Official Gazette Notification Text
Official TranscriptOfficial Journal EN of the European Union L series 2026/1942 14.8.2026 DECISION(EU) 2026/1942 OF THE EUROPEAN CENTRAL BANK of 30 July 2026 on the processing of personal data in the context of the prudential supervision of credit institutions (ECB/2026/18) THE GOVERNING COUNCIL OF THE EUROPEAN CENTRAL BANK, Having regard to the Treaty on the Functioning of the European Union, Having regard to...
Official Journal EN of the European Union L series 2026/1942 14.8.2026 DECISION(EU) 2026/1942 OF THE EUROPEAN CENTRAL BANK of 30 July 2026 on the processing of personal data in the context of the prudential supervision of credit institutions (ECB/2026/18) THE GOVERNING COUNCIL OF THE EUROPEAN CENTRAL BANK, Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC(1), and in particular Article 28 thereof, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)(2), and in particular Article 26 thereof, Having regard to Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions(3), and in particular Article 4(3) and Article 6(1) and (7) thereof,
Whereas:
(1) The European Central Bank (ECB) and each national competent authority (NCA) together comprise the Single Supervisory Mechanism (SSM). The ECB and the NCAs carry out supervisory tasks relating to the prudential supervision of credit institutions pursuant to Regulation (EU) No 1024/2013. When carrying out those supervisory tasks, the ECB and the NCAs may process personal data.
(2) When processing personal data in carrying out supervisory tasks, the ECB and the NCAs jointly determine the purposes and means of processing. The joint determination of the purposes of processing of personal data occurs as a result of the organisation of work within the SSM which entails cooperation between the ECB and the NCAs.
(3) The ECB and each NCA are therefore to be considered as joint controllers within the meaning of Article 28(1) of Regulation (EU) 2018/1725, concerning the ECB, and Article 26(1) of Regulation (EU) 2016/679, concerning the NCAs, in relation to the personal data processing operations performed in carrying out supervisory tasks.
(4) Article 28(1) of Regulation (EU) 2018/1725 and Article 26(1) of Regulation (EU) 2016/679 provide that the joint controllers must determine, by means of an arrangement between them, their respective responsibilities for compliance with the obligations under Regulation (EU) 2018/1725 and Regulation (EU) 2016/679, respectively. In the interests of the effective and consistent functioning of the SSM for which the ECB is responsible under Article 6(1) of Regulation (EU) No 1024/2013, and transparency and legal certainty, it is appropriate that such an arrangement should be established by means of a decision of the ECB adopted in consultation with the NCAs in accordance with Article 6(1) and (7) of Regulation (EU) No 1024/2013.
(5) The joint controllers should process personal data for the purposes of the following supervisory tasks: (a) fit and proper procedures for significant supervised entities; (b) authorisation procedures; (c) ongoing supervision of significant supervised entities; (d) enforcement and sanctions, with the exclusion of certain specific procedures;
(e) on-site inspections of significant supervised entities; (f) oversight of the supervision of less significant supervised entities; and (g) supervision of less significant supervised entities.
(1) OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj.
(2) OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj.
(3) OJ L 287, 29.10.2013, p. 63, ELI: http://data.europa.eu/eli/reg/2013/1024/oj.
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 1/25EN OJ L, 14.8.2026
(6) Where personal data are processed in the context of procedures under Article 18(5) of Regulation
(EU) No 1024/2013 from the moment the ECB notifies the NCA that it requires the NCA to open proceedings; in the context of procedures under Article 136 of Regulation (EU) No 468/2014 of the European Central Bank (ECB/2014/17)(4)from the moment the ECB notifies the NCA of its request; and where there is a legal basis for the processing of personal data different from Regulation (EU) No 1024/2013, each NCA should be a sole controller.
For any processing of personal data in relation to reports of breaches of Union or national law relating to the prudential supervision of credit institutions submitted through the ECB’s or an NCA’s whistleblowing mechanism, the ECB or the NCA, respectively, should be a sole controller.
(7) In order to comply with Article 28(2) of Regulation (EU) 2018/1725 and Article 26(2) of Regulation (EU) 2016/679, this Decision should set out the respective roles and relationships of the joint controllers vis-à-vis the data subjects and govern how the joint controllers are to make the essence of the arrangement available to the data subjects.
(8) The organisation of work within the SSM implies that typically only two or several joint controllers carry out a supervisory task in relation to a supervised entity and perform the related personal data processing operations.
Therefore, it is appropriate that the determination of the respective responsibilities of the joint controllers pursuant to Article 28(1) of Regulation (EU) 2018/1725 or Article 26(1) of Regulation (EU) 2016/679 takes account of which joint controllers carry out the specific supervisory task in relation to a supervised entity. This approach to determining the respective responsibilities of the joint controllers is particularly relevant in the context of providing information to the data subject, handling data subject requests and notifying the supervisory authorities of personal data breaches relating to the personal data processed by that joint controller.
(9) Personal data breaches should be managed by the joint controller responsible. In the unlikely event that the joint controller responsible cannot be determined rapidly, all the joint controllers should be responsible for managing the personal data breach. In such a case, it is appropriate that all the joint controllers coordinate with each other with a view to meeting their respective notification obligations towards the supervisory authority and their communication obligations towards the data subject under Regulation (EU) 2018/1725 or Regulation (EU) 2016/679. Where a personal data breach is communicated to the data subject, it is necessary that this is done in an effective manner in
order to avoid multiple or inconsistent communications. The ECB should always notify all personal data breaches to the European Data Protection Supervisor, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
(10) Each joint controller should remain individually responsible for maintaining a record of the processing activities that fall under its responsibility; determining the periods for which the personal data will be stored; deciding to restrict the application of data subject rights, where necessary and proportionate, or to apply any exceptions under Article 16(5) of Regulation (EU) 2018/1725 or Article 14(5) of Regulation (EU) 2016/679; identifying and assessing the lawfulness, necessity and proportionality of transfers of personal data to a third country or an international organisation; and engaging the processors which process personal data on its behalf.
(11) The joint controllers are liable for damage suffered as a result of an infringement of Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, respectively, in accordance with Article 65 of Regulation (EU) 2018/1725, concerning the ECB, and Article 82 of Regulation (EU) 2016/679, concerning each NCA. Each of the joint controllers is jointly and severally liable vis-à-vis the data subjects, and the distribution of the compensation paid between the joint controllers therefore should be regulated.
(12) This Decision should not affect the applicability of other Union legal acts that lay down rules on the transmission of supervisory information held by the ECB to Union institutions and bodies, and national and international courts and authorities,
(4) Regulation (EU) No 468/2014 of the European Central Bank of 16 April 2014 establishing the framework for cooperation within the Single Supervisory Mechanism between the European Central Bank and national competent authorities and with national designated authorities (SSM Framework Regulation) (ECB/2014/17) (OJ L 141, 14.5.2014, p. 1, ELI: http://data.europa.eu/eli/reg/2014/468/oj).
