Decision No 2/2026 of the Secretary-General of the Council of the European Union of 30 January 2026 laying down implementing rules concerning the application of Regulation (EU) 2018/1725 of the European Parliament and of the Council and the restriction of data subjects’ rights for the purpose of restrictive measures
Scope
1. This Decision lays down rules relating to the conditions under which the General Secretariat of the Council (GSC) may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of that Regulation, in accordance with Article 25 thereof.
2. For the purposes of this Decision, the GSC shall be considered to be the controller within the meaning of Article 3(8) of Regulation (EU) 2018/1725. The GSC is represented by its Secretary-General.
Restrictions
1. The GSC may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of Regulation (EU) 2018/1725 under any of the following circumstances:
(a)
pursuant to Article 25(1), points (a) to (d) and points (g) and (h), of Regulation (EU) 2018/1725, when the Council prepares, adopts and reviews restrictive measures provided for in legal acts based on Article 29 of the Treaty on European Union (TEU) and Article 215 of the Treaty of the Functioning of the European Union (TFEU); as well as under Common Position 2001/931/CFSP, Regulation (EC)No 2580/2001, Decision (CFSP) 2016/1693 and Regulations (EC)No 881/2002 and (EU) 2016/1686;
(b)
pursuant to Article 25(1), points (a) to (d) and points (g) and (h), of Regulation (EU) 2018/1725, when ensuring the possibility for third parties to report confidentially about facts which give rise to the preparation and review of restrictive measures provided for in legal acts based on Article 29 TEU and Article 215 TFEU; as well as under Common Position 2001/931/CFSP, Regulation (EC)No 2580/2001, Decision (CFSP) 2016/1693 and Regulations (EC)No 881/2002 and (EU) 2016/1686;
(c)
pursuant to Article 25(1), points (a) to (d) and points (g) and (h), of Regulation (EU) 2018/1725, when providing or receiving assistance to or from other Union institutions, bodies, offices or agencies or cooperating with them pursuant to relevant service level agreements, memoranda of understanding and cooperation agreements;
(d)
pursuant to Article 25(1), points (a) to (d) and points (g) and (h), of Regulation (EU) 2018/1725, when providing or receiving assistance and cooperation to and from Member States’ public authorities, either at their request or on its own initiative;
(e)
pursuant to Article 25(1), points (a) to (d) and points (g) and (h), of Regulation (EU) 2018/1725, when providing or receiving assistance to or from third countries’ national authorities and international or regional organisations or cooperating with such authorities and organisations, either at their request or on its own initiative; or
(f)
pursuant to Article 25(1), points (e) and (h), of Regulation (EU) 2018/1725, when processing personal data in the context of administrative, judicial, or other proceedings.
Application of restrictions
1. Any restriction of the rights and obligations referred to in Article 2 shall be necessary and proportionate, taking into account the risks to the rights and freedoms of data subjects.
2. Before applying one of the restrictions set out in Article 2, the relevant GSC service shall carry out a necessity and proportionality test. Restrictions shall be limited to what is strictly necessary to achieve their objective.
3. The relevant GSC service shall record the reasons for any restriction applied pursuant to this Decision, including the test provided for in paragraph 2 of this Article and the grounds under Article 25(1) of Regulation (EU) 2018/1725. The record and, where applicable, the documents containing underlying factual and legal elements shall be part of a register kept by the relevant GSC service. They shall be made available to the European Data Protection Supervisor (EDPS) on request.
Duration and safeguards
1. Restrictions referred to in Article 2 shall continue to apply as long as the reasons justifying them remain applicable.
2. The relevant GSC service shall review the application of restrictions referred to in Article 2 at least every 12 months, or sooner if the reasons that justify them no longer apply..
3. Restrictions shall be lifted as soon as the reasons that justify them no longer apply.
4. Where the reasons for a restriction referred to in Article 2 no longer apply, the GSC shall lift the restriction and provide the reasons for the restriction to the data subject. At the same time, the GSC shall inform the data subject of the possibility of lodging a complaint with the EDPS.
