Commission Decision on Internal Data Supervision (Decision 2025/628)

To ensure the European Commission itself follows the strictest data protection standards, Decision 2025/628 defines rules for handling personal data during EU investigations. This includes data about whistleblowers, suspects, or staff in sensitive inquiries. The regulation mandates independent reviews by Data Protection Officers, formal risk assessments, and mandatory consultations with the European Data Protection Supervisor. It is designed to enhance accountability and transparency in EU institutional processes, reinforcing public trust. Companies offering DPO-as-a-Service can take this as a benchmark for best practices in independent oversight and internal auditing to meet EU-level expectations.
🔗 EUR-Lex Decision 2025/628