2/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026
HAS ADOPTED THIS DECISION:
Article 1 Subject matter and scope
1. This Decision sets out the allocation of the respective roles and responsibilities between the joint controllers, which are the ECB and the NCAs, for compliance with Regulation (EU) 2018/1725, concerning the ECB, and Regulation
(EU) 2016/679, concerning the NCAs, when processing personal data in carrying out the supervisory tasks listed in paragraph 2.
2. This Decision applies to the processing of personal data in carrying out the following supervisory tasks:
(a) fit and proper procedures for significant supervised entities;
(b) authorisation procedures;
(c) ongoing supervision of significant supervised entities;
(d) enforcement and sanctions, with the exclusion of the processing of personal data by NCAs acting pursuant to Article 18(5) of Regulation (EU) No 1024/2013 from the moment the ECB notifies the NCA that it requires the NCA to open proceedings, and procedures under Article 136 of Regulation (EU) No 468/2014 (ECB/2014/17) from the moment the ECB notifies the NCA of its request;
(e) on-site inspections of significant supervised entities;
(f) oversight of the supervision of less significant supervised entities;
(g) supervision of less significant supervised entities.
For each supervisory task, the subject matter, nature and purpose of processing, the legal basis for processing, the data subjects concerned and the categories of personal data processed are set out in the Annexes.
3. This Decision shall not apply to the processing of personal data in relation to reports of breaches of Union or national law relating to the prudential supervision of credit institutions submitted through the ECB’s or an NCA’s whistleblowing mechanism. Nor shall it apply where NCAs process personal data under a legal basis other than Regulation
(EU) No 1024/2013.
4. This Decision is without prejudice to other Union legal acts laying down rules on the transmission of supervisory information held by the ECB to Union institutions and bodies, and national and international courts and authorities.
Article 2 Definitions For the purposes of this Decision, the definitions contained in Regulation (EU) No 1024/2013 and Regulation
(EU) No 468/2014 (ECB/2014/17) shall apply, unless otherwise provided for, together with the following definitions:
(1) ‘processing’ means processing as defined in Article 3, point (3), of Regulation (EU) 2018/1725 or Article 4, point (2), of Regulation (EU) 2016/679;
(2) ‘personal data’ means personal data as defined in Article 3, point (1), of Regulation (EU) 2018/1725 or Article 4, point (1), of Regulation (EU) 2016/679;
(3) ‘national competent authority’ (NCA) means a national competent authority as defined in Article 2, point (9), of Regulation (EU) No 468/2014 (ECB/2014/17);
(4) ‘supervisory task’ means a task conferred on the ECB under Article 4(1) and (2) and carried out within the framework of Article 6 of Regulation (EU) No 1024/2013;
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 3/25EN OJ L, 14.8.2026
(5) ‘controller’ means a controller as defined in Article 3, point (8), of Regulation (EU) 2018/1725 or Article 4, point (7), of Regulation (EU) 2016/679;
(6) ‘joint controller’ means a joint controller within the meaning of Article 28(1) of Regulation (EU) 2018/1725 or Article 26(1) of Regulation (EU) 2016/679;
(7) ‘processor’ means a processor as defined in Article 3, point (12), of Regulation (EU) 2018/1725 or Article 4, point
(8), of Regulation (EU) 2016/679;
(8) ‘Union institutions and bodies’ means Union institutions and bodies as defined in Article 3, point (10), of Regulation
(EU) 2018/1725;
(9) ‘data protection notice’ means a document whereby data subjects are provided with information in accordance with Articles 15 or 16 of Regulation (EU) 2018/1725 or Articles 13 or 14 of Regulation (EU) 2016/679;
(10) ‘data subject request’ means a request addressed by a data subject to one or more of the joint controllers whereby the data subject exercises any of their rights under Chapter III of Regulation (EU) 2018/1725 or Chapter III of Regulation
(EU) 2016/679;
(11) ‘personal data breach’ means a personal data breach as defined in Article 3, point (16), of Regulation (EU) 2018/1725 or Article 4, point (12), of Regulation (EU) 2016/679;
(12) ‘supervisory authority’ means a national supervisory authority as defined in Article 3, point (22), of Regulation
(EU) 2018/1725, a supervisory authority as defined in Article 4, point (21), of Regulation (EU) 2016/679, or the European Data Protection Supervisor;
(13) ‘home Member State’ means the Member State in which a credit institution has been granted authorisation;
(14) ‘host Member State’ means the Member State in which a credit institution has a branch or in which it provides services.
Article 3 Provision of information to the data subject
1. The joint controller that starts the processing of personal data, which includes the collection of personal data, shall provide the information to the data subject required by Articles 15 and 16 of Regulation (EU) 2018/1725 or Articles 13 and 14 of Regulation (EU) 2016/679, and by Article 28(2), second sentence, of Regulation (EU) 2018/1725 or Article 26(2), second sentence, of Regulation (EU) 2016/679, respectively. That joint controller shall be:
(a) for personal data submitted via the Information Management System (IMAS) portal, the ECB;
(b) for personal data received in all other cases:
(i) for fit and proper procedures for significant supervised entities, the relevant NCA in accordance with Articles 93 and 94 of Regulation (EU) No 468/2014 (ECB/2014/17);
(ii) for authorisation procedures:
(1) in cases of authorisation, the NCA that receives the application for authorisation to take up the business of a credit institution pursuant to Article 14(1) of Regulation (EU) No 1024/2013;
(2) in cases of qualifying holdings, the NCA that receives the notification or any related information pursuant to Article 15(1) of Regulation (EU) No 1024/2013;
(3) in cases of procedures initiated by an NCA for withdrawal of an authorisation to take up the business of a credit institution, including a withdrawal at the credit institution’s request, pursuant to Article 80 of Regulation (EU) No 468/2014 (ECB/2014/17), the relevant NCA;
4/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026
(4) in cases of procedures initiated by the ECB for withdrawal of an authorisation to take up the business of a credit institution, the ECB;
(5) in cases of establishment of a branch by a significant supervised entity, the NCA of the home Member State in accordance with Article 11 of Regulation (EU) No 468/2014 (ECB/2014/17);
(6) in cases of notification of a change in the provision of services by a significant supervised entity or a less significant supervised entity; notification of a change in branch particulars by a significant supervised entity or a less significant supervised entity; or the establishment of a branch by a less significant supervised entity, the NCA of the home Member State;
(7) in cases of establishment of a branch in a participating Member State by a credit institution established in a non-participating Member State, the NCA of the host Member State;
(8) in cases of the provision of services outside the participating Member States by a significant supervised entity or by a less significant supervised entity, the NCA of the home Member State;
(9) in cases of the provision of services in a participating Member State by a credit institution established in a non-participating Member State, the NCA of the host Member State;
(10) in cases of approval or exemption from approval of (mixed) financial holding companies comprising significant supervised entities or significant supervised groups, the ECB;
(11) in cases of approval or exemption from approval of (mixed) financial holding companies comprising less significant supervised entities or less significant supervised groups, the NCA that receives the application in accordance with Article 21a of Directive 2013/36/EU of the European Parliament and of the Council(5);
(12) in cases of mergers carried out by institutions and by (mixed) financial holding companies where the entities resulting from such proposed operation are significant supervised entities, the ECB;
(13) in cases of mergers carried out by institutions and by (mixed) financial holding companies where the entities resulting from such proposed operation are less significant supervised entities, the NCA that receives the notification pursuant to Article 27i(1), first subparagraph, of Directive 2013/36/EU;
(14) in cases of divisions carried out by institutions and by (mixed) financial holding companies that are significant supervised entities, the ECB;
(15) in cases of divisions carried out by institutions and by (mixed) financial holding companies that are less significant supervised entities, the NCA that receives the notification pursuant to Article 27i(1), second subparagraph, of Directive 2013/36/EU;
(iii) for ongoing supervision of significant supervised entities, the ECB;
(iv) for enforcement and sanctions, the ECB;
(v) for on-site inspections of significant supervised entities, the ECB;
(vi) for oversight of the supervision of less significant supervised entities, the ECB;
(vii) for supervision of less significant supervised entities:
(1) the NCA of the home Member State; or
(2) where the ECB exercises directly itself all the relevant powers for a less significant supervised entity pursuant to Article 6(5), point (b), of Regulation (EU) No 1024/2013, the ECB.
