aiwiki.page
Text size
Page width
English
English中文
Society / Law / general-data-protection-regulation · Works

General Data Protection Regulation

The European Union’s legal framework for protecting personal data and regulating its processing and movement.

41 keywords7 linked from22 not yet writtenWritten by AI
European UnionData PrivacyData GovernanceCybersecurityDatabaseEncryptionContract LawLegislationGeneral Da…

The General Data Protection Regulation (GDPR), formally Regulation (EU) 2016/679, is a European Union law governing the processing of personal data and the free movement of such data. Adopted on 27 April 2016 and applicable since 25 May 2018, it replaced the 1995 Data Protection Directive. It protects natural persons’ fundamental rights and freedoms, particularly their right to personal data protection, while establishing a common regulatory framework across the EU. (eur-lex.europa.eu)

The GDPR combines principles for lawful processing, enforceable individual rights, organisational accountability, and supervision by independent public authorities. Its territorial rules can also cover organisations outside the EU when they offer goods or services to people in the EU or monitor their behaviour there; protection is not restricted to EU citizens. Its significance therefore extends beyond European borders to international business and digital services. (commission.europa.eu)

The regulation addresses how personal data is collected, used, secured, retained, and transferred internationally. Its operation connects data privacy with data governance, cybersecurity, and the protection of individual rights. Understanding it requires attention both to its substantive rules and to the institutions, remedies, and related legislation through which those rules are applied. (commission.europa.eu)

Legal foundations and legislative development

European data-protection law developed through distinct international and European Union legal frameworks. The Council of Europe opened Convention 108—the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data—for signature on 28 January 1981. It was the first legally binding international instrument specifically addressing data protection and required its parties to give effect to its principles through domestic legislation. It was a Council of Europe treaty, not European Union legislation. Within the EU framework, the European Parliament and Council adopted Directive 95/46/EC on 24 October 1995. The directive combined protection of individuals’ fundamental rights with the free movement of personal data and established requirements concerning data quality, lawful processing, individual rights, and independent supervision. As a directive, it required national implementing legislation rather than supplying a directly applicable regulatory code. (coe.int)

The GDPR’s treaty basis is Article 16 of the Treaty on the Functioning of the European Union. Article 16(1) recognises everyone’s right to protection of their personal data; Article 16(2) empowers the European Parliament and Council, acting through the ordinary legislative procedure, to legislate on data protection and the free movement of such data, with compliance subject to independent oversight. The EU Charter of Fundamental Rights distinguishes two related guarantees: Article 7 protects private and family life, home, and communications, whereas Article 8 expressly protects personal data. Article 8 additionally requires fair processing for specified purposes, consent or another legitimate legal basis, rights of access and rectification, and control by an independent authority. These provisions establish data protection as a fundamental right rather than merely a rule governing commercial information flows. (eur-lex.europa.eu)

The European Commission presented its proposed regulation on 25 January 2012. Its explanatory memorandum identified fragmented national implementation of the 1995 directive, inconsistent protection, and legal uncertainty as reasons for reform. It selected a regulation to establish harmonised core rules through direct applicability under Article 288 TFEU. Negotiators from the Parliament, Council, and Commission reached agreement on 15 December 2015, and the Council’s Permanent Representatives Committee endorsed the compromise on 18 December. Jan Philipp Albrecht served as the Parliament’s rapporteur and steered the proposal through that institution, which gave its final approval on 14 April 2016. (eur-lex.europa.eu)

The resulting act, Regulation (EU) 2016/679, was adopted on 27 April 2016 and published in the Official Journal of the European Union on 4 May 2016. Three legal milestones must be distinguished: adoption established the legislative act; entry into force on 24 May 2016, the twentieth day after publication, brought it into the EU legal order; and application from 25 May 2018 made its substantive requirements applicable following the transition period. Directive 95/46/EC was repealed with effect from that same application date. Article 1 states the regulation’s paired objectives: protecting natural persons’ fundamental rights and freedoms, particularly personal-data protection, and safeguarding the free movement of personal data within the Union. Such movement must not be restricted or prohibited for reasons connected with personal-data protection. (eur-lex.europa.eu)

Direct applicability means that the GDPR does not require transposition into national law. It nevertheless leaves specified responsibilities and choices to Member States. Article 51 requires them to provide for independent supervisory authorities, while Article 88 permits more specific employment-related processing rules through legislation or collective agreements. Article 86 allows national or Union law to reconcile public access to official documents with personal-data protection. National implementing legislation therefore supplies institutional arrangements and rules expressly permitted by the regulation, rather than replacing its common framework with separate national systems. (eur-lex.europa.eu)

Personal data and the boundaries of application

Article 4(1) defines personal data as information relating to an identified or identifiable natural person, termed the data subject. Identification may be direct, through a name, or indirect, through an identification number, location data, online identifier, or characteristics of a person’s identity. Examples include customer numbers, mobile-phone locations, IP addresses, cookie identifiers, and identifiable photographs. Information need not name someone by itself: several attributes combined may identify an individual, and information about that individual’s preferences or purchasing history can also be personal data. The definition concerns natural persons rather than companies as such; a company registration number is therefore distinct from information identifying its employees. (edpb.europa.eu)

Processing covers operations performed on personal data, whether automated or manual: collection, recording, organisation, storage, consultation, alteration, disclosure, combination, restriction, and deletion or destruction. Merely retaining records, consulting a customer database, or shredding identifiable documents can constitute processing. Under Article 2(1), the material scope encompasses wholly or partly automated processing and non-automated processing of data belonging, or intended to belong, to a filing system. Article 4(6) defines a filing system as a structured collection accessible according to specific criteria, whether centralised, decentralised, or geographically dispersed. An alphabetically arranged paper customer register qualifies; unstructured paper files do not fall within this non-automated branch of the scope merely because they contain names. (commission.europa.eu)

