In this page Why Article 1 Still Matters, Even Without a Fine Attached How Courts Have Used Article 1 What This Means in Practice Related Recitals Frequently Asked Questions about Article 1 Related Key Issues and Articles Art. 1(1) This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. subject matter Art. 1(2) This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. fundamental rights objective Art. 1(3) The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data. free movement objective Official text: Regulation (EU) 2016/679, Article 1, via EUR-Lex. In shortArticle 1 states why the GDPR exists: to protect people when their personal data is processed, and to stop that protection being used as an excuse to block the free flow of data within the EU. It does not itself create an obligation a controller can breach. Instead, it is the fundamental-rights anchor that courts and regulators point to when deciding how broadly to read every other article. Chapter Chapter 1 - General provisions (Art. 1-4) Applies to Interpretive backdrop for the whole Regulation; not a standalone obligation Directly finable No. Article 1 is not an obligation-imposing provision, so no DPA has fined a controller for infringing it In force since 25 May 2018 Explained by recitals 1, 2, 3, 4, 10 Closest UK equivalent UK GDPR Art. 1 (identical wording) Why Article 1 Still Matters, Even Without a Fine Attached Article 1(2) is the line regulators and courts return to when a newer question does not have a clean answer elsewhere in the Regulation: does this reading protect the individual, or does it leave a gap in that protection? Article 1(3) does the opposite job, it stops a Member State or a company from using "data protection" as a pretext to restrict data flows within the EU for reasons that have nothing to do with protecting people. How Courts Have Used Article 1 No supervisory authority has fined a controller for breaching Article 1, because it does not impose a compliance duty of its own. What does exist is a small number of CJEU judgments that lean on Article 1's stated objective to decide how another article should be read. These are judicial interpretation, not enforcement, and the table below marks them accordingly rather than presenting them as fines. Case Court Date Role of Article 1 Meta Platforms Inc. and Others v Bundeskartellamt (C-252/21) CJEU, Grand Chamber 4 Jul 2023 Article 1's "high level of protection" objective was used to justify national competition authorities being able to assess GDPR compliance alongside data protection authorities. Discussed / relevant, not infringed. Schrems v Meta Platforms Ireland (C-446/21) CJEU 4 Oct 2024 The Court opened its reasoning by anchoring the decision in "the objective pursued by the GDPR, as is set out in Article 1 thereof and in recitals 1 and 10," before ruling on special-category data and storage limitation. Discussed / relevant, not infringed. Neither case found Article 1 itself infringed, since it is not a provision capable of being infringed in the way Article 5 or Article 6 are. Both used it as interpretive support for a ruling on a different, operative article. What This Means in Practice When a newer processing question has no clean answer elsewhere in the GDPR, expect regulators and courts to lean on Article 1(2)'s fundamental-rights framing to favour the more protective reading. Article 1(3) is why "we're protecting privacy" is not a valid reason to restrict the flow of personal data to another EU Member State; that justification only works in the other direction, against non-EU transfers under Chapter V. Recitals That Explain Article 1 (1) Data Protection as a Fundamental Right States the constitutional source Article 1(2) draws on: the protection of natural persons in relation to the processing of their personal data is a fundamental right under Article 8(1) of the EU Charter of Fundamental Rights and Article 16(1) TFEU. This is why Article 1(2) is phrased as protecting a right rather than merely regulating an industry. (2) Respect of the Fundamental Rights and Freedoms Sets the Regulation's dual ambition, matching Article 1's own two objectives: protecting fundamental rights and freedoms regardless of nationality or residence, while contributing to an area of freedom, security and justice, to the internal market, and to the well-being of natural persons. Data protection and economic integration are framed as complementary, not opposed. (3) Directive 95/46/EC Harmonisation Explains the GDPR's lineage: the 1995 Data Protection Directive already sought to harmonise fundamental-rights protection while ensuring free data flow between Member States. The GDPR inherits and strengthens that same twin aim, which is exactly what Article 1's three paragraphs restate as binding rules rather than a directive Member States could implement unevenly. (4) Data Protection in Balance with Other Fundamental Rights Qualifies Article 1(2)'s fundamental-rights framing: the right to data protection is not absolute. It must be weighed against its function in society and balanced proportionately against other rights the Charter protects, including private life, freedom of expression, freedom to conduct