In July 2025, the European Data Protection Board adopted what it described as a landmark statement aimed at improving GDPR usability — particularly for micro, small and medium organisations. The statement emerged from a high-level meeting in Helsinki and sets out a direction of travel: more clarity, more support, and more engagement to reduce friction in day-to-day compliance.
The EDPB’s framing is notable because it explicitly links fundamental rights and competitiveness. The Board recognises that smaller organisations often struggle not because they disregard privacy, but because compliance is complex, guidance can be fragmented, and operational resources are limited. The Helsinki Statement therefore positions usability and consistent guidance as part of effective regulation, rather than a concession.
While the statement itself does not rewrite legal obligations, it matters because it sets expectations for regulator behaviour and future outputs. When supervisory authorities align on clearer templates, more consistent interpretations, and better engagement mechanisms, the day-to-day burden of “figuring out what good looks like” should fall. For SMEs, this could translate into more practical tools, fewer contradictory signals across Member States, and more actionable compliance pathways.
For larger organisations, the statement is also relevant: many SMEs operate as processors, vendors, or service providers in enterprise supply chains. If regulators drive clearer baseline expectations, enterprises may increasingly require structured evidence and standard artefacts from smaller vendors — tightening procurement requirements and pushing privacy maturity down the chain.
Acompli perspective: The Helsinki Statement reinforces a simple point: the future of GDPR compliance is operational. Organisations that can convert the GDPR’s principles into repeatable workflows — DPIAs, risk registers, vendor assessments, incident playbooks — will spend less time debating theory and more time demonstrating control. Tools that generate structured outputs (rather than static documents) directly support the direction the EDPB is signalling.