EDPBI:LU:OSS:D:2025:3423

View all Final One Stop Shop Decisions

23 April 2025

LSA

CSA

DE/BLM

Main legal reference

Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject)

Article 15 (Right of access by the data subject)

Article 32 (Security of processing)

Keywords

Consumer protection

Personal data breach

E-Commerce

Outcome

No sanction

SA LU Decision 861.5KB

Download

One-Stop-Shop case digest on the legal basis of "legitimate interest"

26 March 2026

Support Pool of Experts projects

Since the entry into force of the GDPR, Data Protection Authorities (DPAs) have closely cooperated to adopt a growing number of one-stop-shop (OSS) decisions on the legal basis of "legitimate interest", as shown by the decisions on this matter available in the EDPB register.

The OSS decisions assess and present a wide range of factual contexts. This case digest provides useful examples of how DPAs analyse controllers’ reliance on the legal basis of “legitimate interest” in specific contexts, providing positive and negative compliance examples. The external expert who authored the digest explains and summarises how DPAs apply the three-step test to assess whether a controller can lawfully rely onlegitimate interests as a legal basis.. The case digest also takes into account the EDPB Guidelines 1/2024 on Processing of Personal Data Based on Article 6(1)(f) GDPR and illustrates how parts of these Guidelines apply in practice . Relevant cases before the Court of Justice of the EU are also mentioned. In addition, several DPA’s decisions and national court judgments are presented as examples of specific issues.

The EDPB commissioned the one-stop-shop case digest as part of the Support Pool of Experts programme, which aims to support cooperation among DPAs by providing expertise and tools related to enforcement.

Project conducted by external expert Dr. TJ McIntyre and completed in December 2025.

Objective

Thematic one-stop-shop case digests are drafted on the basis of one-stop-shop decisions taken from the EDPB’s public register (based on Art. 60 GDPR). Such case digests complement the EDPB's public register by selecting and presenting the most important decisions on a given theme and providing an overview and aggregated results of relevant decisions on this theme.

EDPB-EDPS Joint Opinion 4/2026 on the Proposal for a Cybersecurity Act 2 and the Proposal on amendments to the NIS 2 Directive

19 March 2026

EDPB/EDPS Joint Opinion

EDPB-EDPS Joint Opinion 3/2026 on the Proposal for a European Biotech Act

12 March 2026

EDPB/EDPS Joint Opinion

EDPB letter to the European Commission on the privacy implications of recent proposed legislative changes regarding entry conditions to the United States for EEA citizens

12 March 2026

Letters

Opinion 7/2026 on the draft decision of the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the BCD Travel Group

10 March 2026

Opinion of the Board (Art. 64)