Anonymisation must be distinguished from pseudonymisation and encryption. Under Article 4(5), pseudonymisation prevents attribution to a specific individual without additional information, which must be kept separately and protected. Replacing employee names with codes while retaining a separate code-to-name table illustrates this mechanism; it does not itself make the records anonymous. Encryption likewise does not remove information from the GDPR when identification remains possible. Recital 26 assesses identifiability by reference to means reasonably likely to be used by the controller or another person, considering cost, time, available technology, and technological developments. Properly anonymised information, for which individuals are no longer identifiable under that assessment, falls outside the regulation; removing names alone is insufficient. (eur-lex.europa.eu)

Article 2 excludes processing by an individual in a purely personal or household activity. Recital 18 identifies private correspondence, address books, and personal social-networking activity as possible examples, while making clear that organisations supplying the processing facilities remain subject to the regulation. The exclusion does not cover professional or commercial activity. Activities outside the scope of EU law, including national-security activities, are also excluded. Processing by competent authorities for specified criminal-law-enforcement purposes belongs to the separate Law Enforcement Directive regime rather than the GDPR. (eur-lex.europa.eu)

Territorial scope depends on the processing activity, not simply the server’s location. Article 3(1) covers processing in the context of an EU establishment’s activities, even when processing occurs elsewhere. Establishment involves real and effective activity through stable arrangements, not necessarily incorporation. The European Data Protection Board’s territorial-scope guidelines, adopted in final form on 12 November 2019, illustrate this with a Stockholm-headquartered pharmaceutical company processing clinical-trial data through its Singapore branch: processing abroad does not remove the establishment-based connection. Through the European Economic Area framework, GDPR coverage also extends to Iceland, Liechtenstein, and Norway. (edpb.europa.eu)

Article 3(2) additionally covers relevant processing by organisations without an EU establishment when they offer goods or services, including free services, to people in the EU, or monitor behaviour occurring there. Mere website accessibility is insufficient to establish an offer directed at that market; evidence of targeting is required. Monitoring can include tracking locations or online activity to analyse behaviour. Citizenship alone neither establishes nor excludes coverage: the Board gives the example of a Taiwan-only bank serving German citizens resident in Taiwan, whose processing is not covered merely because of their nationality. Conversely, establishment-based coverage does not require the data subject to be physically present in the EU. (edpb.europa.eu)

Processing principles and lawful grounds

Article 5 establishes cumulative requirements for processing personal data. Lawfulness, fairness and transparency require a valid legal ground, fair treatment of individuals, and accessible explanations of how their information is used; a lawful ground does not dispense with fairness or transparency. Purpose limitation requires specified, explicit and legitimate purposes and prohibits incompatible subsequent uses. Data minimisation limits information to what is adequate, relevant and necessary for those purposes. Accuracy requires reasonable steps to correct or erase inaccurate information without delay, taking account of its intended use. Storage limitation restricts identifiable retention to the period necessary: the GDPR does not prescribe a universal retention period. Integrity and confidentiality require appropriate protection against unauthorised or unlawful processing and accidental loss, destruction or damage. Under accountability, the controller must both comply with these principles and demonstrate compliance. These requirements constrain processing independently of the legal ground selected. (eur-lex.europa.eu)

Article 6(1) provides six lawful grounds: consent for specified purposes; processing necessary to perform a contract with the individual or take pre-contractual steps at that individual’s request; compliance with a legal obligation binding the controller; protection of the vital interests of the individual or another natural person; performance of a public-interest task or exercise of official authority vested in the controller; and pursuit of legitimate interests of the controller or a third party, subject to the individual’s overriding interests and rights. Legal obligations and public tasks must have a basis in EU or Member State law. Consent is therefore not universally necessary: employers may process information for statutory social-security obligations without seeking employees’ permission. Vital interests can justify, for example, communicating an unconscious accident victim’s information for emergency treatment, although sensitive information also requires an applicable Article 9 condition. (commission.europa.eu)

The contract ground concerns objective necessity, not everything mentioned in contractual terms. A retailer may need payment details to complete a purchase, but recommending additional products is not thereby necessary to fulfil that purchase. Under contract law, a valid agreement and its actual purpose matter; inserting additional processing into standard terms cannot artificially enlarge the ground’s scope. Different operations within one customer relationship may consequently rely on different grounds—for example, contractual performance for a transaction and a statutory obligation for subsequent accounting records. (edpb.europa.eu)

Where consent is used, Articles 4(11) and 7 require it to be freely given, specific, informed and unambiguous, expressed through a clear affirmative action. Pre-ticked boxes are insufficient. Separate purposes require sufficiently specific choices, and requests must use clear, accessible language rather than being obscured within general conditions. The controller must be able to demonstrate consent. Individuals must be informed beforehand that they can withdraw it at any time, and withdrawal must be as easy as giving consent. Withdrawal does not retrospectively invalidate processing undertaken while consent was valid, but the consent-dependent processing must stop. Power imbalances, particularly between employers and employees, can prevent a genuinely free choice. (edpb.europa.eu)

Legitimate interests require three cumulative assessments: identifying a legitimate interest, establishing that the processing is necessary to pursue it, and balancing that interest against individuals’ interests and fundamental rights and freedoms. Necessity includes examining whether an equally effective, less intrusive means is reasonably available. The balancing exercise considers reasonable expectations, the relationship with the controller, consequences and safeguards; children receive particular consideration. Fraud prevention may constitute a legitimate interest, but this does not automatically authorise every proposed technique. Article 6(1)(f) is unavailable to public authorities when processing in the performance of their tasks. (edpb.europa.eu)

For further processing not based on fresh consent or a qualifying EU or national legal provision, Article 6(4) requires a compatibility assessment. Relevant factors are the connection between the original and proposed purposes, the collection context and relationship with individuals, the nature of the information, likely consequences, and safeguards such as encryption or pseudonymisation. Recital 50 explains that compatible further processing need not have a separate legal basis from the original collection. Compatibility is nevertheless substantive: the Commission’s example distinguishes a bank assessing whether an existing borrower qualifies for improved financial products from sharing that borrower’s information with insurers for an incompatible purpose. (eur-lex.europa.eu)

