Consumers, Health, Agriculture and Food Executive Agency

Data protection


The right to protection of personal data is a fundamental right foreseen in the Charter of Fundamental Rights of the European Union. Chafea is therefore highly committed to ensuring the protection of the personal data of the individuals it works with, regardless of whether they are grant applicants; tenderers; experts; stakeholders; individuals subscribing to a newsletter; staff members; or job applicants.

All personal data are processed by Chafea in accordance with Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of personal data by the European Union's institutions and bodies.

Personal data shall only be processed for the performance of tasks carried out in the public interest on the basis of EU law or in the legitimate exercise of official authority vested in the Agency. Alternatively, processing is lawful if it forms part of a legal or contractual obligation, it is necessary in order to protect vital interests or when the individual concerned has given their unambiguous consent.

Personal data processing for the implementation of the EU programmes

Personal data of applicants and tenderers are processed solely for the purpose of:

  • calls for proposals and direct grant agreements,
  • calls for tender or other activities linked to the mandate of the Agency (e.g. organising meetings).

Personal data processing for personnel selection and recruitment

Personal data submitted for job applications are processed solely for pre-selection and recruitment procedures at the Agency.

Personal information is processed only by Chafea staff responsible of the corresponding operations and kept no longer than necessary.

Data subjects have the right of information, access, rectification, to object an automated individual decision-making, the portability of data and their erasure. They also may at any time address a written request to the Chafea Human Resources services and/or the Data Protection Officer or have recourse to the European Data Protection Supervisor (EDPS).

Register of records

Each data controller has to keep a Record (previously Notification) for each type of processing activity involving personal data which should be stored in the Chafea Central Register of Records. It will contain all Records of processing activities in place in Chafea and the Data Controller in charge of it and the list of Records will be made publically accessible on the Chafea's public website.

The DPO provides an independent advisory function. They monitor the register of all personal data processing operations carried out by data controllers in the Agency and provide advice and make recommendations on rights and obligations of data controllers and data subjects. In critical situations, the DPO may investigate matters and incidents on request or on their own initiative.

Should you consider that the processing of your personal data by Chafea does not comply with the provisions of Regulation (EU) 2018/1725, you should first notify the data controller for the processing in question and ask him to take action.

You may also contact the Agency's DPO at to inform him or her of any issues related to the processing of your data.

If the problem cannot be solved this way, you may lodge a complaint with the EDPS. The EDPS is empowered to hear and investigate complaints and to conduct inquiries, including on his or her own initiative. If a breach of data protection rules is found to have occurred, the EDPS may exercise the powers assigned to him under Article 58 of Regulation (EU) 2018/1725.

Chafea Data Protection Officer



European Data Protection Supervisor
Giovanni BUTTARELLI, Supervisor
Wojciech WIEWIOROWSKI, Assistant Supervisor

Postal address
Rue Wiertz, 60 B-1047 Brussels
Telephone: (+32) 2 283 1900