EBA Publishes Record of Processing Activity for Staff Data Shared with Member States

Key Takeaways

• The European Banking Authority has published an updated Article 31 record under the EU Data Protection Regulation (EUDPR), detailing how it processes and shares staff nationality data with EU Member State authorities for geographical balance reporting.
• While primarily an internal HR governance document, it serves as a model for data privacy documentation practices that compliance teams at regulated entities should note, particularly regarding transparency and data subject notification obligations.

Deep Dive

This update is a Record of Processing Activity (ROPA) published by the EBA under Article 31 of Regulation (EU) 2018/1725 (EUDPR), documenting an internal HR process whereby the EBA reports nationality representation data of its temporary/contract agents and Seconded National Experts (SNEs) to EU Member State authorities upon ad hoc request. This is not a binding regulatory requirement imposed on financial institutions, but rather a transparency disclosure reflecting the EBA's own compliance with EU data protection law.

The key elements of this record include a clearly defined legal basis (Protocol No. 7 on Privileges and Immunities), a limited and proportionate data set (identification, contact, and profession data only — no special category data), a defined recipient group (Permanent Representations, Embassies, Ministries), and a commitment to notify affected staff before or after any data sharing event. The EBA also confirms data remains within the EU/EEA, with no third-country transfers, and is protected under its Information Security Framework with need-to-know access controls.

From a timeline perspective, the record was last updated on August 26, 2026, with the next scheduled review on August 26, 2028 — a two-year review cycle. There are no externally facing deadlines or action items required of financial institutions or third parties, as this record pertains solely to the EBA's internal operations.

For compliance professionals, the primary value of this document is as a benchmark example of best-practice ROPA documentation under EUDPR/GDPR-aligned frameworks. Compliance and privacy teams, especially those within EU-regulated entities or firms interacting with EU bodies, may use this as a reference for structuring their own records of processing activities, particularly regarding data minimization, retention justification, and data subject notification practices. There are no direct regulatory obligations, fines, or supervisory expectations imposed on third parties by this publication; however, it reinforces the EBA's ongoing commitment to EUDPR compliance and may signal increased scrutiny of data governance practices across the broader regulatory ecosystem.

Risk implications are minimal and largely reputational/procedural rather than financial or enforcement-related, given this concerns the EBA's internal HR operations rather than supervised entities.

Source: European Banking Authority