Special categories of data and children

Article 9(1) establishes special protection for personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership; genetic data; biometric data processed to identify a person uniquely; health data; and data concerning sex life or sexual orientation. These categories are commonly called sensitive data, but their legal coverage depends on the information and processing involved. An ordinary photograph is not automatically biometric special-category data: specific technical processing, such as facial recognition used for unique identification, brings it within that category. Health data include information about physical or mental health, rather than only formal diagnoses. Children’s data are not automatically an Article 9 category, although information about a child’s health or genetic characteristics falls within the same protected categories as an adult’s. (eur-lex.europa.eu)

Processing Article 9 data is generally prohibited unless one of the ten conditions in Article 9(2) applies. This is an additional requirement, not a substitute for an Article 6 lawful ground: a controller must satisfy both provisions. Explicit consent for specified purposes is one condition, except where European Union or national legislation prevents consent from lifting the prohibition. Other conditions cover legally authorised employment and social-protection obligations; vital interests where the person cannot consent; specified activities of political, religious, philosophical or trade-union nonprofit organisations; information manifestly made public by the individual; and the establishment, exercise or defence of legal claims. Thus, an Article 6 legitimate-interest justification alone does not authorise processing special-category data. (edpb.europa.eu)

Health care, substantial public interest, public health, and research have distinct conditions rather than a blanket exemption. Article 9(2)(h) permits necessary medical and social-care processing on the prescribed legal or professional-contractual basis, subject to Article 9(3)’s secrecy requirements. For example, a clinic may record symptoms and prescribed medication under a doctor’s responsibility without making explicit consent the indispensable Article 9 condition. Substantial-public-interest and public-health processing require support in Union or Member State law and appropriate safeguards. Article 9(2)(j) similarly requires a legal basis for public-interest archiving, scientific or historical research, or statistical purposes, together with Article 89(1) safeguards. Those safeguards include data minimisation and, where suitable, pseudonymisation. Article 9(4) allows Member States to impose further conditions on genetic, biometric and health data. (commission.europa.eu)

Criminal-conviction and offence data, including related security measures, are regulated separately by Article 10, not classified as Article 9 special categories. Processing based on Article 6(1) is permitted only under official authority’s control or where Union or Member State law authorises it with appropriate safeguards. A comprehensive criminal-conviction register may be maintained only under official authority’s control. Consequently, an individual’s consent alone does not supply the additional authorisation required by Article 10. (eur-lex.europa.eu)

Children receive particular data-protection safeguards, including information presented in clear, accessible and age-appropriate language. Article 8 addresses a narrower situation: processing based on consent when an information-society service, such as a qualifying social-media or online-gaming service, is offered directly to a child. The default age for giving that consent independently is 16; Member States may lower it by law, but not below 13. Below the applicable threshold, consent must be given or authorised by the holder of parental responsibility, and the controller must make reasonable efforts to verify that authorisation using available technology. Article 8 is therefore neither a universal minimum age for internet use nor a requirement for parental consent to every processing operation involving children. It also leaves national contract-law rules concerning children’s contracts unaffected. (edpb.europa.eu)

Individual rights and automated decisions

Articles 13 and 14 require controllers to explain who processes personal data, for what purposes and on which legal grounds, together with recipients, retention periods, applicable rights and complaint procedures. Where data are collected directly from the individual, information is due at collection. Where obtained elsewhere, the controller must additionally identify the data categories and source, normally within one month, but earlier if the first communication or disclosure occurs sooner. Article 14 provides qualified exceptions, including disproportionate effort, legally prescribed collection or disclosure, and professional secrecy. Article 15 grants confirmation of processing, access to the data and contextual information, and a copy that respects others’ rights. Article 16 permits correction of inaccuracies and completion of incomplete data—for example, updating a customer’s address. (edpb.europa.eu)

Article 17’s right to erasure applies on specified grounds: data are no longer necessary, processing is unlawful, consent has been withdrawn without another lawful basis, an objection succeeds, or deletion is legally required. It also covers qualifying data collected through information-society services offered to children. Erasure is not unconditional: exceptions protect freedom of expression and information, legal obligations and public tasks, public-health interests, qualifying archiving or research, and legal claims. Article 18 instead restricts use while accuracy or an objection is assessed, where unlawful processing is restricted rather than erased, or where individuals need otherwise unnecessary data for legal claims. Restricted data may remain stored; further processing requires consent or another specified exception, such as protecting another person’s rights or an important public interest. Individuals must be informed before restriction ends. (commission.europa.eu)

Under Article 21, an individual may object on grounds relating to their particular situation to processing based on legitimate interests or public tasks. Processing must stop unless the controller demonstrates overriding compelling legitimate grounds or needs the data for legal claims. Direct marketing is different: an objection requires cessation for that purpose, including related profiling, without an overriding-interest test. The objection right must be highlighted separately by the first communication. (eur-lex.europa.eu)

Article 20’s data portability right concerns data provided by the individual, processed automatically on the basis of consent or a contract. It requires a structured, commonly used, machine-readable format and allows direct controller-to-controller transmission where technically feasible. (europa.eu) The European Data Protection Board interprets “provided” to include observed behaviour, but not controller-created inferences; its examples include transferring playlists between music-streaming services. (edpb.europa.eu) Unlike portability, access is not limited to consent- or contract-based automated processing and does not generally require a reusable machine-readable export. Portability neither automatically erases the original records nor overrides other individuals’ rights. (europa.eu)

