laying down implementing rules concerning the application of Regulation (EU) 2018/1725 of the European Parliament and of the Council and the restriction of data subjects’ rights for the purpose of restrictive measures

| Official Journal of the European Union | EN C series ---|---|--- * * * | C/2026/866 | 9.2.2026 ---|---|--- DECISION NO 2/2026 OF THE SECRETARY-GENERAL OF THE COUNCIL OF THE EUROPEAN UNION of 30 January 2026 laying down implementing rules concerning the application of Regulation (EU) 2018/1725 of the European Parliament and of the Council and the restriction of data subjects’ rights for the purpose of restrictive measures (C/2026/866) THE SECRETARY-GENERAL OF THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty of the Functioning of the European Union, and in particular Article 235(4) and Article 240(2) thereof, Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (1) and in particular Article 25 thereof, Having regard to the opinion of the European Data Protection Supervisor (EDPS) of 13 June 2025, consulted in accordance with Article 41(2) of Regulation (EU) 2018/1725, Whereas: (1) | Regulation (EU) 2018/1725 sets out the principles and rules applicable to the processing of personal data by all Union institutions and bodies as well as the rights of data subjects. ---|--- (2) | In certain cases, the General Secretariat of the Council (GSC) may be required to reconcile the rights of data subjects set out in Regulation (EU) 2018/1725 with the objectives of restrictive measures. It might also be required to balance a data subject’s rights against the fundamental rights and freedoms of other data subjects. To that end, Article 25(1) of Regulation (EU) 2018/1725 provides each Union institution or body with the possibility to restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of that Regulation. Unless restrictions are provided for in a legal act adopted on the basis of the Treaties, it is necessary to adopt internal rules under which the GSC is entitled to restrict those rights. ---|--- (3) | The Council may adopt restrictive measures against natural or legal persons or groups or non-State entities within the framework of the common foreign and security policy (CFSP). The legal acts establishing restrictive measures are proposed by the High Representative as regards the CFSP decision, based on Article 29 of the Treaty on European Union (TEU). The restrictive measures may include embargoes on the export of arms and of equipment used for internal repression, prohibitions on the entry of designated individuals into the Union, asset freezes against designated persons and entities, as well as other general economic measures such as restrictions on imports or exports of certain goods or services, prohibitions on the provision of financial or other services, and restrictions on access to capital markets. In addition, a joint proposal is made by the High Representative and the Commission for a regulation, based on Article 215 of the Treaty of the Functioning of the European Union (TFEU), if the restrictive measures consist of economic or financial restrictions which need to be implemented directly by economic operators in the Union. ---|--- (4) | Council Common Position 2001/931/CFSP (2) and Council Regulation (EC)No 2580/2001 (3) lay down the criteria for listing persons, groups and entities involved in terrorist acts which are to be subject to restrictive measures. Common Position 2001/931/CFSP and Regulation (EC)No 2580/2001 also identify actions that constitute terrorist acts for this purpose and define the restrictive measures to be applied. Those measures relate to the freezing of funds and economic resources as well as measures related to police and judicial cooperation. ---|--- (5) | Council Decision (CFSP) 2016/1693 (4) and Council Regulations (EC)No 881/2002 (5) and (EU) 2016/1686 (6) lay down the Union legal framework for imposing travel restrictions on individuals, and an arms embargo and an asset freeze against individuals and entities, that have been designated by the United Nations Security Council as being associated with ISIL (Da’esh) / Al-Qaida. ---|--- (6) | When preparing and reviewing restrictive measures, the relevant services of the GSC process different types of personal data, including names (including aliases) and (if known), date and place of birth, nationality, passport and ID card numbers, gender, address, function or profession, professional background, education, business interests, family composition, financial data, national administrative decisions, criminal convictions and indictments. The name, professional address, passport and professional coordinates of the person’s lawyer(s) necessary for correspondence may also be processed. Where relevant, information on membership of terrorist organisations is also processed. The relevant services ensure that the personal data they process are adequate, relevant, and not excessive in relation to the purposes of the preparation of the restrictive measure. The persons concerned by a restrictive measure should be notified either by means of