EDPB Calls for Legal Basis to Enable Cross-Regulatory Information Sharing

The EDPB has highlighted a critical governance gap: regulators across different domains lack a clear legal framework to share information with one another, undermining coordinated enforcement of the GDPR. As cases grow more complex — particularly those involving AI systems that intersect data protection, competition, and sector-specific regulations — siloed enforcement leads to inconsistent outcomes and weakened protection for individuals. Without a defined legal basis, inter-regulatory cooperation risks being legally challenged, slowing down enforcement actions. This matters because modern data-driven systems rarely fall under a single regulatory regime, making cross-authority collaboration essential for effective oversight.

Tactical Insight

Organizational Governance Actions

Establish an internal cross-functional compliance team that maps all applicable regulatory obligations (GDPR, AI Act, sector-specific rules) relevant to your data processing activities.
Document and maintain a legal basis register for every data sharing activity, including those with external authorities or partners.

Long-term Compliance Improvements

Implement a regulatory change monitoring process to track evolving EDPB guidance, new legal bases, and inter-regulatory cooperation frameworks.
Design data architectures with regulatory boundary awareness, ensuring data flows can be audited and restricted per jurisdiction or regulatory context.
Engage legal counsel proactively when deploying AI systems that may fall under multiple overlapping regulatory regimes.

Detection and Audit Measures

Conduct periodic Data Protection Impact Assessments (DPIAs) that explicitly assess cross-regulatory risks, especially for AI-driven processing.
Establish audit trails for all information shared with or received from regulatory bodies to ensure accountability and legal defensibility.