EDPB and EDPS support strengthening EU’s cybersecurity and easing compliance while protecting individuals’ personal data

In their joint opinion, issued at the request of the Commission*, the EDPB and the EDPS address the proposed revision of the CSA and the targeted amendments to the NIS2 Directive.“The relationship between data protection and cybersecurity is reciprocal and deeply interconnected. While cybersecurity supports the protection of personal data by limiting the risks of unwanted access, modification or unavailability of data, it is crucial to ensure that security controls are implemented in a way that does not undermine individuals’ fundamental rights and freedoms.”EDPB Chair Anu Talus“While maximizing the effectiveness of cybersecurity measures is vital, we must ensure that the processing of personal data remains limited to what is strictly necessary. They also suggest adding the EDPS as a possible requestor of advice from ENISA.In the joint opinion, the EDPB and the EDPS recall that in case the Management Board of ENISA decides to adopt additional measures necessary for the application of the EU Data Protection Regulation, such decisions should be limited to very technical (practical) details related to the processing of personal data. To ensure consistency, ENISA should consult with the EDPB before adopting a certification scheme relating to the security of processing of personal data. Note to editors:* On 21 January 2026, the Commission formally consulted the EDPB and the EDPS and requested a joint opinion on the European Commission’s proposal for a CSA2 and the proposal on amendments to the NIS2 Directive in accordance with Art. Relevant topics Cross-regulatory interplay Cybersecurity Certification Artificial intelligence Legal basis Automated decision making, profiling and Online tracking Latest news EDPB News EDPB gets a new look: discover the new website and brand identity22 June 2026 EDPB News Coordinated Supervision Committee extends scope to include Eurodac12 June 2026 EDPB News EDPB meets with EU Commissioner McGrath and adopts common data breach notification template10 June 2026All news