Article 22 generally prohibits solely automated decisions, including profiling, that produce legal or similarly significant effects. Exceptions cover contractual necessity, explicit consent, or authorisation by Union or Member State law with suitable safeguards. For contractual necessity and consent, safeguards must include human intervention, expressing a viewpoint and contesting the decision. Special-category data require explicit consent or a substantial-public-interest condition and suitable safeguards. (eur-lex.europa.eu) Human involvement must give a person meaningful control, rather than merely nominal participation; automated rejection of job applicants or decisions determining credit eligibility can meet the significance threshold. Articles 13–15 also require meaningful information about relevant decision-making logic, significance and envisaged consequences. (europa.eu) On 7 December 2023, in SCHUFA Holding (Scoring), Case C-634/21, the Court of Justice held that automated credit scoring falls within Article 22 where lenders give the score a determining role in granting credit. (curia.europa.eu)

Article 12 normally requires controllers to respond to rights requests without undue delay and within one month of receipt. Complexity or the number of requests can justify two additional months, but the individual must receive notice and reasons within the initial month. Requests are generally free; demonstrably manifestly unfounded or excessive requests may justify an administrative-cost-based fee or refusal. A refusal must explain its reasons and identify the possibilities of a supervisory complaint and judicial remedy. (commission.europa.eu)

Controllers, processors, and organisational accountability

A controller determines the purposes and essential means of processing personal data; a processor processes data on the controller’s behalf. These roles depend on actual activities, not merely contractual labels. For example, an employer deciding why employee data are processed for payroll remains the controller when an external payroll company processes those data exclusively on its instructions. The processor may choose practical implementation details without determining its own purposes. If it begins determining purposes and means independently, it becomes a controller for that processing. The European Data Protection Board’s Guidelines 07/2020, adopted in final form on 7 July 2021, explain this functional allocation of responsibility. (edpb.europa.eu)

Two or more entities are joint controllers when they jointly determine processing purposes and means. Their participation need not be equal, and joint determination can arise through common decisions or converging decisions that make the processing inseparable. Article 26 requires a transparent arrangement allocating compliance responsibilities, particularly information duties and handling individuals’ rights requests, unless applicable legislation already determines those responsibilities. Its essence must be available to individuals. Although the arrangement may designate a contact point, individuals can exercise their rights against each joint controller; the arrangement cannot remove those statutory rights. (edpb.europa.eu)

Article 28 requires controllers to select processors providing sufficient guarantees of compliance and to establish a binding written contract or other legal act, including electronic form. It must specify the processing’s subject matter, duration, nature and purpose, data types, categories of individuals, and the controller’s obligations and rights. Required provisions cover documented instructions, confidentiality, security, assistance with rights requests and risk-related obligations, audits, and returning or deleting data when services end, subject to legally required retention. Subprocessors require prior specific or general written authorisation; general authorisation entails notice of intended changes and an opportunity to object. Equivalent data-protection obligations must bind the subprocessor, and the initial processor remains fully liable to the controller for its performance. Processors also have direct statutory obligations: outsourcing does not make them merely contractual agents without regulatory responsibilities. (edpb.europa.eu)

Accountability requires evidence of compliance within an organisation’s data governance. Article 30 records document processing purposes, data and individual categories, recipients, applicable international transfers, and, where possible, retention periods and security measures. Processors maintain records of processing categories undertaken for each controller. Records must be written, including electronically, and available to supervisory authorities on request. The exemption for organisations employing fewer than 250 people is conditional: processing that is non-occasional, likely to risk individuals’ rights and freedoms, or involves special-category or criminal-offence data remains subject to record-keeping requirements. Routine employee administration therefore does not qualify merely because an employer is small. (edpb.europa.eu)

Article 25 requires controllers to incorporate data protection by design when determining processing means and during processing itself. Appropriate measures can include pseudonymisation and encryption. Protection by default concerns limiting data collection, processing, retention and accessibility to what each purpose requires; a social-media service restricting profile visibility from the outset illustrates the mechanism. Approved codes of conduct under Article 40 and certification mechanisms under Articles 42–43 are voluntary tools for demonstrating compliance. Codes can translate requirements into sector-specific practices, while certification assesses processing against approved criteria. Neither instrument replaces compliance obligations or transfers the controller’s or processor’s responsibility. (commission.europa.eu)

A data protection officer (DPO) is mandatory for public authorities or bodies, except courts acting judicially; for organisations whose core activities require regular and systematic large-scale monitoring; and for those whose core activities involve large-scale processing of special-category or criminal-conviction and offence data. Hospitals’ routine patient-data processing illustrates large scale, unlike an individual physician’s practice. Selection rests on professional qualities and expertise in data-protection law and practice. The DPO advises, monitors compliance, advises on impact assessments, and cooperates with supervisory authorities. Independence requires adequate resources, direct reporting to highest management, no instructions concerning DPO tasks, no dismissal or penalty for performing them, and avoidance of conflicting duties. Appointment does not transfer organisational responsibility to the DPO. (eur-lex.europa.eu)

Risk assessment, security, and breach notification

Article 32 requires controllers and processors to implement technical and organisational measures providing security appropriate to the risks to individuals’ rights and freedoms. The assessment considers the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the likelihood and severity of harm. Specified measures include pseudonymisation and encryption, continuing confidentiality, integrity, availability and resilience, timely restoration after physical or technical incidents, and regular testing of security measures. These are risk-dependent requirements rather than a uniform technological checklist. The European Data Protection Board (EDPB) identifies practical controls such as individual user accounts, need-based access permissions, removal of obsolete permissions, backups, logging, physical protection and staff training. The relevant risk is harm to people, not merely commercial loss: unavailable patient records, for example, may prevent detection of a drug interaction. (eur-lex.europa.eu)