(5) Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338, ELI: http://data.europa.eu/eli/dir/2013/36/oj).
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 5/25EN OJ L, 14.8.2026
2. Each joint controller shall publish a data protection notice on its website, in addition to complying with the obligation referred to in paragraph 1.
3. The joint controllers shall coordinate and agree on the consistent, if not identical, content of the information to be
provided to the data subject pursuant to Article 28(2), second sentence, of Regulation (EU) 2018/1725 and Article 26(2), second sentence, of Regulation (EU) 2016/679, respectively.
Article 4 Handling of data subject requests
1. Data subjects may exercise their rights under Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, whichever is applicable, in respect of and against each of the joint controllers. Each joint controller shall publish its contact point and the contact point of each of the other joint controllers in its data protection notice on its website.
2. The joint controller responsible for handling the data subject request shall be:
(a) for fit and proper procedures for significant supervised entities, the relevant NCA in accordance with Articles 93 and 94 of Regulation (EU) No 468/2014 (ECB/2014/17) until the assessment in the fit and proper procedure is assigned to the ECB, and thereafter the ECB;
(b) for authorisation procedures:
(i) in cases of authorisation, the NCA that receives the application for authorisation to take up the business of a credit institution pursuant to Article 14(1) of Regulation (EU) No 1024/2013 until the draft decision prepared by the NCA is notified to the ECB, and thereafter the ECB;
(ii) in cases of qualifying holdings, the NCA that receives the notification or any related information pursuant to Article 15(1) of Regulation (EU) No 1024/2013 until the draft NCA proposal for a decision to oppose or not to oppose the acquisition is submitted to the ECB, and thereafter the ECB;
(iii) in cases of procedures initiated by an NCA for withdrawal of an authorisation to take up the business of a credit institution, including a withdrawal at the credit institution’s request, pursuant to Article 80 of Regulation
(EU) No 468/2014 (ECB/2014/17), the relevant NCA until the draft withdrawal decision prepared by the NCA is submitted to the ECB, and thereafter the ECB;
(iv) in cases of procedures initiated by the ECB for withdrawal of an authorisation to take up the business of a credit institution, the ECB;
(v) in cases of establishment of a branch by a significant supervised entity, the NCA of the home Member State in accordance with Article 11 of Regulation (EU) No 468/2014 (ECB/2014/17) until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;
(vi) in cases of notification of a change in the provision of services by a significant supervised entity or a less significant supervised entity; notification of a change in branch particulars by a significant supervised entity or a less significant supervised entity; or the establishment of a branch by a less significant supervised entity, the NCA of the home Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;
(vii) in cases of establishment of a branch in a participating Member State by a credit institution established in a non-participating Member State, the NCA of the host Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;
(viii) in cases of the provision of services outside the participating Member States by a significant supervised entity or by a less significant supervised entity, the NCA of the home Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;
6/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026
(ix) in cases of the provision of services in a participating Member State by a credit institution established in a non- participating Member State, the NCA of the host Member State until the opening of the passporting procedure is notified to the ECB, and thereafter the ECB;
(x) in cases of approval or exemption from approval of (mixed) financial holding companies comprising significant supervised entities or significant supervised groups, the ECB;
(xi) in cases of approval or exemption from approval of (mixed) financial holding companies comprising less significant supervised entities or less significant supervised groups, the NCA that receives the application in accordance with Article 21a of Directive 2013/36/EU;
(xii) in cases of mergers carried out by institutions and by (mixed) financial holding companies where the entities resulting from such proposed operation are significant supervised entities, the ECB;
(xiii) in cases of mergers carried out by institutions and by (mixed) financial holding companies where the entities resulting from such proposed operation are less significant supervised entities, the NCA that receives the
notification pursuant to Article 27i(1), first subparagraph, of Directive 2013/36/EU;
(xiv) in cases of divisions carried out by institutions and by (mixed) financial holding companies that are significant supervised entities, the ECB;
(xv) in cases of divisions carried out by institutions and by (mixed) financial holding companies that are less significant supervised entities, the NCA that receives the notification pursuant to Article 27i(1), second subparagraph, of Directive 2013/36/EU;
(c) for ongoing supervision of significant supervised entities, the ECB;
(d) for enforcement and sanctions, the ECB;
(e) for on-site inspections of significant supervised entities, the ECB;
(f) for oversight of the supervision of less significant supervised entities, the ECB;
(g) for supervision of less significant supervised entities:
(i) the NCA of the home Member State; or
(ii) where the ECB exercises directly itself all the relevant powers for a less significant supervised entity pursuant to Article 6(5), point (b), of Regulation (EU) No 1024/2013, the ECB.
3. A joint controller shall, when requested to do so by the joint controller responsible under paragraph 2, provide swift and efficient assistance to the latter in handling any data subject requests, in accordance with the procedure set out in paragraph 4.
