Data protection
Introduction
Data protection is a fundamental right, protected not only by national legislation, but also by European Union law. At FRA, we are responsible for the personal data that we collect and process.
The processing of an individual’s personal data carried out by the European Agency for Fundamental Rights (FRA) is performed in compliance with Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC.
What types of personal data do we collect?
The personal data that the Agency collects and processes relates to you as a natural person. The personal data collected can be classified into two types.
Mandatory personal data: This refers to the personal data necessary for the performance of the tasks carried out in the public interest that were conferred on the Agency or for compliance with a legal obligation to which the Agency is subject to. Some examples include your name, address, your CV when applying for a job or traineeship at the Agency, or when submitting a tender linked to a published procurement procedure.
Non-mandatory personal data: This refers to personal data processed based on consent only. Examples include your dietary and mobility requirements when attending an event organised by the Agency, your phone number, fax number or email address when you choose to make them publicly available. Additionally, your information might be processed when you choose to participate in the surveys undertaken by the Agency.
Access to these data will be restricted to authorised staff of the Agency, and we will request your consent to make them available to the general public.
Purpose of the processing
Whenever personal data is processed, it is essential that the data subject (the person whose personal data are collected, held or processed) knows for which purposes the data is being collected. According to Article 4 Paragraph a) of the Regulation, personal data "must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes."
Moreover, personal data must be adequate, relevant, and not excessive in relation to the purpose and kept for no longer than is necessary for the purposes for which they were collected.
In this regard, the Agency informs you through a privacy notice linked to the specific processing operation. A number of those privacy notices are listed below.
What are the legal bases on which the Agency processes your personal data?
Primarily, we collect and process your personal data on the basis of Article 5.1(a), (b) and (d) of the EU Data Protection Regulation 2018/1725:
- To perform a task carried out in the public interest or in the exercise of official authority vested in the Agency (for example its Founding Regulation or the EU Staff Regulations)
- To comply with a legal obligation to which the Agency is subject
- Where the processing is based on consent.
In very specific circumstances, a different or additional legal basis mentioned in Article 5 of Regulation 2018/1725 may apply.
The processing of personal data by the Agency is governed not only by Regulation 2018/1725, but also by specific legal instruments, such as implementing rules and internal rules.
Information on the legal basis is provided to you in a privacy notice.
Who has access to your personal data?
The general public has access to data in relation to information that is considered to be of public interest. Indeed, the Agency has a legal obligation to make such data public. Such examples can include the names of its Management Board members.
Access to your personal data is limited to the Agency’s staff. The Agency will not make personal data available to the public, unless the party concerned has given his or her express statement of consent. The consequence being that certain personal data provided by you as an applicant or as representative of an organisation, for which publication is not a legal obligation (e.g. phone, fax number or email address), may only be accessible to the public if consent is given and provided that the Agency’s IT systems can support it.
How long do we keep your data?
For each processing operation there is a defined retention period that specifies the period for which the personal data is kept. Depending on the processing operation the retention period can vary. For example, in the case of surveys the retention period might be a few months where in the case of financial transactions it can be up to 10 years. The exact retention period is specified in the privacy notice of the processing operation.
What measures do we have to protect and safeguard your information?
The Agency takes the protection of your personal data very seriously, and therefore applies adequate organisational, technical and security measures to protect it. Some examples of these measures are:
- A username and password are required in order to access FRA’s IT systems;
- Authentication and authorisation for the IT systems are based on roles and anonymous access at server level is not permitted;
- The Agency’s datacenter is physically protected;
- Network security is configured to prevent external threats from accessing the Agency’s infrastructure;
- Confidentiality and data protection clauses are signed by service providers to ensure compliance with security rules and the data protection regulation.
What are your rights to manage your personal data?
As a data subject you have the right to access, rectify and, where processed on the basis of your consent, transfer your data to another controller at any time. You may also request the erasure of your data under certain conditions. Moreover, you also have the right to object to and restrict certain processing of your data.
We will review your requests and grant your rights provided that certain conditions are met. Please note that in some cases restrictions may apply under Article 25 of Regulation (EU) 2018/1725 and MB decision 2021/08 on internal rules concerning restrictions of certain rights of data subjects in relation to processing of personal data in the framework of the functioning of the European Union Agency for Fundamental Rights.