a business, and the right to a fair trial. This is the recital courts reach for when Article 1 is used to favour a protective reading, since it confirms that reading still has limits. (10) Harmonised Level of Data Protection Despite National Scope Grounds Article 1(3)'s free-movement guarantee: to remove obstacles to data flows within the Union, the level of protection has to be equivalent across every Member State, applied consistently rather than left to national variation. The CJEU cited this recital together with Article 1 itself in Schrems v Meta Platforms Ireland (C-446/21) when anchoring its reasoning in the Regulation's stated objective. Article 1 sets the "why" behind everything that follows: consent, transparency, security, transfer rules. If you're looking at tools to help manage that in practice, Secure Privacy's consent management platform is one place to start. Learn more about Secure Privacy Related Recitals (1) Data Protection as a Fundamental Right (2) Respect of the Fundamental Rights and Freedoms (3) Directive 95/46/EC Harmonisation (4) Data Protection in Balance with Other Fundamental Rights (10) Harmonised Level of Data Protection Despite National Scope Frequently Asked Questions about Article 1 + What is the purpose of Article 1 GDPR? Article 1 sets out the subject matter and objectives of the GDPR. It establishes rules for protecting individuals when their personal data is processed and protects the free movement of personal data within the EU. + Does the GDPR protect data or people? The GDPR protects natural persons in relation to the processing of their personal data, treating data protection as a fundamental right. It is not designed to protect data itself, but the individuals the data relates to. + Can the free movement of personal data be restricted under the GDPR? No. Article 1 states that the free movement of personal data within the EU cannot be restricted or prohibited for reasons connected with the protection of individuals regarding their data. + Has any regulator ever fined a company for breaching Article 1? No. Article 1 states the Regulation's purpose rather than imposing an obligation, so it is not a provision that can be found infringed. Courts have instead cited it to support how they interpret other, operative articles. Related Key Issues GDPR Personal Data GDPR Processing GDPR Privacy by Design

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. This Regulation does not apply to the processing of personal data: in the course of an activity which falls outside the scope of Union law; by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; by a natural person in the course of a purely personal or household activity; by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. 1For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. 2Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98. This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive. Related Recitals (13) Taking Account of Micro, Small and Medium-Sized Enterprises (14) Not Applicable to Legal Persons (15) Technology Neutrality (16) Not Applicable to Activities Regarding National and Common Security (17) Adaptation of Regulation (EC) No 45/2001 (18) Not Applicable to Personal or Household Activities (19) Not Applicable to Criminal Prosecution (20) Respecting the Independence of the Judiciary (21) Liability Rules of Intermediary Service Providers Shall Remain Unaffected (27) Not Applicable to Data of Deceased Persons Frequently Asked Questions about Article 2 + What does Article 2 GDPR cover? Article 2 defines the material scope of the GDPR. It applies to the processing of personal data wholly or partly by automated means, and to non-automated processing of data that forms part of a filing system. + What processing is excluded from the GDPR? The GDPR does not apply to processing for purely personal or household activities, by EU institutions under separate rules, for national security, or by authorities for criminal law enforcement covered by the Law Enforcement Directive. + Does the GDPR apply to paper records? Yes, but only when the paper records form part of a structured filing system. Unstructured manual notes that are not part of a filing system fall outside the material scope. Related Key Issues GDPR Personal Data GDPR Third Countries

In this page Which Territorial Trigger Applies? What Does Establishing Article 3 Applicability Actually Involve? How Regulators Have Used Article 3 Recitals That Explain Article 3 Article 3 Compliance Checklist Frequently Asked Questions about Article 3 Related Key Issues and Articles Art. 3(1) This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. establishment Art. 3(2)(a) This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing relates to the offering of goods or services, irrespective of whether a payment is required, to such data subjects in the Union. targeting — offering goods/services Art. 3(2)(b) This Regulation also applies where the processing relates to the monitoring of the behaviour of such data subjects, as far as their behaviour takes place within the Union. targeting — behavioural monitoring Art. 3(3) This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. public