4. The following rules shall apply to the handling of data subject requests:
(a) The joint controller that receives the data subject request shall send an acknowledgment of receipt to the data subject without undue delay. If the data subject request does not fall under its responsibility as determined in accordance with paragraph 2, the joint controller that receives the data subject request shall forward it to the joint controller actually responsible for handling that request under paragraph 2.
(b) If the joint controller to whom the data subject request has been forwarded confirms that it is the joint controller responsible for handling that request under paragraph 2, the joint controller that received the data subject request shall inform the data subject of the transmission of the data subject request to that joint controller.
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 7/25EN OJ L, 14.8.2026
(c) Any disagreement as to which joint controller is responsible under paragraph 2 shall be resolved in a meeting between the joint controller that received the data subject request, the joint controller to whom the data subject request has been forwarded and any other joint controller that the latter considers to be responsible under paragraph
2. Following that meeting, the joint controller that received the data subject request shall inform the data subject of the transmission of the data subject request to the joint controller that has confirmed it is responsible under paragraph 2. If the joint controller that receives the data subject request is the joint controller responsible under paragraph 2 but the data subject request also pertains to other supervisory tasks referred to in paragraph 2, points
(a) to (g), that joint controller shall request the assistance of another joint controller or joint controllers in accordance with paragraph 3.
(d) The joint controller responsible under paragraph 2 shall send the final reply to the data subject, having incorporated the input provided by any other joint controllers under point (c), if relevant.
Article 5 Procedure related to personal data breaches
1. A joint controller that becomes aware of a personal data breach shall notify all the other joint controllers of the breach without undue delay, and at the latest within 24 hours after having become aware of the occurrence of the personal data breach.
2. The joint controller that caused the personal data breach or to whom the personal data breach is attributable, including breaches caused by or attributable to its processors or sub-processors, shall be responsible for managing that personal data breach in accordance with Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, respectively. If it cannot be determined which joint controller is responsible within 24 hours of receipt of the notification referred to in paragraph 1, all the joint controllers shall be responsible for managing the personal data breach.
3. The joint controller responsible under paragraph 2 shall, in particular, notify its supervisory authority and inform the data subject of the personal data breach, if appropriate. The ECB shall also notify the personal data breach to the European Data Protection Supervisor, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons, even if it is not the joint controller responsible.
4. The joint controller responsible under paragraph 2 shall notify all the other joint controllers without undue delay of
(a) the measures applied by the joint controller to mitigate the risks arising from the personal data breach; and (b) whether the data breach has been or will be notified to the supervisory authority and communicated to the data subject.
Article 6 Security of processing
1. Pursuant to Article 33 of Regulation (EU) 2018/1725 and Article 32 of Regulation (EU) 2016/679, respectively, the joint controllers shall implement appropriate technical and organisational measures to ensure the security of the personal data processed. In assessing the appropriate level of security, the joint controllers shall take into account the state of the art; the costs of implementation; the nature, scope, context and purposes of processing; and the risks involved for the data subjects.
2. Each joint controller that maintains and administers an IT system which is used in the processing of personal data shall establish and implement, or ensure that the processor establishes and implements, appropriate technical and organisational measures with regard to such system.
3. The joint controllers shall grant access to personal data processed in the context of this Decision only to natural persons acting under their authority and only to the extent necessary for fulfilling the purposes of the processing laid down in the Annexes.
4. The joint controllers shall ensure that persons authorised to process personal data have committed themselves to respect confidentiality or are under an appropriate statutory obligation of confidentiality.
8/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026 Article 7 Data protection impact assessments
1. The joint controllers shall agree whether a data protection impact assessment is required and which of the joint controllers shall prepare a draft of the data protection impact assessment.
2. A data protection impact assessment may only be considered final if it has been approved by all the joint controllers.
3. In justified cases, such as where the joint controllers are not involved during the same stages of a processing operation, the joint controllers shall carry out a separate data protection impact assessment for the specific stage of the processing operation during which they are involved.
4. Where a data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the rights and freedoms of natural persons and the joint controller responsible for preparing the draft under paragraph 1 is of the opinion that the risk cannot be mitigated by reasonable means in view of the available technologies and costs of implementation, that joint controller shall consult its supervisory authority. In such a case, the ECB shall also consult the European Data Protection Supervisor pursuant to Article 40 of Regulation (EU) 2018/1725, even if it is not the joint controller responsible for preparing the draft under paragraph 1.
Article 8 Other responsibilities of the joint controllers
1. Without prejudice to the obligations to which joint controllers are subject under Regulation (EU) 2018/1725, Regulation (EU) 2016/679, or national laws, each joint controller shall be responsible for the following:
(a) determining the periods for which the personal data will be stored in accordance with applicable data protection law;
(b) deciding to restrict the application of data subject rights, where necessary and proportionate, in accordance with applicable data protection rules, including internal rules adopted by a joint controller or national laws in compliance with Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, respectively, or to apply any exceptions under Article 16(5) of Regulation (EU) 2018/1725 or Article 14(5) of Regulation (EU) 2016/679, respectively;
(c) identifying and assessing the lawfulness, necessity and proportionality of transfers of personal data to a third country or an international organisation and complying with its obligations under Chapter V of Regulation (EU) 2018/1725 or Chapter V of Regulation (EU) 2016/679, respectively;
(d) engaging only processors providing sufficient guarantees to implement appropriate technical and organisational measures, pursuant to Article 29 of Regulation (EU) 2018/1725 and Article 28 of Regulation (EU) 2016/679, respectively;
(e) providing to the other joint controllers a list of processors engaged by that joint controller to process personal data in carrying out the supervisory tasks listed in Article 1(2).
2. The joint controllers shall notify each other of any relevant information relating to compliance with the obligations set out in paragraph 1, while having due regard to the applicable confidentiality regime.
Article 9 Compliance and documentation
1. Each of the joint controllers shall comply with the general principles of data protection as laid down in Article 4 of Regulation (EU) 2018/1725 or Article 5 of Regulation (EU) 2016/679, respectively.
2. Each joint controller shall maintain records of processing activities under its responsibility and hold the information necessary to demonstrate its compliance with this Decision.
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 9/25EN OJ L, 14.8.2026 Article 10 Cooperation between the joint controllers The joint controllers shall provide each other with the assistance necessary to enable each of them to comply with the requirements of Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, respectively, and with this Decision, within a timeframe compatible with the requirements contained in those Regulations.
Article 11 Distribution of compensation The joint controllers shall settle between them any compensation paid by one (or more) of them for damage suffered as a result of an infringement of Regulation (EU) 2018/1725 or Regulation (EU) 2016/679 according to the actual degree of responsibility. A joint controller proving that it is not in any way responsible for any event giving rise to liability shall be exempt from such settlement between it and other joint controllers and shall be entitled to recover from the joint controller actually responsible any contribution it has made to compensation paid.