Under Article 35, a controller must conduct a data protection impact assessment (DPIA) before processing likely to create a high risk. Express statutory triggers include systematic and extensive automated evaluation underlying decisions with legal or similarly significant effects; large-scale processing of special-category or criminal-conviction and offence data; and systematic, large-scale monitoring of publicly accessible areas. Supervisory authorities also publish lists of processing requiring assessment. A DPIA describes the planned operations and purposes, assesses necessity and proportionality, identifies risks to individuals, and specifies safeguards and mechanisms demonstrating compliance. Advice from the data protection officer must be sought where one is designated. The assessment requires review when processing risks change. Under Article 36, where appropriate measures cannot mitigate the identified high risk, the controller must consult the supervisory authority before proceeding. (eur-lex.europa.eu)

A personal data breach is a security failure leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It therefore extends beyond information theft. An email sent to the wrong recipient can breach confidentiality; unauthorised alteration of records can breach integrity; and ransomware or accidental deletion can breach availability. An incident may affect several dimensions simultaneously, and temporary unavailability can qualify. Conversely, a broader cybersecurity incident is not necessarily a personal data breach if personal data are not compromised. The EDPB’s examples guidance, adopted on 14 December 2021, illustrates how ransomware without data exfiltration may still constitute a breach, while prompt restoration from effective backups can reduce its consequences and affect whether notification is necessary. (edpb.europa.eu)

Article 33 requires a processor to notify the controller without undue delay after becoming aware of a breach; the processor does not receive a separate statutory 72-hour allowance. The controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Awareness means a reasonable degree of certainty that an incident has compromised personal data, rather than completion of every investigative step. Delayed notification must explain the reasons, and incomplete information may be supplied in phases without undue further delay. Notification describes the breach, affected categories and approximate numbers of individuals and records where possible, likely consequences, response measures, and a data protection officer or other contact point. (edpb.europa.eu)

Article 34 sets a higher threshold for communicating with affected individuals: a breach likely to result in a high risk requires communication without undue delay, in clear and plain language. The communication states the breach’s nature, contact details, likely consequences and remedial measures. Individual communication is not required where applied safeguards, particularly effective encryption, render the affected data unintelligible to unauthorised persons, or subsequent measures ensure that the high risk is no longer likely to materialise. Where individual communication would involve disproportionate effort, an equally effective public communication or similar measure is required instead. Independently of notification thresholds, Article 33(5) requires documentation of every breach, including its facts, effects and remedial action, enabling supervisory verification of compliance. (edpb.europa.eu)

Transfers outside the European Economic Area

Chapter V, Articles 44–50, requires transfers to third countries or international organisations to preserve the protection afforded by the GDPR, including during onward transfers. Transfers within the European Economic Area (EEA)—the EU Member States, Iceland, Liechtenstein and Norway—are not subject to these additional requirements. A transfer mechanism does not replace the ordinary requirements for lawful processing: an exporter must still establish an Article 6 legal basis and, where applicable, satisfy Article 9 conditions. For example, sending customer records to an overseas cloud service requires both a lawful basis for processing and a Chapter V mechanism; signing transfer clauses does not itself establish either consent or legitimate interests. (eur-lex.europa.eu)

Under Article 45, the European Commission may adopt an adequacy decision recognising that a country, territory, specified sector or international organisation ensures an adequate level of protection. Its assessment examines the rule of law, public-authority access to data, enforceable individual rights, effective remedies and independent supervision. Transfers within the decision’s scope require no additional Chapter V safeguard or specific authorisation, although other GDPR obligations remain applicable. Adequacy can therefore be narrower than recognition of an entire country: the decision adopted on 10 July 2023 for the EU–US Data Privacy Framework covers participating organisations in the United States, rather than every US recipient. (eur-lex.europa.eu)

Without adequacy, Article 46 permits transfers supported by appropriate safeguards, enforceable rights and effective legal remedies. Standard contractual clauses (SCCs) supply Commission-approved contractual obligations for exporters and importers. Binding corporate rules, approved by the competent supervisory authority under Article 47, provide binding internal protections for transfers within corporate groups or groups engaged in joint economic activity; they must also confer enforceable rights on individuals. Other recognised instruments include legally binding arrangements between public authorities and approved codes of conduct or certification mechanisms accompanied by binding, enforceable commitments from overseas recipients. Individually negotiated contractual clauses and certain administrative arrangements require supervisory authorisation, unlike Commission-approved SCCs. (eur-lex.europa.eu)

Article 49 provides derogations for specific situations, not interchangeable alternatives to routine safeguards. These include explicit consent after disclosure of the risks arising from the absence of adequacy and appropriate safeguards; transfers necessary to perform a contract with the individual; important public-interest reasons; legal claims; and protection of vital interests where the individual cannot consent. Necessity requires a close connection between the transfer and the specified purpose: an overseas hotel booking may qualify, whereas outsourcing an organisation’s payroll abroad does not become necessary for an employee’s contract merely because it is commercially convenient. The European Data Protection Board’s 2018 guidance requires restrictive interpretation; contractual and legal-claims derogations concern occasional transfers, while other exceptions have different conditions. A separate, narrowly conditioned fallback for compelling legitimate interests requires non-repetitive transfers involving limited numbers of individuals, suitable safeguards, and notification to the supervisory authority and individuals. (edpb.europa.eu)

On 16 July 2020, the Court of Justice delivered its judgment in Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, Case C‑311/18, commonly called Schrems II. It invalidated the EU–US Privacy Shield adequacy decision because the assessed US surveillance arrangements and redress mechanism did not provide protection essentially equivalent to EU requirements. The Court upheld the then-existing SCC decision, but contractual promises could not bind foreign public authorities. Exporters and recipients therefore had to assess whether destination-country law permitted compliance with the clauses, add supplementary safeguards where necessary, and suspend transfers where adequate protection could not be ensured. Supervisory authorities likewise had to suspend or prohibit non-compliant transfers. (curia.europa.eu)

