/1725 (the EUDPR), the institutional twin of the GDPR. It is not the EDPB — the EDPB coordinates the national regulators and watches companies; the EDPS watches Brussels, sits on the EDPB and runs its Secretariat. In operation since 2004, headquartered in Brussels, led by Supervisor Wojciech Wiewiórowski (in office since 6 December 2019, continuing on an interim basis as of June 2026 pending a successor). Its main outputs: enforcement against EU bodies, Supervisory Opinions on their processing, and opinions on draft EU law.

Sources