Article 12 Settlement of disagreements
1. In the event of a disagreement regarding the settlement of compensation paid by one of the joint controllers for damage suffered as a result of an infringement of Regulation (EU) 2018/1725 or Regulation (EU) 2016/679, an independent panel shall be established to facilitate the resolution of the disagreement.
2. Any joint controller may serve notice of a disagreement to one or more joint controllers and appoint a panellist. Each joint controller that has been served notice shall appoint its panellist within two weeks of the date of receipt of the notice.
The joint controller that served the notice of disagreement and the joint controlllers that have been served notice shall be considered to be parties to the disagreement.
3. An independent panel shall have an odd number of members and shall be composed of the panellists appointed pursuant to paragraph 2 and one or two panellists jointly appointed by those panellists. The jointly appointed panellist or panellists shall serve as chair, or chair and vice-chair respectively according to their seniority, and they shall be remunerated through an equal financial contribution from all parties to the disagreement. The jointly appointed panellist or panellists shall be independent of the parties to the disagreement. The chair shall notify the final composition of the panel to the President of the ECB.
4. The independent panel shall work in accordance with the principles of impartiality and equality and the right to be heard.
5. The independent panel shall aim to deliver, within three months of the date of notification of its final composition to the President of the ECB, a reasoned recommendation on the resolution of the disagreement. The recommendation shall not be binding on the parties to the disagreement and may be submitted as evidence in court proceedings.
Article 13 Review To ensure the effectiveness of the determination of responsibilities, among the joint controllers, for compliance with the obligations under Regulation (EU) 2018/1725 and Regulation (EU) 2016/679, respectively, the Governing Council shall review the arrangements set out in this Decision at the latest five years following the date on which this Decision takes effect.
10/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026 Article 14 Taking effect This Decision shall take effect on the day of its notification to the addressees.
Article 15 Addressees This Decision is addressed to the national competent authorities of the participating Member States.
Done at Frankfurt am Main, 30 July 2026.
The President of the ECB Christine LAGARDE
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 11/25EN OJ L, 14.8.2026 ANNEX I Fit and proper assessments
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING The ECB, in cooperation with the NCAs, conducts assessments and reassessments of the suitability of appointees to positions of responsibility for the management and oversight of significant supervised entities, such as members of the management body and key function holders, as well as holders of other positions indicated by national law transposing Directive 2013/36/EU, branch managers, and certain other persons responsible for the management of significant supervised entities or their branches (hereinafter the ‘fit and proper procedure’).
In the context of fit and proper procedures, personal data are processed for the following purposes:
(a) assessing whether the appointees meet the fit and proper criteria;
(b) conducting reassessments to ensure that fit and proper requirements are met on a continuing basis and, if the requirements are not met, remove the members concerned from the management body of the significant supervised entity;
(c) assessing applications to authorise additional non-executive directorships of members of the management body, as well as applications to hold simultaneously in the significant supervised entity the position of Chair of the management body in its supervisory function and the position of Chief Executive Officer;
(d) conducting quantitative research, analysis and statistical reporting on an aggregated level.
2. LEGAL BASIS
(a) Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 4(1), point (e), and Articles 6, 7, 8, 9 and 10 of Regulation (EU) No 1024/2013;
(b) Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Directive 2013/36/EU, as transposed into national law.
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) appointees who are subject to an assessment pursuant to a fit and proper procedure;
(b) close relatives of an appointee, such as spouse, registered partner, cohabitee, child, parent or other relation with whom the appointee shares living accommodation;
(c) associates of an appointee whose personal data are relevant for the assessment of the appointee, such as persons who hold management positions in, or who are beneficial owners of, the supervised entity in which the appointment is made;
(d) authorised representatives of an appointee in the fit and proper procedure.
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) identification data, such as name, ID card/passport number, nationality and signature of the appointee;
(b) contact data, such as the postal address, email address and phone number of the appointee;
(c) professional data relating to the education, training, employment and other positions held by the appointee and the members of the management body of the supervised entity in which the appointment is made;
12/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026
(d) professional data relating to any other business activities of the appointee;
(e) details of criminal records; and information on criminal investigations and proceedings, relevant civil and administrative proceedings and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures;
(f) financial details of the appointee;
(g) description of the personal relationships of close relatives of the appointee with other members of the management body and/or key function holders of the supervised entity in which the appointment is made, its parent undertaking or its subsidiaries; and their professional and financial relationships with the supervised entity in which the appointment is made, its parent undertaking or its subsidiaries;
(h) information as to whether a fit and proper assessment has already been conducted by another competent authority and information about the outcome of this assessment;
(i) comments by ECB or NCA staff regarding the performance of the appointee in their current or any previous role that may have an impact on the current fit and proper procedure;
(j) information on the conduct of the appointee in their current role that may be relevant in the context of reassessments;
(k) sound recording of the appointee’s voice.
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 13/25EN OJ L, 14.8.2026 ANNEX II Authorisation procedures
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING The ECB, in cooperation with the NCAs, conducts assessments in the context of authorisation procedures comprising the acquisition of qualifying holdings, the granting and withdrawal of authorisation to take up the business of a credit institution, supervised entities’ right of establishment and freedom to provide services, approvals or exemptions from approval of (mixed) financial holding companies comprising significant supervised entities, or significant supervised groups, as well as mergers and divisions that are notified.
In the context of each of the respective authorisation procedures, personal data are processed for the following
purposes:
(a) authorisation to take up the business of a credit institution: to assess whether an applicant for an authorisation fulfils the relevant requirements of national and Union law, which may include the assessment of the structural organisation, fit and proper assessments of members of the management body and key function holders, as well as the analysis of the suitability of the applicant’s shareholders or members;
(b) qualifying holdings: to ascertain the financial soundness of the proposed acquisition and the suitability of the proposed acquirer;
(c) withdrawals of authorisation to take up the business of a credit institution: to assess whether a supervised entity meets the conditions for withdrawal of an authorisation under national and Union law;
(d) supervised entities’ right of establishment and freedom to provide services: to assess whether the establishment of a branch or the provision of services by significant supervised entities and less significant supervised entities, the establishment of a branch in a participating Member State by a credit institution established in non- participating Member State, the provision of services outside the participating Member States by a significant or a less significant supervised entity, the provision of services in a participating Member State by a credit institution established in a non-participating Member State, and changes in branch particulars or changes in the provision of services by significant supervised entities or less significant supervised entities comply with the relevant requirements of national and Union law;
(e) approvals or exemptions from approval of (mixed) financial holding companies: to assess whether the criteria set out in the relevant national and Union law for granting an approval or exemption from approval of a
(mixed) financial holding company are met, including the assessment of the internal arrangements and structural organisation of the group of which the (mixed) financial holding company is part, as well as the internal distribution of tasks within the that group, and the suitability of the members of the management body and of the shareholders (or members) of the (mixed) financial holding company.