You also have the right to recourse to the European Data Protection Supervisor.
For more information please read the specific privacy notice that specifies in detail your data protection rights and how to exercise them.
How to contact us?
You can contact us for any aspect regarding your personal data, by sending a written request to the FRA as the data controller responsible for your information, or to the FRA Data Protection Officer as follows:
By post:
Luisa Lopez,
Data Protection Officer,
FRA,
Schwarzenbergplatz 11,
AT-1040 Vienna,
Austria.
By email:
dpo@fra.europa.eu
If you feel your request was not responded adequately by the data controller and/or the DPO, you can lodge a complaint with the European Data Protection Supervisor.
You can find all records of FRA processing activities on the Records registry page . A list of privacy notices available for download can be found below.
Privacy notices:
Privacy notice - Bodies of the Agency (MB, EB, SC)
DPR-2025-242 Data protection notice - FRA e-learning platform
Data protection notice - Meetings of the Survey Review Steering Committee
Data Protection Notice - Use of artificial intelligence in asylum and immigration procedures – interviews
Data Protection Notice - Regional meeting of the OECD Civic Space Network for Public Officials in cooperation with FRA 18-19.3
Data Protection Notice - 360 degree evaluation
Data protection notice - Charter experts' online meetings
Data Protection Notice - Call for expressions of interest for the EUAN Women’s Leadership Development Programme
Data Protection Notice - Promotion of FRA’s tools and materials on the EU Charter of Fundamental Rights
Data Protection Notice - Stakeholder consultation for an independent review and scenario development
Data Protection Notice - Online Launch FRA report FR in EU climate and energy transition in housing
Data Protection Notice - Consultation meeting on strengthening integrated child protection systems, 28-29 January 2026
Data Protection Notice - Insights into the Situation of Roma in Bulgaria from the FRA Roma Survey event, 8 December 2025
Data Protection Notice - Expert meeting on victims of online fraud
Data Protection Notice - Encryption fieldwork
Data Protection Notice - Annual General Meeting of the Fundamental Rights Platform, 18th and 19th November 2025
Data Protection Notice - Launch of the Brussels Liaison Office of the European Union Agency for Fundamental Rights
Data Protection Notice - Safeguarding Children and Young Adults online: Fieldwork research on illegal and otherwise harmful content online under the DSA
Data Protection Notice - Fundamental rights protection of persons with disabilities in institutions event 21-22 October 2025
Data Protection Notice - Expert meeting on encryption workarounds and fundamental rights
Data Protection Notice - Consultation meeting on the FRA report on Rule of Law & Fundamental Rights
Data Protection Notice - 35th FRA NLOs meeting
Data Protection Notice - CharterXChange on 8-9 December
Data Protection Notice - MB Meetings 17-19 September 2025
Data protection notice - Collecting data online on manifestations of hate
Data protection notice - UPDATE Usability testing of online tools and services
Data protection notice - Justice and Home Affairs Agencies Network (JHAAN) Staff Visits Programme under the European Union Agency for Fundamental Rights Presidency (2025)
Data protection notice - Events organised by FRA within its mandate of presiding the EU Justice and Home Affairs Agencies Network (JHAAN)
Data protection notice - Functioning of the FRA Pilot Youth Advisory Panel
Data protection notice - Expert meeting on EU accession to the ECHR
Data protection notice - FRA Symposium 04/2025
Data protection notice - DPR-2025-232 RBI Validation workshop
Consultation of stakeholders in the context of the specific contracts 21-3030-03/FWC4/FRA/nr12 Looking ahead: Interim assessment of the FRA Strategic Plan 2023-2028
Data protection notice - FRANET SR 46 Fundamental Rights in Corporate Sustainability and Due Diligence
Data protection notice - FRANET SR-45 Access to Justice for victims of online crime
Data protection notice – FRANET SR 47 Digitalisation of Justice
Data protection notice – FRANET SR 43 Law Enforcement Directive
Data protection notice – Performance management staff members
Data protection notice – EU Survey project
Data protection notice - The role of fundamental rights for the protection of the rule of law: relevant national case law and other examples