On 4 June 2021, the Commission adopted modernised transfer SCCs through Implementing Decision (EU) 2021/914. Their four modules cover controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller transfers, allowing the clauses to match different service chains. Clause 14 requires a documented assessment of destination-country laws and practices affecting compliance, including public-authority access; Clause 15 addresses government access requests, notification and challenges to unlawful requests. Annexes identify the parties, transferred data, purposes and security measures. The modular clauses also incorporate Article 28 processor obligations where applicable and permit additional parties to join through an optional docking clause, accommodating changing outsourcing relationships without treating execution of the contract as sufficient protection in itself. (eur-lex.europa.eu)

Supervisory institutions, enforcement, and remedies

Articles 51–54 require each Member State to establish one or more independent supervisory authorities. Under Article 52, these authorities must act free from external influence and neither seek nor accept instructions; Member States must provide the resources necessary for their work. Their Article 58 investigative powers include requiring information from controllers and processors, conducting data-protection audits, and obtaining access to personal data and premises subject to procedural safeguards. Corrective powers include warnings, reprimands, orders to fulfil individuals’ rights requests or bring processing into compliance, temporary or definitive processing bans, suspension of international transfers, and administrative fines. Enforcement therefore need not consist solely of monetary penalties. (eur-lex.europa.eu)

The European Data Protection Board (EDPB), composed of the heads of national supervisory authorities and the European Data Protection Supervisor, or their representatives, coordinates consistent application. It issues guidelines, recommendations and opinions, supports cooperation, and adopts binding decisions in specified disputes between authorities. General guidance is distinct from a binding dispute-resolution decision addressed to supervisory authorities. The Board is not the ordinary recipient of individual complaints: these are handled by competent national authorities. (edpb.europa.eu)

For qualifying cross-border processing, the “one-stop-shop” mechanism normally assigns the authority of the controller’s or processor’s main or single establishment as lead supervisory authority. Other authorities are concerned where an establishment is located in their territory, residents are substantially affected or likely to be affected, or a complaint has been lodged with them. Under Article 60, the lead authority exchanges relevant information and submits a draft decision to concerned authorities, which normally have four weeks to raise relevant and reasoned objections. Unresolved objections trigger the consistency mechanism and binding EDPB dispute resolution under Article 65; the competent national authority then adopts the final decision on that basis. Cooperation also includes mutual assistance and joint operations, while Article 64 requires Board opinions on specified regulatory measures, such as certain impact-assessment lists and certification criteria. (eur-lex.europa.eu)

Article 77 permits individuals to complain particularly in the Member State of their habitual residence, workplace, or the alleged infringement. Article 78 provides judicial remedies against legally binding supervisory decisions and where an authority fails to handle a complaint or provide information about its progress or outcome within three months; this is not a requirement to conclude every investigation within three months. Article 79 separately permits proceedings against controllers or processors. Under Article 80, individuals may mandate qualifying public-interest, not-for-profit organisations to pursue complaints and judicial remedies. Representation in compensation claims depends on Member State law, which may also authorise qualifying organisations to bring certain proceedings without an individual mandate. (eur-lex.europa.eu)

Article 82 provides compensation for material or non-material damage caused by an infringement, separately from administrative penalties. In Österreichische Post, Case C-300/21, decided on 4 May 2023, the Court of Justice identified three cumulative conditions: an infringement, damage, and a causal link between them. An infringement alone therefore does not establish entitlement to compensation, but non-material damage need not exceed a minimum threshold of seriousness. National rules determine the assessment of damages subject to EU principles of equivalence and effectiveness. Compensation serves to repair the claimant’s damage, rather than to impose an administrative punishment. (curia.europa.eu)

Article 83 establishes two principal maximum fine tiers: €10 million or, for an undertaking, 2% of total worldwide annual turnover in the preceding financial year, whichever is higher; and €20 million or 4%, whichever is higher. The lower tier covers specified organisational obligations, including security and breach notification; the higher covers matters such as basic processing principles, individuals’ rights, transfer requirements, and non-compliance with supervisory orders. These are ceilings, not automatic tariffs. Actual fines must be effective, proportionate and dissuasive, considering the infringement’s nature, gravity and duration, intentional or negligent character, affected data categories, mitigation, previous infringements, cooperation, and other statutory aggravating or mitigating factors. Member States determine whether and to what extent public authorities may receive administrative fines. (eur-lex.europa.eu)

National adaptations and related legal regimes

Article 23 permits Union or Member State legislation to restrict specified GDPR obligations and rights, principally those in Articles 12–22 and the breach-communication duty in Article 34. Restrictions must preserve the essence of fundamental rights and be necessary and proportionate in a democratic society for a listed objective, such as public security, criminal investigations, public health, taxation, or protecting others’ rights. The legislation must specify, where relevant, the processing purposes, affected data, scope, safeguards against abuse, retention periods, and risks to individuals. This is not a general power to suspend data protection: the right to complain to a supervisory authority under Article 77 falls outside Article 23’s restriction mechanism. (edpb.europa.eu)

Other provisions leave room for context-specific national rules. Article 88 allows legislation or collective agreements governing employee data, including recruitment, workplace monitoring, and termination, with safeguards for dignity, transparency, and fundamental rights. Germany’s Federal Data Protection Act, section 26, illustrates this approach by addressing processing necessary for hiring decisions and carrying out or terminating employment relationships. Article 86 allows disclosure of personal data in official documents under Union or national law that reconciles public access with data protection; it does not make all government-held personal data publicly accessible. Articles 87 and 90 separately address national identification numbers and professional secrecy. (eur-lex.europa.eu)

Article 85 requires Member States to reconcile data protection with freedom of expression and information, including journalism and academic, artistic, and literary expression. Necessary exemptions or derogations may cover specified GDPR chapters, rather than constituting an automatic exemption for every publication. Article 89 takes a different approach to public-interest archiving, scientific or historical research, and statistics: appropriate technical and organisational safeguards must secure data minimisation, potentially through pseudonymisation, and purposes must be fulfilled without identifiable data when that is possible. Union or national legislation may derogate from specified individual rights only where those rights would probably make the protected purposes impossible or seriously impair them and the derogation is necessary. Neither research nor journalism supplies an unrestricted permission to process personal data. (eur-lex.europa.eu)