(f) mergers and divisions carried out by institutions and by (mixed) financial holding companies: to assess whether the criteria set out in the relevant national and Union law for the approval of mergers and divisions are met, including the assessment of the reputation and financial soundness of the financial stakeholders involved and whether the entity resulting from the proposed operation will be able to comply and continue to comply with the prudential requirements.
2. LEGAL BASIS
(a) Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 4(1), points (a), (b), (c) and (g), Articles 4(2) and 6(4), Articles 14 and 15, and Article 17(1) of Regulation (EU) No 1024/2013;
(b) Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Articles 8, 11 to 17 and Part V, Titles 1, 2 and 3 of Regulation (EU) No 468/2014 (ECB/2014/17);
14/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026
(c) Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Articles 8, 8a, 10 to 14, 18, 21a, 22, 23, 27i, 27j, 33, 34, 35 and 39 of Directive 2013/36/EU, as transposed into national law.
3. DATA SUBJECTS Personal data relating to the following categories of data subjects may be processed.
3.1. Authorisation to take up the business of a credit institution:
(a) staff of the applicant;
(b) members of the management body, key function holders, and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the applicant or other entities linked to the applicant;
(c) persons with whom the applicant or members of the management body, key function holders, and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the applicant has or have relevant financial or non-financial relationships;
(d) authorised representatives of the applicant in the authorisation procedure.
3.2. Qualifying holdings:
(a) staff of the supervised entity subject to the procedure; members of the management body and shareholders of the supervised entity subject to the procedure or other relevant entities;
(b) persons effectively directing the business of the acquirer and members of the management body who will direct the business of the supervised entity subject to the procedure as a result of the proposed acquisition of the qualifying holding, as well as persons with whom they have relevant financial or non- financial relationships;
(c) the acquirer of a qualifying holding, as well as persons with whom they have relevant financial or non- financial relationships;
(d) staff and authorised representatives of the acquirer.
3.3. Withdrawals of authorisation to take up the business of a credit institution:
(a) members of the management body, key function holders, and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the supervised entity subject to the procedure;
(b) persons with whom members of the management body, and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the supervised entity subject to the procedure has or have relevant financial or non-financial relationships;
(c) staff and authorised representatives of the supervised entity subject to the procedure.
3.4. Supervised entities’ right of establishment and freedom to provide services:
(a) staff of the supervised entity subject to the procedure;
(b) members of the management body and shareholders of the supervised entity subject to the procedure;
(c) authorised representatives of the supervised entity subject to the procedure.
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 15/25EN OJ L, 14.8.2026
3.5. Approvals or exemptions from approval of (mixed) financial holding companies:
(a) staff of the (mixed) financial holding company subject to the procedure and of the supervised entity which is a subsidiary of the (mixed) financial holding company subject to the procedure;
(b) members of the management body and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the supervised entity which is a subsidiary of the (mixed) financial holding company subject to the procedure, as well as persons with whom they have relevant financial or non-financial relationships;
(c) members of the management body and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the (mixed) financial holding company subject to the procedure, as well as persons with whom they have relevant financial or non-financial relationships;
(d) authorised representatives of the (mixed) financial holding company subject to the procedure.
3.6. Mergers and divisions carried out by institutions and by (mixed) financial holding companies:
(a) staff of the supervised entity subject to the procedure;
(b) members of the management body, key function holders, and shareholders or members (in the case of legal persons, the persons effectively directing the business) of the supervised entity or other entities linked to the supervised entity subject to the procedure;
(c) members of the management body who will direct the business of the supervised entity resulting from the proposed operation, as well as persons with whom they have relevant financial or non-financial relationships;
(d) authorised representatives of the supervised entity subject to the procedure.
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) identification data, such as name, ID card/passport number, nationality and signature;
(b) contact data, such as postal address, email address and phone number;
(c) professional data relating to education, training, employment and other positions held;
(d) professional data relating to any other business activities;
(e) details of criminal records and information on criminal investigations and proceedings, relevant civil and administrative proceedings and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures;
(f) financial details;
(g) description of relevant financial and non-financial interests or relationships;
(h) information on any refusal of registration, authorisation, membership of a trade, business or profession or licence to carry out a trade, business or profession; the withdrawal, revocation or termination of such registration, authorisation, membership or licence; or expulsion by a regulatory or government body or by a professional body or association;
(i) information as to whether an assessment of reputation has already been conducted by another competent authority and information about the outcome of this assessment;
(j) comments by the ECB or NCA staff regarding the performance of the relevant person in their current or any previous role that may have an impact on the relevant assessment;
(k) sound recording of the relevant person’s voice.
16/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026 ANNEX III Ongoing supervision of significant supervised entities
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING In the context of the prudential supervision of significant supervised entities, personal data are processed for the
following purposes:
(a) ensuring that significant supervised entities comply with relevant Union law, including national transpositions thereof, imposing prudential requirements in the areas of (i) own funds, securitisation, large exposure limits, liquidity, leverage, and reporting and public disclosure of information on those matters; and (ii) governance, including risk management processes, internal control mechanisms, remuneration policies and practices and effective internal capital and liquidity adequacy assessment processes, including internal ratings based models;
(b) carrying out supervisory reviews and stress tests to determine whether significant supervised entities comply with the relevant requirements of Union law and, on the basis of that supervisory review, imposing on supervised entities specific requirements and other measures;
(c) carrying out supervision over supervised entities’ parents established in one of the participating Member States, including over (mixed) financial holding companies, and participating in supervision on a consolidated basis, including in colleges of supervisors without prejudice to the participation of NCAs in those colleges as observers, in relation to parents not established in one of the participating Member States;
(d) participating in supplementary supervision of financial conglomerates in relation to the supervised entities included in them and assuming the tasks of a coordinator where the ECB is appointed as the coordinator for a financial conglomerate in accordance with the criteria set out in relevant Union law;
(e) carrying out supervisory tasks in relation to recovery plans and early intervention;
(f) carrying out supervisory tasks in relation to the assessment of material holdings that are not qualifying holdings;
(g) exercising, vis-à-vis significant supervised entities, supervisory powers granted under national law which fall within the scope of the ECB’s tasks, including the approval of acquisitions by significant supervised entities of holdings in a non-credit institution or a credit institution outside the Union, mergers or demergers of credit institutions, the acquisition or sale of assets or liabilities, amendments to credit institutions’ statutes, the appointment of external auditors, requests for information and specific reports from external auditors, outsourcing projects, operations in third countries, the exercise of powers vis-à-vis shareholders, the granting or limitation of credit to related parties, strategic decisions and the establishment of cooperative banking groups;
(h) exercising, vis-à-vis significant supervised entities, supervisory powers granted under Union law, including the options and discretions available to competent authorities under Regulation (EU) No 575/2013 of the European Parliament and of the Council(1)and Directive 2013/36/EU, as transposed into national law;
2. LEGAL BASIS Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 4(1), points (d), (e), (f), (g), (h) and (i), Article 4(3) and Articles 6 and 9 of Regulation (EU) No 1024/2013.
