News, events, publications

DETAILS OF REGISTER

EDA-DPO-088 - Ethics Requests & Declarations

Records and compliance checklist

Under Article 31 of the new Regulation, EUIs have to keep records of their processing operations. This template covers two aspects:

1.Mandatory records under Article 31 of the new rules (recommendation: publicly available)
2.Compliance check and risk screening (internal).

The header and part 1 should be publicly available; part 2 is internal to the EUI. By way of example, column 3 contains a hypothetical record on badges and physical access control in a EUI.
Nr Item Explanation
Header - versioning and reference numbers (recommendation: publicly available)
1. Last update of this record 11-02-2026
2. Reference number EDA-DPO-088
part 1 - article 31 record (recommendation: publicly available)
3. Name and contact details of controller
European Defence Agency

Rue des Drapiers 17-23
B-1050 Brussels
Belgium
4. Name and contact details of DPO

Data Protection Officer

[email protected]
5. Name and contact details of joint controller (where applicable)
N/A
6. Name and contact details of processor (where applicable)
N/A
7. Purpose of the processing

The purpose of this processing activity is to examine the requests for authorisation and declarations relevant to ethical obligations of active EDA personnel and of former EDA staff members, to ensure that these are compatible with the interests of the Agency and the statutory obligations provided in Chapter 2 of EDA Staff Regulations (Council Decision (EU) 2016/1351) and in Article 8 of EDA SNE Rules (Council Decision (EU) 2016/1352). Following this assessment, a request may be authorised, authorised with restrictions, or refused.

(a)   Requests for authorisation to engage in an occupational activity after leaving EDA

(b)   Requests for authorisation for publications and speeches

(c)   Requests for authorisation to engage in an outside activity

(d)   Declarations of spouse employment

(e)   Requests for authorisation to receive gifts and hospitality
8. Description of categories of persons whose data EDA processes and list of data categories

(1)   Categories of data subjects

  • Active EDA personnel,
  • Former staff members,
  • Spouses of staff members for activity (d)

(2)  List of data categories:

 For all activities:

For EDA personnel: Name, surname, contact details, position, job description, contract duration, EDA personnel number, supporting documents (optional), assessment of the Ethics officer, opinion of reporting line managers, decision of the AACC.

 For activity (a):

·         For EDA staff members: future job title, position, duties, duration, type of activity and future employer.

For activity (b):

·         Scope and summary of the publication/speech, location or means of publication, dates, fee or remuneration received, financial arrangements.

For activity (c):

·         Type of activity, scope and description of the activity, location, company or organisation, dates and duration, overlap with working days and hours, financial arrangements.

For activity (d):

·         Name and surname of spouse, organisation or company, position and job description.

For activity (e):

·         Types of gifts and hospitality, value, and originator. 
9. Time limit for keeping the data

Decisions on requests for authorisation and documents relevant to declarations are stored in staff member’s personal file, in accordance with Art. 33 and Art. 104 of the EDA Staff Regulations, for a period of 5 years after the jobholder has terminated employment at the Agency. The same filing practice and retention is applied for recruited SNEs and trainees.
10. Recipients of the data
  • Human Resources Unit
  • EDA personnel’s reporting line managers (Head of Unit, Director, DCE and CE)
  • EDA Ethics Officer and EDA Legal Unit on a need-to-know basis.
11. Are there any transfers of personal data to third countries or international organisations? If so, to which ones and with which safeguards?
N/A
12. General description of security measures, where possible.
EDA has implemented appropriate technical and organisational measures (firewalls, checkpoints, antivirus) to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected. Such measures have been taken to prevent any unauthorised disclosure or access, accidental or unlawful destruction, accidental loss or alteration, and to prevent all others unlawful forms of processing.
13. For more information, including how to exercise your rights to access, rectification, object and data portability (where applicable), see the privacy statement
Additional information is available by following the link to privacy statement here.