5. The GSC shall implement safeguards to prevent abuse or unlawful access or transfer of personal data that may be subject to restrictions. These safeguards shall include technical and organisational measures and be detailed, as necessary, in GSC internal decisions, procedures and implementing rules. The safeguards shall include:
(a)
an adequate definition of roles, responsibilities and procedural steps;
(b)
where applicable, a secure electronic environment which prevents unlawful or accidental access or transfer of electronic data to unauthorised persons;
(c)
where applicable, secure storage and processing of paper-based documents; and
(d)
due monitoring of restrictions and periodic review of their application.
Involvement of the Data Protection Officer
1. Where the relevant GSC service concludes that a data subject’s rights should be restricted pursuant to this Decision, it shall inform the Data Protection Officer (DPO). It shall also provide the DPO with access to the record and any documents containing underlying factual and legal elements. The relevant GSC service shall record the involvement of the DPO in the application of restrictions including in the assessment of the necessity and proportionality of the restriction.
2. The DPO may request that the relevant GSC service reviews the application of the restrictions. The service concerned shall inform the DPO in writing about the outcome of the requested review.
Information to data subjects
1. The GSC shall include a section in the privacy statement and records of processing activities published in the register of processing operations kept by the DPO providing general information to data subjects on the potential for restriction of data subjects’ rights pursuant to Article 2(1). The information shall cover which rights may be restricted, the grounds on which restrictions may be applied and their potential duration.
2. The relevant services shall inform data subjects, in appropriate format, of ongoing or future restrictions of their rights. They shall inform the data subject of the principal reasons on which the application of the restriction is based, of their right to consult the DPO and of their right to lodge a complaint with the EDPS.
3. The relevant services may defer, omit or deny the provision of information to data subjects referred to in paragraph 2 of this Article, for as long as it would cancel the effect of the restriction. Assessment of whether this would be justified shall take place on a case-by-case basis. As soon as it would no longer cancel the effect of the restriction, the information shall be provided to the data subject.
4. Where the relevant GSC service restricts, wholly or partly, the provision of information to data subjects referred to in paragraph 2 of this Article, the GSC shall record and register the reasons for the restriction, in accordance with Article 3.
Communication of a personal data breach to the data subject
1. Where the GSC is under an obligation to communicate a data breach under Article 35(1) of Regulation (EU) 2018/1725, it may, in exceptional circumstances, restrict such communication wholly or partly. It shall document this decision as provided under Article 3(3) of this Decision.
2. Where the reasons for the restriction no longer apply, the GSC shall communicate the personal data breach to the data subject concerned and inform him or her of the principal reasons for the restriction and of his or her right to lodge a complaint with the EDPS.
Confidentiality of electronic communication
1. In exceptional circumstances, the GSC may restrict the right to confidentiality of electronic communications under Article 36 of Regulation (EU) 2018/1725.
2. Where the GSC restricts the right to confidentiality of electronic communications, it shall inform the data subject concerned, in its reply to any request from the data subject, of the principal reasons for which the application of the restriction is based and of his or her right to lodge a complaint with the EDPS.
3. The GSC may defer, omit or deny the provision of information concerning the reasons for a restriction and the right to lodge a complaint with the EDPS for as long as it would undermine the effect of the restriction. Assessment of whether this would be justified shall take place on a case-by-case basis.
Risks to the rights and freedoms of data subjects
1. Any restriction shall respect the essence of fundamental rights and freedoms and be necessary and proportionate in a democratic society.
2. Whenever the relevant GSC service tasked with the preparation or review of restrictive measures assesses the necessity and proportionality of a restriction, it shall consider the potential risks to the rights and freedoms of the data subject.
3. No restriction may have the effect of preventing persons concerned by restrictive measures to exercise their rights of defence, and in particular their right to be heard in the context of the review of the restrictive measures.
Entry into force
This Decision shall enter into force on the day following that of its publication in the Official Journal of the European Union .
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