(1) Regulation (EU) No 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012 (OJ L 176, 27.6.2013, p. 1, ELI: http://data.europa.eu/eli/reg/2013/575/oj).
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 17/25EN OJ L, 14.8.2026
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) staff of a significant supervised entity;
(b) members of the management body, customers and their guarantors, shareholders and creditors, service providers, consultants and external auditors of a significant supervised entity;
(c) staff or representatives of banking associations;
(d) staff of Union institutions and bodies, and of national and international authorities;
(e) other third parties, such as persons filing complaints or submitting requests for information regarding a significant supervised entity;
(f) authorised representatives of an appointee in a fit and proper procedure;
(g) authorised representatives of the acquirer of a material holding;
(h) staff of the acquirer of a material holding.
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) identification data, such as name, ID card/passport number, nationality and signature;
(b) contact data, such as postal address, email address and phone number;
(c) professional data relating to education, training, employment, other positions held and any other business activities;
(d) financial details, such as in the context of a credit file review of a bank customer or in the context of a loan to a member of the management body when a pre-approval is required;
(e) details of criminal records; and information on criminal investigations and proceedings, relevant civil and administrative proceedings and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures.
18/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026 ANNEX IV Enforcement and sanctions
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING In the context of enforcement and sanctions procedures, personal data are processed for the following purposes:
(a) investigating alleged breaches of requirements under relevant directly applicable acts of Union law committed by supervised entities in relation to which administrative pecuniary penalties may be imposed pursuant to Article 18(1) of Regulation (EU) No 1024/2013 and preparing proposals for the imposition of such penalties;
(b) investigating alleged breaches by supervised entities of ECB regulations or decisions in relation to which sanctions may be imposed pursuant to Article 18(7) of Regulation (EU) No 1024/2013;
(c) assessing, in the context of cases under Article 18(5) of Regulation (EU) No 1024/2013, whether an NCA should be required to open proceedings and notifying the NCA of such request;
(d) requesting information pursuant to Article 10 of Regulation (EU) No 1024/2013 and Article 139 of Regulation
(EU) No 468/2014 (ECB/2014/17) and carrying out tasks pursuant to Articles 125 to 138 of Regulation
(EU) No 468/2014 (ECB/2014/17) in the context of investigating alleged breaches as referred to in Article 18(1) and (7) of Regulation (EU) No 1024/2013;
(e) assessing whether an NCA should be requested pursuant to Article 136 of Regulation (EU) No 468/2014 (ECB/2014/17) to refer a suspected criminal offence to the appropriate authorities for investigation and possible criminal prosecution and notifying the NCA of such request.
2. LEGAL BASIS
(a) Article 5(1), points (a) and (b), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Articles 9, 10, 11 and 18 of Regulation
(EU) No 1024/2013;
(b) Article 5(1), points (a) and (b), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 113(3) and Articles 120 to 129, 134, 136 and 139 of Regulation (EU) No 468/2014 (ECB/2014/17).
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) staff of the supervised entity subject to the procedure;
(b) members of the management body of the supervised entity subject to the procedure;
(c) members of the management body of entities seeking to acquire a qualifying holding in the supervised entity;
(d) proposed acquirers of a qualifying holding;
(e) authorised representatives of the supervised entity subject to the procedure.
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) identification data, such as name, nationality and signature;
(b) contact data, such as postal address, email address and phone number;
(c) professional data relating to education, training and employment;
(d) financial details;
(e) details of (suspected) offences and criminal convictions.
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 19/25EN OJ L, 14.8.2026 ANNEX V On-site inspections of significant supervised entities
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING In the context of on-site inspections of significant supervised entities, personal data are processed for the following
purposes:
(a) carrying out on-site inspections to perform in-depth investigations of the supervised entities’ risks, risk controls and governance;
(b) assessing internal models used for the calculation of own funds requirements, in particular with regard to methodologies, economic appropriateness, risks, risk controls and governance;
(c) carrying out asset quality reviews to enhance transparency regarding the supervised entities’ exposures, including as regards the adequacy of asset and collateral valuations and related provisions.
2. LEGAL BASIS
(a) Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 4(1), point (f), Article 6(4) and Articles 10, 11 and 12 of Regulation (EU) No 1024/2013;
(b) Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Articles 143 to 146 of Regulation
(EU) No 468/2014 (ECB/2014/17).
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) staff members of the supervised entity;
(b) shareholders of the supervised entity;
(c) members of the management body of the supervised entity;
(d) customers of the supervised entity, their guarantors and connected parties;
(e) external auditors of the supervised entity;
(f) service providers and consultants to the supervised entity;
(g) staff of Union institutions and bodies, and of national and international authorities.
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) details of the customers of the supervised entity, such as:
(i) identification data, such as name, ID card/passport number, nationality and signature;
(ii) contact data, such as postal address, email address and phone number;
(iii) financial status and activities, such as information related to income level, expenditures, assets, debts, derivatives, financial commitments, credit score, payment history, disputes and litigation with the supervised entity, as well as overall financial health indicators;
(iv) household composition, characteristics of housing, education, and employment-related information and prospects;
20/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026
(b) details of the staff members, shareholders and members of the management body of the supervised entity,
such as:
(i) identification data, such as name, ID card/passport number, nationality and signature;
(ii) contact data, such as postal address, email address and phone number;
(iii) financial activities in relation to the supervised entity, such as information related to remuneration, assets, debts, derivatives and financial commitments;
(iv) work experience, qualifications, academic background;
(c) details of external auditors, service providers and consultants to the supervised entity and details of staff of Union institutions and bodies, and of national and international authorities, such as:
(i) identification data, such as name, ID card/passport number, nationality and signature;
(ii) contact data, such as postal address, email address and phone number;
(iii) description of the personal relationships of close relatives of the data subject with members of the management body and/or key function holders of the supervised entity, its parent undertaking or its subsidiaries, and a description of the data subject’s professional and financial relationships with the supervised entity, its parent undertaking or its subsidiaries.
