Article 1, Paragraph 2. · ECB/2026/18

Contents

2.This Decision applies to the processing of personal data in carrying out the following supervisory tasks:

(a)fit and proper procedures for significant supervised entities;

(b)authorisation procedures;

(c)ongoing supervision of significant supervised entities;

(d)enforcement and sanctions, with the exclusion of the processing of personal data by NCAs acting pursuant to Article 18(5) of Regulation (EU) No 1024/2013 from the moment the ECB notifies the NCA that it requires the NCA to open proceedings, and procedures under Article 136 of Regulation (EU) No 468/2014 (ECB/2014/17) from the moment the ECB notifies the NCA of its request;

(e)on-site inspections of significant supervised entities;

(f)oversight of the supervision of less significant supervised entities;

(g)supervision of less significant supervised entities.

For each supervisory task, the subject matter, nature and purpose of processing, the legal basis for processing, the data subjects concerned and the categories of personal data processed are set out in the Annexes.