CJEU 10/02/2026 — GDPR: EDPB binding decisions are challengeable

10 February 2026 — The CJEU held that an EDPB binding decision (Art. 65 GDPR) is a challengeable act that directly concerns the company. Key takeaway: the EDPB’s fine methodology can now be contested before EU courts. See CP 11/26 and EUR‑Lex C‑97/23 P.

The case

The Grand Chamber delivered C‑97/23 P, WhatsApp Ireland v EDPB, setting aside the General Court’s 2022 order that had declared WhatsApp’s action against the EDPB Binding Decision 1/2021 inadmissible and remitting the case on the merits. The CJEU found that an Article 65 GDPR decision “produces legal effects vis‑à‑vis third parties” and is thus challengeable under Article 263 TFEU. WhatsApp is directly concerned. Sources: CP 11/26; EUR‑Lex C‑97/23 P. EDPB Binding Decision 1/2021: EDPB, Binding Decision 1/2021.

Legal reasoning

• The GDPR’s cooperation (Art. 60) and consistency (Arts. 63‑65) mechanisms grant the EDPB dispute‑resolution powers: when authorities disagree, the EDPB adopts a binding decision (Art. 65) on the disputed points, including fines. Refs: GDPR on EUR‑Lex; CNPD summary: CNPD – Chapter VII.
• The CJEU clarifies that an EDPB binding decision is not a mere preparatory act: it binds the lead authority and produces external legal effects, hence it is challengeable under Article 263 TFEU. Sources: CP 11/26; EUR‑Lex C‑97/23 P.
• Procedural convergence: when a national decision is “preceded” by an EDPB opinion/decision, the GDPR requires its transmission to the national court seized (Art. 78(4) GDPR), strengthening coherence and judicial review at all levels. Ref: EUR‑Lex – Art. 78(4).

What changes in practice

• Luxembourg groups and establishments: part of the fine‑setting “machinery” (Art. 83 GDPR) can be set or revised by the EDPB under Art. 65. After 10/02/2026, that EDPB decision is challengeable before EU courts in parallel with challenges to the national final decision. Sources: CP 11/26; CNPD – Cooperation & Consistency. For scoping, review the GDPR articles 63 and 65.
• Possible acceleration and tougher stance: in WhatsApp, EDPB 1/2021 tightened requirements (compliance deadline shortened from six to three months), showing the Board can harden corrective measures. Refs: redacted final decision; EDPB 1/2021 PDF.
• National authorities (incl. CNPD): they remain bound by Article 65 EDPB decisions and highlight the mechanism’s scope (incl. Art. 66) on their pages: CNPD.
• Litigation strategy for executives/DPO/CISO: think “dual track” when the EDPB intervened: (1) national appeal against the authority’s decision (e.g., CNPD) and (2) autonomous annulment action against the EDPB decision. Target the GDPR and EDPB guidelines (fines). Consider strengthening your DPO mandate and planning for CNPD compliance in Luxembourg.

Frequent pitfalls

1. Overlooking the EDPB decision in risk analysis and defense: contesting only the national decision while the framework (qualification, gravity, range) is “locked in” by the EDPB. Ref: CJEU, CP 11/26.
2. Underestimating inter‑authority disagreements: once a “relevant and reasoned objection” (Art. 65(1)(a) GDPR) is raised, the EDPB can impose a stricter calculation basis. Refs: GDPR Art. 65; EDPB 1/2021.
3. Ignoring deadline coherence: the EDPB may shorten compliance deadlines; plan a “D‑Day to D+90” remediation with evidence. Example: reference to shortened deadline.
4. Fragmented proportionality evidence (Art. 83 GDPR): centrally document criteria (nature, gravity, duration, intent/negligence, mitigation, history, cooperation, etc.). Base: GDPR.
5. Missing appeals interplay: the national court must receive the prior EDPB opinion/decision (Art. 78(4) GDPR). Refs: EUR‑Lex – Art. 78(4); CNPD.

Official sources

• CJEU, Press release No 11/26 (10 Feb 2026) – C‑97/23 P WhatsApp Ireland v EDPB: curia.europa.eu
• EUR‑Lex, Case C‑97/23 P – Judgment of 10/02/2026: eur-lex.europa.eu
• EDPB, Binding Decision 1/2021 (WhatsApp – Art. 65(1)(a) GDPR): edpb.europa.eu and PDF: edpb.europa.eu
• EDPB – related public file (shortened deadline): edpb.europa.eu
• GDPR (consolidated): Arts. 63, 65; Art. 78(4): eur-lex.europa.eu; EUR‑Lex – Art. 78(4)
• CNPD Luxembourg – Chapter VII “Cooperation and consistency”: cnpd.public.lu

Note for Luxembourg executives: the CNPD participates in the consistency mechanism (Arts. 63‑65) and complies with EDPB binding decisions. After 10/02/2026, factor in direct judicial review of EDPB decisions, especially where they affect breach qualification and fine methodology. For support, contact our team.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.