The Support Pool of Experts (SPE) was developed as part of the EDPB 2021-2023 Strategy to help Data Protection authorities (DPAs) increase their capacity to enforce by developing common tools and giving them access to a wide pool of experts.
The EDPB aims to carry out approximately 10 projects per year with pre-eminent external experts in a given field.
Projects are coordinated either by individual DPAs or by the EDPB.
How does the Support Pool of Experts work?
A Call for Expression of Interest was launched in February 2022 to gather candidates with Legal expertise in new technologies and/or Technical expertise in new technologies and information security. Each of the two fields is divided into sub-fields of expertise, covering the topics for which the EDPB may call upon external expertise.
The technical ones are:
- Anonymisation and pseudonymisation techniques, Risk analysis and attacks with respect to data re-identification (including inference attacks), Privacy enhancing technologies
- Artificial intelligence
- Behavioural advertising, digital tracking, cookies, fingerprinting, RTB and internet advertising (programmatic advertising, ad exchanges, demand side platforms, SSP, data brokers, consent management platforms), ePrivacy
- Cloud computing architectures, cloud computing models, cloud infrastructures, cloud services, cloud trust and security
- Cryptology, (a)symmetric cryptography, Hash functions, digital signature, message authentication, Cryptanalysis methodologies, techniques and tools, Crypto material management Key management, PKI, Homomorphic encryption, Mathematical foundations of cryptography
- DPIA, personal data breaches, risk management
- Data science or statistical analysis in this field
- Digital forensics, Eavesdropping techniques, MITM proxy
- Digital identity management and Trust Services (including security of electronic identification schemes, authentication, digital signatures), eIDAS, zero trust, identity federation, Age verification, Biometrics including facial recognition
- Experience in conducting exercises / training in the above
- Fintech
- IT auditing, information security auditing
- UX, web design and dark patterns
- Website security, Mobile OS, internet of things, mobile applications
The legal ones are:
- Digital ethics
- Digital laws, EU legal framework on data protection and privacy, legislation on forensics
- Policy monitoring
- Statistical analysis in this field of activity
A selection committee meets every 3 months to update the reserve list with all the names of new applicants who meet the eligibility and selection criteria. This stage allows the EDPB to have access to a broad variety of profiles. There is no maximum number of experts on the list and being on the reserve list does not imply a commitment on behalf of the EDPB to launch a project with listed experts. In the 20 months since the launch of the SPE programme, 704 applications were processed, of which 504 experts were included on the reserve list:
- 26% with technical expertise;
- 70% with a legal expertise; and
- 4% with both technical and legal expertise.
An expert listed becomes an expert working on a specific project for the EDPB or a national DPA only from the moment they are selected for a project.
How to apply for the Support Pool of Expert?
Send us your expression of interest and join the EDPB Support Pool of Experts.
Learn how to submit your application
On 22 September 2023 the validity period of the list as been extended by the Corrigendum 2023/S 183-570468.
- Expiry date of the list resulting from the call for expressions of interest: 10 February 2026
- Time-limit for the submission of applications: 10 November 2025
Save the “contribution ID”
At the end of your application, the system will generate a personal “contribution ID”. Please take note of your “contribution ID” or save a pdf of your application, it will be required to update your profile, including for candidates accepted on the reserve list.
How to update an application?
You can access and update the application by using the corresponding “contribution ID” at the following link: https://ec.europa.eu/eusurvey/home/editcontribution
The "contribution ID” is displayed when you end and submit your application. If you have decided to “print” or “get pdf” on this screen, you can find it on the upper left side of the pdf document.
If you want to update your email address, please contact the EDPB by email at; edpb@edpb.europa.eu (add the tag [SPE] in the subject) to ensure that your contact is appropriately updated in all our databases.
Can I share that I have been accepted to the list of Support Pool of Expert experts?
Yes, if you are an expert in the Support Pool of Expert reserve list, you can communicate it on your professional profiles online or CV, as long as you clearly specify that you are not an EDPB employee and that you have not been offered a contract (unless it is the case).
Example of message: “I have been selected by the EDPB for the Support Pool of Experts reserve list and I might be assigned a project in the future.”
If you want to accurately describe what an SPE expert in the reserve list is, you can include the link to the EDPB Support Pool of Experts (SPE) Programme page.
How are experts selected for a project?
In practice, when a project is planned, the EDPB drafts Terms of Reference to describe the specific work to be done, the requirements to be taken into account (especially regarding languages) and the deliverables to be prepared. This proposal is commented by the DPAs participating in the SPE initiative and validated by a panel including the Chair and Deputy Chairs.
Based on the Terms of Reference, the most qualified experts are selected (in full respect of the principles of non-discrimination, equal treatment and absence of conflict of interest). They are selected per project according to "8.1.2 Criteria for the selection of individual experts" and " 8.4.3 Convocation" of the Experts. Starting with the most qualified, selected experts are contacted to enquire about their availability and willingness to participate in the project. If all parties agree then a contract is signed, if not the next most qualified expert is contacted.
Which Support Pool of Experts projects have been completed or are ongoing?
13 projects have been launched since July 2022. 8 projects have been completed, 2 are in the finalisation phase and 3 have recently started.
In total, 13 experts assisted the EDPB on projects initiated by either a DPA or the EDPB. All projects, except one dedicated to help an individual DPA, involved several authorities. For these projects, interested authorities are invited to participate and all final documents are made available to all of them at the latest upon completion of the project.
Experts have been selected based on the following subfields:
- 1 expert on: “Website security, Mobile OS, internet of things, mobile applications“
- 5 experts on: “Digital laws, EU legal framework on data protection and privacy, legislation on forensics”
- 2 experts on: “Artificial intelligence”
- 2 experts on: “ IT auditing, information security auditing”
- 2 experts on: “DPIA, personal data breaches, risk management”
- 1 expert on: “Digital forensics, Eavesdropping techniques, MITM proxy”
As the Support Pool of Experts relates to enforcement activities, it is not possible to disclose information about all the projects. However, when the project is of a more general nature and its outcome can be disclosed, it is made public.
For the moment, two reports relating to analysis of published DPA’s decisions have been published:
- One-Stop-Shop thematic case digest - right to object and right to erasure' by Ass. Prof. Dr. Alessandro MANTELERO.
- One-Stop-Shop thematic case digest - Security of Processing and Data Breach Notification by Prof. Dr. Eleni KOSTA.
These projects mainly aim to help the public, businesses and DPOs to have an overview of decisions relating to a given subject (and specific articles of GDPR).
The EDPB launches website auditing tool in January 2024.The software allows the preparation, completion and evaluation of website audits directly in the tool.
The EDPB website auditing tool is a Free and Open Source Software under the EUPL 1.2 Licence. You can download the source code and software on code.europa.eu
The Croatian Data Protection Authority has performed an SPE project in order to build a “Data Protection Training Programme for Croatian DPOs in the health and education sectors”. You can learn more about this project on the AZOP website
What else is in the pipeline?
In June 2023, DPA enforcement experts were invited to meet in Brussels for the first EDPB bootcamp, on the topic of website inspections. It was an occasion to use and discuss the new EPDB website auditing tool developed in the framework of the Support Pool of Experts. A new bootcamp will be organised in 2024.
In addition, an online event for the experts included on the SPE reserve list will take place in February 2024. Finally, a survey will be carried out to collect feedback, allowing the EDPB to better prepare for the future SPE projects.