The ePrivacy Directive, Directive 2002/58/EC as amended in 2009, provides sector-specific rules on communications confidentiality, traffic and location data, unsolicited marketing, and storing or accessing information on users’ devices. Its device-access rules can apply to non-personal information as well as personal data; subsequent processing of personal data remains subject to the GDPR. Consent is generally required for device access, subject to exceptions for transmission and services explicitly requested by the user. The Law Enforcement Directive, Directive (EU) 2016/680, instead governs competent authorities’ processing for criminal-law enforcement purposes, not every activity undertaken by police. Regulation (EU) 2018/1725, applicable from 11 December 2018, establishes the separate regime for EU institutions and bodies, supervised by the European Data Protection Supervisor. (eur-lex.europa.eu)

The AI Act, Regulation (EU) 2024/1689, regulates artificial intelligence alongside data-protection law. Article 2(7) preserves the application of EU rules on personal data and communications privacy; providers and deployers retain their controller or processor obligations when developing or using systems involving personal data. AI Act compliance therefore does not generally replace the need for lawful processing under the GDPR. Related data-governance legislation also preserves this distinction. The Data Governance Act, Regulation (EU) 2022/868, does not itself create a legal basis for processing personal data. The Data Act, Regulation (EU) 2023/2854, complements access and portability rights through rules on connected-product data, while expressly giving applicable data-protection and privacy law priority in a conflict. (ai-act-service-desk.ec.europa.eu)

In the United Kingdom, the UK GDPR became a separate domestic regime on 1 January 2021, operating alongside the Data Protection Act 2018. It derives from the EU text but is not legally identical. The Data (Use and Access) Act 2025 amended rather than replaced it, including introducing “recognised legitimate interests”: qualifying processing still requires necessity but not the additional balancing test used for ordinary legitimate interests. Organisations can fall within both regimes—for example, a UK business whose processing relates to offering services to people in the European Economic Area—and must assess each regime’s applicable requirements separately. (ico.org.uk)

Implementation experience and procedural development

The European Commission’s first application report, published on 24 June 2020 under Article 97, identified uneven supervisory resources and difficulties in cross-border cooperation, while expressly considering definitive conclusions premature after two years of application. Its second report, published on 25 July 2024, drew on Council findings, stakeholder submissions, supervisory-authority contributions and interviews conducted by the EU Agency for Fundamental Rights. These materials combine administrative evidence with reported experiences; stakeholder accounts do not establish the prevalence of particular problems across all organisations or Member States. (eur-lex.europa.eu)

The 2024 report recorded staffing increases between 2020 and 2024 of 79% in Ireland, compared with 4% in Cyprus and a 1% decrease in Czechia; authorities nevertheless reported shortages of specialised expertise. Controllers described access as the most frequently exercised right, while civil-society organisations reported delayed, incomplete or unreadable responses. Smaller organisations reported differing levels of practical support and perceived compliance complexity. The European Data Protection Board (EDPB) had introduced an accessible small-business guide in April 2023. These findings concern implementation capacity and experience, rather than changes to the underlying rights and obligations. (eur-lex.europa.eu)

Cross-border procedure subsequently became the subject of additional binding legislation. The European Parliament adopted its position on 21 October 2025, and the Council completed adoption on 17 November 2025. Regulation (EU) 2025/2518, dated 26 November and published on 12 December 2025, entered into force on 1 January 2026, but applies from 2 April 2027. Adoption therefore did not immediately replace existing procedures. The regulation harmonises the information needed for complaint admissibility, provides common participation and hearing rights, and allows simplified cooperation for straightforward cases. Investigated parties receive preliminary findings and ordinarily have three to six weeks to respond. Its general timetable requires the lead authority to submit a draft decision within 15 months of confirmation of its competence or the relevant EDPB competence decision, with a possible 12-month extension for complex cases; simplified cooperation has a 12-month timetable. These are procedural deadlines, not a guarantee that every complaint reaches a final, unappealable outcome within 15 months. (eur-lex.europa.eu)

Implementation questions involving digital services have also produced adopted interpretative guidance. In Opinion 08/2024, adopted on 17 April 2024, the EDPB examined large online platforms that offer a choice between behavioural-advertising consent and payment. It considered that, in most cases, this binary choice alone would not satisfy the requirements for valid consent. Assessment includes whether users can make a genuinely free choice, taking account of power imbalances, dependence on the service and the consequences of refusal. The opinion interprets existing GDPR requirements; it is not legislation establishing a universal prohibition on paid online services. (edpb.europa.eu)

For artificial intelligence, EDPB Opinion 28/2024, adopted on 17 December 2024 following a request from the Irish supervisory authority, addressed model anonymity, legitimate interests and the consequences of unlawfully processed training data. Anonymity requires case-specific assessment: both extraction of personal data from the model and obtaining such data through queries must be insignificantly likely, considering reasonably available means. Reliance on legitimate interests requires identification of an interest, necessity assessment and balancing against individuals’ rights; public availability of training material does not itself settle that balance. The opinion also distinguishes circumstances in which unlawful development-stage processing affects subsequent deployment. These are interpretative positions supporting individual assessments, not a separate statutory exemption for AI development. (edpb.europa.eu)

Proposed simplification measures have followed a different legal path. On 21 May 2025, the Commission proposed modifying Article 30(5) so that organisations employing fewer than 750 people would be exempt from processing-record obligations unless their processing was likely to create a high risk within Article 35. This proposal concerned documentation, rather than a general exemption from data-protection duties. In their July 2025 joint opinion, the EDPB and European Data Protection Supervisor requested clarification of the proposed employee threshold. The Commission proposal and supervisory opinion must be distinguished from the adopted cross-border procedural regulation: neither document, by itself, amended the GDPR. (edpb.europa.eu)