Data protection notice - Selection procedure for pilot Youth Advisory Panel
Data protection notice - Workshop and meeting on mainstreaming human rights into international organisations/institutions/donors’ programmes and projects, 29-30 January 2025, in Brussels, Belgium
Data protection notice - Use of LimeSurvey
Data protection notice - Assessment of Fundamental Rights in the Migration Preparedness and Crisis Blueprint
Data protection notice - FRA project on Assessing high-risk artificial intelligence: selected use-cases – additional interviews carried out by FRA
Data protection notice - Assessing high-risk artificial intelligence: selected use-cases
Data protection notice - Expert workshop on the role of National Human Rights Institutions in ensuring the fundamental rights compliance of EU funds, Vienna, Austria, 26-27 November 2024
Data protection notice - Probation and appraisal of the Director
Data protection notice - Human rights impact assessment and legal scrutiny of legislation in the EU
Data protection notice - Consultation of stakeholders in the context of specific contract 21-3030-03/ FWC 1 / FRA / 10 - Ex-Ante Evaluation FR in Corporate Sustainability and Due Diligence
Data protection notice - FRA Diplomatic Community Event, 27 November 2024
Data protection notice - 2nd Annual Online CharterXchange event
Data protection notice - Expert meeting on assessing high-risk AI
Data protection notice - Handling of Article 90(2) complaints by the Appeals Committee
Data protection notice - FRA’s Facilities Booking App
Data protection notice - Expert workshop on civic space monitoring and protection from 16 to 18 September 2024
Data protection notice - The informal procedure under EB Decision 2019/02 for dealing with psychological and sexual harassment
Data protection notice - Fieldwork of the project ‘The impact of addressing terrorist content online on fundamental rights’
Data protection notice - Fundamental and social rights in the green transition – interviews with experts
Data protection notice - Selection of confidential counsellors
Data protection notice - Digitalisation of justice: fundamental rights guidance
Privacy notice - Roma Survey 2024
Data protection notice - Project on remote biometric identification for law enforcement purposes
Data protection notice - Consultation of stakeholders in the context of specific contracts 21-3030-03/FWC1/FRA/08 Ex-ante, interim and ex-post evaluations of FRA projects and 21-3030-03/FWC1/FRA/09 FRF 2024 - Participant feedback survey
Data protection notice - Interviews and survey with authorities and other stakeholders at Border Crossing Points for FRA project on the fundamental rights implications of the Entry-Exit System
Data protection notice - Consultation of stakeholders in the context of the implementation of the framework contract 21-3030-03/FWC1/FRA – Provision of evaluation and feedback services
Data protection notice - Online survey of ENVR experts for FRA project on the fundamental rights protection of persons with disabilities living in institutions
Data protection notice - IT Service Management Ticketing System - JIRA
Data protection notice - Workshop and final conference under regional project on supporting NHRIs, 20-22 February 2024, Brussels, Belgium
Data protection notice - Interviews for project 'Fundamental rights protection of persons with disabilities living in institutions'
Data protection notice - Collection of information among Jewish communities on the situation after October 7th 2023
Data protection notice - Workshop on forced returns monitoring in Athens, Greece, on 22-23 January 2024
Data protection notice - Interviews with experts and authorities for FRA’s project on the fundamental rights implications of the Entry-Exit System
Data protection notice - Ex-post control on the compliance with EB decision 2022/03 “Application by analogy of the Commission Decision C(2022)1788 on working time and hybrid working”
Data protection notice - Consultation of stakeholders in the context of FRA’s Consolidated Annual Activity Report 2023
Data protection notice - Research on fundamental rights compliance at the EU's external land and sea borders
Data protection Notice-FRF 2024
Data Protection Notice for Consultation of stakeholders -evaluation services FW-2-FRA-06
Data Protection Notice for Data Subjects- Violence against Women-Ukraine
Data protection notice - Expert meeting on digitalisation and justice: fundamental rights guidance 28-11-2023