a personal communication if their addresses are known or by means of a notice published in the Official Journal of the European Union. They should also be informed of the type of data that are being or will be processed, how they will be processed and what their rights are in that respect. ---|--- (7) | When preparing and reviewing decisions designating natural and legal persons, all personal data are shared with Member States, the European Commission and the European External Action Service (EEAS). In the context of court proceedings, elements of personal data might also be relied upon by the Council in the proceedings. ---|--- (8) | All restrictive measures regimes are subject to a regular review with regard to the stated objectives and effectiveness of the measures, and in the light of updated information and observations received. The review process may involve an exchange of correspondence between the Council and listed persons or entities, or their lawyers, in which personal data may be processed (including pre-notification of a draft statement of reasons, updated information, observations and de-listing requests, and requests for public or privileged access to the file). ---|--- (9) | During the preparation and review of restrictive measures, personal data may also be processed for communication with international or regional organisations and third countries on a strict need to know basis, for important reasons of public interest and for the establishment, exercise or defence of legal claims. ---|--- (10) | Where there is a serious risk that applying Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725 would be prejudicial to the effectiveness of restrictive measures, it may be necessary to restrict the application of those articles. In such cases, there is a need to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 and the necessity for the Council to ensure the effectiveness of the restrictive measure. Any restriction to the right of data subjects under a restrictive measure should only be applied in limited circumstances and be handled in a transparent and proportionate manner in terms of scope and duration. ---|--- (11) | It may be necessary to protect the anonymity of a source. In that case, the right of access to the identity, testimonies and other personal data of such persons may be restricted within the limits of the rights of defence. ---|--- (12) | The GSC should apply restrictions to the rights of data subjects only when those restrictions respect the essence of fundamental rights and freedoms, are strictly necessary and are a proportionate measure in a democratic society. The GSC should give reasons justifying those restrictions. ---|--- (13) | In accordance with the principle of accountability, the relevant service of the GSC should record and register the application of any restrictions. ---|--- (14) | Article 25(6) of Regulation (EU) 2018/1725 obliges the controller to inform data subjects of the principal reasons for which the application of a restriction is based and of their right to lodge a complaint with the EDPS. ---|--- (15) | Pursuant to Article 25(8) of Regulation (EU) 2018/1725, the GSC is entitled to defer, omit or deny the provision of information on the reasons for the application of a restriction to the data subject if this would in any way cancel the effect of the restriction. The GSC should assess on a case-by-case basis whether the communication of the restriction would cancel its effect. ---|--- (16) | Restrictions should be lifted as soon as the conditions that justify them no longer apply or where maintaining them would impinge on the rights of defence. The need for restrictive measures should be assessed regularly. ---|--- (17) | The Data Protection Officer (DPO) should be consulted in due time and be informed of any restrictions to be applied and should have the possibility to comment on their compliance with this Decision, ---|--- HAS DECIDED AS FOLLOWS: Article 1 Scope 1\. This Decision lays down rules relating to the conditions under which the General Secretariat of the Council (GSC) may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of that Regulation, in accordance with Article 25 thereof. 2\. For the purposes of this Decision, the GSC shall be considered to be the controller within the meaning of Article 3(8) of Regulation (EU) 2018/1725. The GSC is represented by its Secretary-General. Article 2 Restrictions 1\. The GSC may restrict the application of Articles 14 to 21, 35 and 36 of Regulation (EU) 2018/1725, as well as Article 4 of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 21 of Regulation (EU) 2018/1725 under any of the following circumstances: (a) | pursuant to Article 25(1), points (a) to (d) and points (g) and (h), of Regulation (EU) 2018/1725, when the Council prepares, adopts and reviews restrictive measures provided for in legal acts based on Article 29 of the Treaty on European Union (TEU) and Article 215 of the Treaty of the Functioning of the European Union (TFEU); as well as under Common Position 2001/931/CFSP, Regulation (EC)No 2580/2001, Decision (CFSP) 2016/1693 and Regulations (EC)No 881/2002 and (EU) 2016/1686; ---|--- (b) | pursuant to Article 25(1), points (a) to (d) and points (g) and (h), of Regulation (EU) 2018/1725, when ensuring the possibility for third parties to report confidentially about facts which give rise to the preparation and review of restrictive measures provided for in legal acts based on Article 29 TEU and Article 215 TFEU; as well as under Common Position 2001/931/CFSP, Regulation (EC)No 2580/2001, Decision (CFSP) 2016/1693 and Regulations (EC)No 881/2002 and (EU) 2016/1686; ---|--- (c) | pursuant to Article 25(1), points (a) to (d) and points (g) and (h), of Regulation (EU) 2018/1725, when providing or receiving assistance to or from other Union institutions, bodies, offices or agencies or cooperating with them pursuant to relevant service level agreements, memoranda of understanding and cooperation agreements; ---|--- (d) | pursuant to Article 25(1), points (a) to (d) and points (g) and (h), of Regulation (EU) 2018/1725, when providing or receiving assistance and cooperation to and from Member States’ public authorities, either at their request or on its own initiative; ---|--- (e) | pursuant to Article 25(1), points (a) to (d) and points (g) and (h), of Regulation (EU) 2018/1725, when providing or receiving assistance to or from third countries’ national authorities and international or regional organisations or cooperating with such authorities and organisations, either at their request or on its own initiative; or ---|--- (f) | pursuant to Article 25(1), points (e) and (h), of Regulation (EU) 2018/1725, when processing personal data in the context of administrative, judicial, or other proceedings. ---|--- Article 3 Application of restrictions 1\. Any restriction of the rights and obligations referred to in Article 2 shall be necessary and proportionate, taking into account the risks to the rights and freedoms of data subjects. 2\. Before applying one of the restrictions set out in Article 2, the relevant GSC service shall carry out a necessity and proportionality test. Restrictions shall be limited to what is strictly necessary to achieve their objective. 3\. The relevant GSC service shall record the reasons for any restriction applied pursuant to this Decision, including the test provided for in paragraph 2 of this Article and the grounds under Article 25(1) of Regulation (EU) 2018/1725. The record and, where applicable, the documents containing underlying factual and legal elements shall be part of a register kept by the relevant GSC service. They shall be made available to the European Data Protection Supervisor (EDPS) on request. Article 4 Duration and safeguards 1\. Restrictions referred to in Article 2 shall continue to apply as long as the reasons justifying them remain applicable. 2\. The relevant GSC service shall review the application of restrictions referred to in Article 2 at least every 12 months, or sooner if the reasons that justify them no longer apply.. 3\. Restrictions shall be lifted as soon as the reasons that justify them no longer apply. 4\. Where the reasons for a restriction referred to in Article 2 no longer apply, the GSC shall lift the restriction and provide the reasons for the restriction to the data subject. At the same time, the GSC shall inform the data subject of the possibility of lodging a complaint with the EDPS. 5\. The GSC shall implement safeguards to prevent abuse or unlawful access or transfer of personal data that may be subject to restrictions. These safeguards shall include technical and organisational measures and be detailed, as necessary, in GSC internal decisions, procedures and implementing rules. The safeguards shall include: (a) | an adequate definition of roles, responsibilities and procedural steps; ---|--- (b) | where applicable, a secure electronic environment which prevents unlawful or accidental access or transfer of electronic data to unauthorised persons; ---|--- (c) | where applicable, secure storage and processing of paper-based documents; and ---|--- (d) | due monitoring of restrictions and periodic review of their application. ---|--- Article 5 Involvement of the Data Protection Officer 1\. Where the relevant GSC service concludes that a data subject’s rights should be restricted pursuant to this Decision, it shall inform the Data Protection Officer (DPO). It shall also provide the DPO with access to the record and any documents containing underlying factual and legal elements. The relevant GSC service shall record the involvement of the DPO in the application of restrictions including in the assessment of the necessity and proportionality of the restriction. 2\. The DPO may request that the relevant GSC service reviews the application of the restrictions. The service concerned shall inform the DPO in writing about the outcome of the requested review. Article 6 Information to data subjects 1\. The GSC shall include a section in the privacy statement and records of processing activities published in the register of processing operations kept by the DPO providing general information to data subjects on the potential for restriction of data subjects’ rights pursuant to Article 2(1). The information shall cover which rights may be restricted, the grounds on which restrictions may be applied and their potential duration. 