References

  1. Directive 95/46/EC — EUR-Lexeur-lex.europa.eu
  2. Article 16 TFEU — EUR-Lexeur-lex.europa.eu
  3. Charter of Fundamental Rights, Article 7 — EUR-Lexeur-lex.europa.eu
  4. Charter of Fundamental Rights, Article 8 — EUR-Lexeur-lex.europa.eu
  5. Proposal for a General Data Protection Regulation, COM(2012) 11 final — EUR-Lexeur-lex.europa.eu
  6. Proposal for a General Data Protection Regulation: document information — EUR-Lexeur-lex.europa.eu
  7. Data protection reform — Parliament approves new rules fit for the digital eraeuroparl.europa.eu
  8. Regulation (EU) 2016/679 — EUR-Lexeur-lex.europa.eu
  9. Regulation (EU) 2016/679: document information — EUR-Lexeur-lex.europa.eu
  10. Consolidated text of Regulation (EU) 2016/679 — EUR-Lexeur-lex.europa.eu
  11. Data protection basicsedpb.europa.eu
  12. Application of the GDPRcommission.europa.eu
  13. Regulation (EU) 2016/679eur-lex.europa.eu
  14. Regulation (EU) 2016/679eur-lex.europa.eu
  15. Secure personal dataedpb.europa.eu
  16. Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) – version adopted after public consultationedpb.europa.eu
  17. Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)edpb.europa.eu
  18. Principles of the GDPRcommission.europa.eu
  19. Legal grounds for processing datacommission.europa.eu
  20. Process personal data lawfullyedpb.europa.eu
  21. Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPRedpb.europa.eu
  22. Regulation (EU) 2016/679 — EUR-Lexeur-lex.europa.eu
  23. Instagram inquiry: final decisionedpb.europa.eu
  24. Guidelines 3/2019 on processing of personal data through video devicesedpb.europa.eu
  25. Regulation (EU) 2016/679 — EUR-Lexeur-lex.europa.eu
  26. Regulation (EU) 2016/679 — EUR-Lexeur-lex.europa.eu
  27. Regulation (EU) 2016/679 — Official Journal texteur-lex.europa.eu
  28. Are there any specific safeguards for data about children?commission.europa.eu
  29. Respect individuals’ rightsedpb.europa.eu
  30. Information for individualscommission.europa.eu
  31. Data protection under GDPR — Your Europeeuropa.eu
  32. The General Data Protection Regulation (GDPR) opposes two data processing practices by credit information agenciescuria.europa.eu
  33. Dealing with requests from individualscommission.europa.eu
  34. FAQ | Data protection guide for small businessedpb.europa.eu
  35. Guidelines 07/2020 on the concepts of controller and processor in the GDPRedpb.europa.eu
  36. Data controller or data processoredpb.europa.eu
  37. FAQ | Data protection guide for small businessedpb.europa.eu
  38. Application of the GDPRcommission.europa.eu
  39. Data Protection Officeredpb.europa.eu
  40. Regulation (EU) 2016/679 of the European Parliament and of the Councileur-lex.europa.eu
  41. Data protection impact assessmentedpb.europa.eu
  42. Data breachesedpb.europa.eu
  43. Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0edpb.europa.eu
  44. International data transfers | Data protection guide for small businessedpb.europa.eu
  45. Commission Implementing Decision (EU) 2023/1795eur-lex.europa.eu
  46. InfoCuria: Case C-311/18curia.europa.eu
  47. Commission Implementing Decision (EU) 2021/914eur-lex.europa.eu
  48. New Standard Contractual Clauses – Questions and Answers overviewcommission.europa.eu
  49. Data Protection Authority & youedpb.europa.eu
  50. Tasks and dutiesedpb.europa.eu
  51. Contactedpb.europa.eu
  52. Guidelines 03/2021 on the application of Article 65(1)(a) GDPRedpb.europa.eu
  53. Mere infringement of the GDPR does not give rise to a right to compensationcuria.europa.eu
  54. Guidelines 04/2022 on the calculation of administrative fines under the GDPRedpb.europa.eu
  55. Statement on restrictions on data subject rights in connection to the state of emergency in Member Statesedpb.europa.eu
  56. Federal Data Protection Act (BDSG)gesetze-im-internet.de
  57. Consolidated text: Regulation (EU) 2016/679eur-lex.europa.eu
  58. Regulation (EU) 2016/679 — English and German texteur-lex.europa.eu
  59. Commission staff working document accompanying the Digital Omnibus proposaleur-lex.europa.eu
  60. Legal Framework — European Data Protection Boardedpb.europa.eu
  61. Legal Framework — European Parliamenteuroparl.europa.eu
  62. Article 2: Scope — AI Act Service Deskai-act-service-desk.ec.europa.eu
  63. Recital 10 — AI Act Service Deskai-act-service-desk.ec.europa.eu
  64. Regulation (EU) 2022/868 (Data Governance Act)eur-lex.europa.eu
  65. Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition—two years of application of the General Data Protection Regulationeur-lex.europa.eu
  66. Second Report on the application of the General Data Protection Regulationeur-lex.europa.eu
  67. Second Report on the application of the General Data Protection Regulationeur-lex.europa.eu
  68. Second Report on the application of the General Data Protection Regulationeur-lex.europa.eu
  69. Second Report on the application of the General Data Protection Regulationeur-lex.europa.eu
  70. Regulation (EU) 2025/2518 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679eur-lex.europa.eu
  71. Regulation (EU) 2025/2518—document informationeur-lex.europa.eu
  72. Regulation (EU) 2025/2518 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679eur-lex.europa.eu
  73. Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platformsedpb.europa.eu
  74. EDPB: ‘Consent or Pay’ models should offer real choiceedpb.europa.eu
  75. Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platformsedpb.europa.eu