Data protection notice - Setting up an online platform in the framework of the regional project Supporting National Human Rights Institutions in monitoring fundamental rights and the fundamental rights aspects of the rule of law
Data protection notice - Expert meeting on fundamental rights and environmental protection in hybrid format on 16-11-2023
Data protection notice - Foresight workshop on fundamental rights and environmental protection in person on 17-11-2023
Data protection notice - Consultation, cooperation and meetings with Member States National Liaison Officers (NLOs) including the organisation of FRA-NLO Meetings
Data protection notice - Event “International Conference on Anti-Racism in the European Union” on 2-3 November 2023
Data protection notice - Event “CharterXChange" on 11-13 December 2023
Data Protection Notice - Expenditure operations
Data Protection Notice for Data Subjects - Training app
Data protection notice – Handling of requests and complaints submitted under Article 90 of the Staff Regulations
Data Protection Notice - Medical advisor booking app
Data Protection Notice - Recovery of debts
Data Protection Notice - HAN
Data Protection Notice - Survey on women’s life and wellbeing
Data protection notice - LGBTIQ Survey III
Data Protection Notice - FRA survey on organisations providing support to people fleeing Ukraine
Data Protection Notice - Event ‘High-level Conference on Institutional protection of fundamental rights in times of crises'
Data Protection Notice - Use of Meetergo
Data Protection Notice - 3rd version - Data subjects AS3 website survey
Data Protection Notice - Consultation of stakeholders in the context of the specific contract 04 under FWC 21-3030-04/ EU Agency for Fundamental Rights
Data Protection Notice – FRA external and internal selection procedures
Data Protection Notice - Welfare reimbursement
Data Protection Notice - Experiences of Requested Persons in EAW proceedings
Data Protection Notice - Consultation with local authorities
Data Protection Notice - FRA consultative event on EU funds & fundamental rights
Data protection notice - Third FRA survey on discrimination and hate crime against Jews in the EU – online data collection and website
Data Protection Notice - Stakeholder Consultation in the context of the Third FRA survey on discrimination and hate crime against Jews in the EU
Data Protection Notice - Handling of data stored in the Agency's contacts database
Data Protection Notice - Recording of meetings, training and info sessions
Data Protection Notice - NLO meeting October 2022
Data Protection Notice - Matrix application
Data Protection Notice - Stakeholder consultation on Director's Note 2024
Data Protection Notice - Call for expressions of interest 2022 for the members of the Scientific Committee of FRA
Data Protection Notice - EU Charter of Fundamental Rights experts event October 2022
Data Protection Notice - Victims of hate crime in Romania – Focus groups
Data Protection Notice - Human Rights Leaders and Experts Meeting
Data Protection Notice - Missions
Data Protection Notice - Cooperation and consultation with Human Rights Cities
Data Protection Notice - Consultation of stakeholders - Evaluation services - Scenario-based strategy for FRA
Data Protection Notice - Children as victims of crimes in Romania – Focus groups
Data Protection Notice - Research Project on "GDPR - the experience of data protection authorties"
Data Protection Notice - Innovation Hub
Data Protection Notice - Data collection from digital platforms
Data Protection Notice - Declarations of interest
Data Protection Notice - Whistleblowing proceedings
Data Protection Notice - 64th EB - 39th MB
Data Protection Notice - Fundamental Rights Dialogue
Data Protection Notice - Social media
Data Protection Notice - CERT-EU services
Data Protection Notice - Consultation of stakeholders - Evaluation services
Data Protection Notice - Digital verification of COVID-19 certificates upon entry of FRA premises
Data Protection Notice - Procedural safeguards in EAW proceedings
Data Protection Notice - Providing technical assistance to national bodies - EU Charter & CRPD compliance of EU funds
Data Protection Notice - Mapping of national (EU-27) legal experts on the Charter of Fundamental Rights of the EU
Data Protection Notice - Conducting interviews on the role of equality bodies in combating hate crime
Data Protection Notice - Analysing online hatred Interviews
Data Protection Notice - Consultation of stakeholders - Performance monitoring and reporting - ICF