2\. The relevant services shall inform data subjects, in appropriate format, of ongoing or future restrictions of their rights. They shall inform the data subject of the principal reasons on which the application of the restriction is based, of their right to consult the DPO and of their right to lodge a complaint with the EDPS. 3\. The relevant services may defer, omit or deny the provision of information to data subjects referred to in paragraph 2 of this Article, for as long as it would cancel the effect of the restriction. Assessment of whether this would be justified shall take place on a case-by-case basis. As soon as it would no longer cancel the effect of the restriction, the information shall be provided to the data subject. 4\. Where the relevant GSC service restricts, wholly or partly, the provision of information to data subjects referred to in paragraph 2 of this Article, the GSC shall record and register the reasons for the restriction, in accordance with Article 3. Article 7 Communication of a personal data breach to the data subject 1\. Where the GSC is under an obligation to communicate a data breach under Article 35(1) of Regulation (EU) 2018/1725, it may, in exceptional circumstances, restrict such communication wholly or partly. It shall document this decision as provided under Article 3(3) of this Decision. 2\. Where the reasons for the restriction no longer apply, the GSC shall communicate the personal data breach to the data subject concerned and inform him or her of the principal reasons for the restriction and of his or her right to lodge a complaint with the EDPS. Article 8 Confidentiality of electronic communication 1\. In exceptional circumstances, the GSC may restrict the right to confidentiality of electronic communications under Article 36 of Regulation (EU) 2018/1725. 2\. Where the GSC restricts the right to confidentiality of electronic communications, it shall inform the data subject concerned, in its reply to any request from the data subject, of the principal reasons for which the application of the restriction is based and of his or her right to lodge a complaint with the EDPS. 3\. The GSC may defer, omit or deny the provision of information concerning the reasons for a restriction and the right to lodge a complaint with the EDPS for as long as it would undermine the effect of the restriction. Assessment of whether this would be justified shall take place on a case-by-case basis. Article 9 Risks to the rights and freedoms of data subjects 1\. Any restriction shall respect the essence of fundamental rights and freedoms and be necessary and proportionate in a democratic society. 2\. Whenever the relevant GSC service tasked with the preparation or review of restrictive measures assesses the necessity and proportionality of a restriction, it shall consider the potential risks to the rights and freedoms of the data subject. 3\. No restriction may have the effect of preventing persons concerned by restrictive measures to exercise their rights of defence, and in particular their right to be heard in the context of the review of the restrictive measures. Article 10 Entry into force This Decision shall enter into force on the day following that of its publication in the Official Journal of the European Union. Done at Brussels, 30 January 2026. The Secretary-General Thérèse BLANCHET * * * (1) OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj. (2) Council Common Position of 27 December 2001 on the application of specific measures to combat terrorism (OJ L 344, 28.12.2001, p. 93, ELI: http://data.europa.eu/eli/compos/2001/931/oj). (3) Council Regulation (EC) No 2580/2001 of 27 December 2001 on specific restrictive measures directed against certain persons and entities with a view to combating terrorism (OJ L 344, 28.12.2001, p. 70, ELI: http://data.europa.eu/eli/reg/2001/2580/oj). (4) Council Decision (CFSP) 2016/1693 of 20 September 2016 concerning restrictive measures against ISIL (Da’esh) and Al-Qaeda and persons, groups, undertakings and entities associated with them and repealing Common Position 2002/402/CFSP (OJ L 255, 21.9.2016, p. 25, ELI: http://data.europa.eu/eli/dec/2016/1693/oj). (5) Council Regulation (EC) No 881/2002 of 27 May 2002 imposing certain specific restrictive measures directed against certain persons and entities associated with the ISIL (Da’esh) and Al-Qaida organisations (OJ L 139, 29.5.2002, p. 9, ELI: http://data.europa.eu/eli/reg/2002/881/oj). (6) Council Regulation (EU) 2016/1686 of 20 September 2016 imposing additional restrictive measures directed against ISIL (Da’esh) and Al-Qaeda and natural and legal persons, entities or bodies associated with them (OJ L 255, 21.9.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/1686/oj). * * * ELI: http://data.europa.eu/eli/C/2026/866/oj ISSN 1977-091X (electronic edition) * * *