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 21/25EN OJ L, 14.8.2026 ANNEX VI Oversight of the supervision of less significant supervised entities
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING In the context of the oversight of the supervision of less significant supervised entities, personal data are processed
for the following purposes:
(a) assessing whether NCAs are applying high-quality supervisory standards in a consistent way and checking whether comparable situations lead to comparable outcomes across the SSM;
(b) receiving ex anteand ex postnotifications from NCAs on material supervisory procedures and draft decisions regarding high-impact and high-risk less significant supervised entities and advising NCAs to further assess specific aspects of such procedures;
(c) receiving notifications from NCAs in relation to specific circumstances;
(d) carrying out thematic reviews to provide targeted insights into supervision by NCAs with regard to defined risk areas at the level of individual less significant supervised entities or classes of similar less significant supervised entities to ensure high quality supervision;
(e) participating in on-site inspections of less significant supervised entities with a view to fostering the ECB’s understanding of the conduct of NCA supervision.
2. LEGAL BASIS Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 6(4), (5) and (6) of Regulation (EU) No 1024/2013.
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) staff of less significant supervised entities;
(b) members of the management body, customers and their guarantors, shareholders and creditors, service providers, consultants and external auditors of less significant supervised entities;
(c) staff or representatives of banking associations;
(d) staff of Union institutions and bodies, and of national and international authorities.
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) identification data, such as name, ID card/passport number, nationality and signature;
(b) contact data, such as postal address, email address and phone number;
(c) professional data relating to the education, training, employment and other positions held by the appointee in a fit and proper procedure and the members of the management body of the supervised entity in which the appointment is made;
(d) professional data relating to any other business activities of the appointee in a fit and proper procedure;
(e) financial details of the appointee in a fit and proper procedure;
(f) details of criminal records; and information on criminal investigations and proceedings, relevant civil and administrative proceedings and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures;
22/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026
(g) description of the personal relationships of close relatives of the appointee in a fit and proper procedure with other members of the management body and/or key function holders of the supervised entity in which the appointment is made, its parent undertaking or its subsidiaries; and their professional and financial relationships with the supervised entity in which the appointment is made, its parent undertaking or its subsidiaries;
(h) information as to whether a fit and proper assessment has already been conducted by another competent authority and information about the outcome of this assessment;
(i) comments by the ECB staff or NCA staff regarding the performance of the appointee in their current or any previous role that may have an impact on the current fit and proper procedure;
(j) information on the conduct of the appointee in the current role that may be relevant in the context of reassessments.
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 23/25EN OJ L, 14.8.2026 ANNEX VII Supervision of less significant supervised entities
1. SUBJECT MATTER, NATURE AND PURPOSE OF PROCESSING In the context of the prudential supervision of less significant supervised entities, personal data are processed for the
following purposes:
(a) ensuring that less significant supervised entities comply with relevant Union law, including national transpositions thereof, imposing prudential requirements in the areas of (i) own funds, securitisation, large exposure limits, liquidity, leverage, and reporting and public disclosure of information on those matters; and
(ii) governance, including risk management processes, internal control mechanisms, remuneration policies and practices and effective internal capital and liquidity adequacy assessment processes, including internal ratings based models;
(b) carrying out supervisory reviews and stress tests to determine whether less significant supervised entities comply with the relevant requirements of Union law and, on the basis of that supervisory review, imposing on less significant supervised entities specific requirements and other measures;
(c) carrying out supervision on a consolidated basis over less significant supervised entities’ parents established in one of the participating Member States, including over (mixed) financial holding companies, and participating in supervision on a consolidated basis, including in colleges of supervisors without prejudice to the participation of NCAs in those colleges as observers, in relation to parents not established in one of the participating Member States;
(d) carrying out supervisory tasks in relation to recovery plans and early intervention;
(e) carrying out on-site inspections of less significant supervised entities;
(f) exercising, vis-à-vis less significant supervised entities, supervisory powers granted under national law, including, among others, the approval of acquisitions by less significant supervised entities of holdings in a non-credit institution or a credit institution outside the Union, mergers or demergers of credit institutions, the acquisition or sale of assets or liabilities, amendments to credit institutions’ statutes, the appointment of external auditors, requests for information and specific reports from external auditors, outsourcing projects, operations in third countries, the exercise of powers vis-à-vis shareholders, the granting or limitation of credit to related parties, strategic decisions and the establishment of cooperative banking groups;
(g) exercising, vis-à-vis less significant supervised entities, supervisory powers granted to competent authorities under Regulation (EU) No 575/2013, and Directive 2013/36/EU, as transposed into national law.
2. LEGAL BASIS Article 5(1), point (a), of Regulation (EU) 2018/1725 or Article 6(1), point (e), and, in some Member States, point (c), of Regulation (EU) 2016/679 in conjunction with Article 4(1), points (b), (d), (g) and (i) and Article 6(6) of Regulation
(EU) No 1024/2013.
3. DATA SUBJECTS
Personal data relating to the following categories of data subjects may be processed:
(a) staff of less significant supervised entities;
(b) members of the management body, customers and their guarantors, shareholders and creditors, service providers, consultants and external auditors of less significant supervised entities;
(c) staff or representatives of banking associations;
(d) staff of Union institutions and bodies, and of national and international authorities;
(e) other third parties, such as persons filing complaints or submitting requests for information regarding a less significant supervised entity;
(f) authorised representatives of an appointee in a fit and proper procedure.
24/25 ELI: http://data.europa.eu/eli/dec/2026/1942/ojEN OJ L, 14.8.2026
4. CATEGORIES OF PERSONAL DATA PROCESSED
The following categories of personal data may be processed:
(a) identification data, such as name, ID card/passport number, nationality and signature;
(b) contact data, such as postal address, email address and phone number;
(c) professional data relating to the education, training, employment and other positions held by the appointee in a fit and proper procedure and the members of the management body of the supervised entity in which the appointment is made;
(d) professional data relating to any other business activities of the appointee in a fit and proper procedure;
(e) details of criminal records; and information on criminal investigations and proceedings, relevant civil and administrative proceedings and disciplinary actions, including disqualification as a company director, bankruptcy, insolvency and similar procedures;
(f) financial details of the appointee in a fit and proper procedure;
(g) description of the personal relationships of close relatives of the appointee in a fit and proper procedure with other members of the management body and/or key function holders of the supervised entity in which the appointment is made, its parent undertaking or its subsidiaries; and their professional and financial relationships with the supervised entity in which the appointment is made, its parent undertaking or its subsidiaries;
(h) information as to whether a fit and proper assessment has already been conducted by another competent authority and information about the outcome of this assessment;
(i) comments by ECB or NCA staff regarding the performance of the appointee in their current or any previous role that may have an impact on the current fit and proper procedure;
(j) information on the conduct of the appointee in their current role that may be relevant in the context of reassessments;
(k) financial details, such as in the context of a credit file review of a bank customer or in the context of a loan to a member of the management body when a pre-approval is required;
(l) sound recording of the voice of the appointee in a fit and proper procedure.
ELI: http://data.europa.eu/eli/dec/2026/1942/oj 25/25