Data protection notice - 62nd Executive Board and 38th Management Board meetings taking place on 16 and 17 December in a virtual
Data Protection Notice - SYSPER
Data protection notice - Virtual seminar on the role of the Charter of Fundamental Rights of the EU in the work of Equality Bodies and National Human Rights Institutions - 20-22 October 2021
Data protection notice - 61st Executive Board and 37th Management Board meetings taking place on 24 September 2021 in a virtual meeting
Data protection notice - Fundamental Rights Forum 2021
Privacy notice - HRCN 2021
Privacy notice - HRCN videos
Privacy notice - Procurement procedures and contract management
Privacy notice - Research on the fundamental rights situation of long-term residents in the EU
Data Protection Notice - EU Survey on Immigrants
Privacy notice - Call for proposal of sessions for the event Fundamental Rights Forum 2021
Privacy Notice - Fieldwork research with children on procedural safeguards for children who are suspects or accused in criminal proceedings
Privacy notice - Research on evidence on bias when using algorithms - simulation and testing of selected cases
Privacy notice - Staff committee elections March 2021
Privacy notice - Legal aid in pre-removal detention and COVID19
Privacy notice - Data Subjects FRD2
Privacy notice - Expert interviews (SR 47)
Privacy notice - Procedural safeguards children
Privacy notice - Fundamental Rights Charter Event
Privacy notice - Evaluation services
Privacy notice - FRP 2021
Privacy notice - Roma Survey 2020
Privacy notice - MB&EB meetings
Data Protection Notice - Use of Microsoft 365
Privacy notice - COVID19
Privacy notice - Request for exception BREXIT
Privacy notice - Stakeholder consultation 2022
Privacy notice - The impact of the Terrorism Directive on fundamental rights
Privacy notice - Registration of Data Subject requests
Privacy notice - Data subjects complaints
Privacy notice - FRP registration
Privacy Notice - Monitoring ICT Systems and E-communications
Privacy notice - Incoming and Outgoing mails
Privacy notice - Scientific Committee selection
Privacy notice - FRA Infobox
Privacy notice - Background research on National Parliament Focal Points
Privacy notice - Establishment Establishment of Fundamental Rights Monitors
Privacy notice - Video interviews with journalists-editors for the eMedia Toolkit
Privacy notice - Fundamental Rights Dialogue virtual event, 13 November 2020
Privacy notice - Psycho-socio support service FRA staff
Privacy notice - Stakeholder consultation via online survey or telephone interviews for evaluation of FRA projects
Privacy notice - Provision of services for the Mid-term review of the FRA Strategy 2018-2022
Data protection notice - UPDATE Cisco Webex Meetings
Privacy notice - Consultation on the framework of commitments for human rights cities organised by the FRA
Privacy notice - Research project on Presumption of innocence: procedural rights in criminal proceedings
Privacy notice - FRA-Equinet joint EU Charter of Fundamental Rights workshop, 25-26 February 2020
Privacy Notice - Human Rights Cities expert meeting Brussels 28 Nov 2019
Privacy Notice - Visit to Dutch National Police The Hague 20-21 November 2019
Privacy Notice - Presentation of the Fundamental Rights Report 2019 - Rome 24-10-2019
Privacy Notice - events organised by the Agency which are live streamed
Privacy notice - Facial recognition technology experts meeting 19-20 September 2019
Privacy Notice - Organisation of 5th IPCAN Seminar
Privacy Notice - Roma stakeholders contact list
Privacy notice - Access to FRA survey data through GESIS data archive
Privacy notice - Access to FRA survey data through UK Data Service
Data Protection Notice - FRA consultations with civil society
Privacy Notice - Stakeholder Consultation on Director’s Note 2021
Privacy notice - Registration of incoming emails and letters (FRA Infobox)
Privacy notice - FRP consultation with organisations registered in the Fundamental Rights Platform (FRP) database on the topic of civil society space
Privacy notice - FRA consultations with organisations registered in the Fundamental Rights Platform database
Privacy notice - Fundamental Rights Forum news gathering
Privacy notice - Selection procedure for traineeships
Privacy Notice - FRA website and web services
Privacy Notice - Building access data
Privacy notice - Health data
Privacy Notice - Access to documents
Privacy Notice - Expert meetings
Privacy notice - CCTV system data
Privacy notice - Organisation of events