international law Official text: Regulation (EU) 2016/679, Article 3, via EUR-Lex. In short Article 3 decides whether the GDPR applies to a piece of processing at all, before any other article's obligations come into play. It reaches you two ways: you have an establishment in the EU (Article 3(1)), or you don't, but you're offering goods or services to people in the EU or monitoring their behaviour there anyway (Article 3(2)). This is the provision that made the GDPR a global law rather than a European one, since a company with no EU office can still be fully in scope. Chapter Chapter 1 - General provisions (Art. 1-4) Applies to Every controller or processor with an EU establishment, plus non-EU controllers/processors that target people in the EU Directly finable No. Article 3 decides whether the GDPR applies at all; fines attach to whichever substantive article (e.g. Art. 5, 6, 9) is actually infringed once scope is established In force since 25 May 2018 Explained by recitals 22, 23, 24, 25 Closest UK equivalent UK GDPR Art. 3, re-drafted post-Brexit to run from the UK's own borders instead of the EU's Which Territorial Trigger Applies? Situation Likely trigger A company incorporated and operating in an EU Member State Establishment (Art. 3(1)) A non-EU company's EU subsidiary makes the real decisions about processing Establishment (Art. 3(1)), even if the parent company itself sits outside the EU A non-EU online retailer ships to, prices in the local currency for, or otherwise targets EU customers Targeting, offering goods or services (Art. 3(2)(a)) A non-EU ad-tech or analytics provider tracks EU visitors' behaviour across the web Targeting, behavioural monitoring (Art. 3(2)(b)) A non-EU website is merely accessible to EU visitors, with no EU-directed marketing, currency, language, or shipping Outside scope; mere accessibility is not targeting under EDPB Guidelines 3/2018 An EU Member State's embassy or consular post in a non-EU country Public international law (Art. 3(3)) The EDPB's Guidelines 3/2018 (final version, 12 November 2019) is the primary interpretive source for every row above; it also sets out when a non-EU controller or processor caught by Art. 3(2) must appoint an EU representative under Art. 27. UK GDPR: a separate, overlapping scope Post-Brexit, the UK GDPR runs on its own territorial test rather than extending the EU version: it applies to UK-established controllers and, in its own Art. 3(2), to non-UK controllers offering goods or services to, or monitoring the behaviour of, people in the UK. The two regimes are independent, so a non-EU, non-UK business that targets consumers in both markets can be in scope of both GDPRs at once, each with its own supervisory authority, representative requirement, and, since the ICO enforces separately from the EU authorities, its own exposure to fines for the same underlying processing. What Does Establishing Article 3 Applicability Actually Involve? The "establishment" test looks at real, effective activity through stable arrangements, not where a company is registered on paper The "targeting" test requires actually directing activity at people in the Union; a non-EU site simply being reachable from an EU browser is not enough on its own Article 3 is assessed per processing activity, not per company; the same non-EU business can be in scope for one product and out of scope for another Getting this wrong produces no fine of its own; it's the threshold question that decides whether every other article's fines can reach you at all How Regulators Have Used Article 3 Article 3 is not itself a provision a controller "infringes" the way it infringes Article 5 or Article 6; it's the jurisdictional gate. The clearest example of it being tested is Clearview AI, where multiple authorities had to establish that Article 3(2) reached a US company with no EU establishment before they could rule on the underlying data-protection violations. Organisation Authority Date Role of Article 3 Clearview AI Inc. Garante (Italy) 10 Feb 2022 Relied on to bring a US company with no EU establishment into scope via the targeting test. The EUR 20,000,000 fine itself was for infringing Art. 5(1)(a), (b) and (e), not Article 3. Clearview AI Inc. Hellenic DPA (Greece) 13 Jul 2022 Same jurisdictional role. The EUR 20,000,000 fine centred on Art. 5(1)(a), with Article 3 listed as part of the applicable legal framework rather than an infringed provision. All Clearview AI enforcement cases → Recitals That Explain Article 3 (22) Processing by an Establishment Confirms the Regulation applies to processing by an establishment in the Union, regardless of whether the processing itself happens inside or outside the EU. (23) Applicable to Controllers/Processors Not Established in the Union if Data Subjects Within the Union are Targeted Sets out the offering-of-goods-or-services trigger and the factors relevant to showing that EU consumers were being targeted. (24) Applicable to Controllers/Processors Not Established in the Union if Data Subjects Within the Union are Profiled Explains the behavioural-monitoring trigger, including profiling used to predict preferences or attitudes. (25) Applicable to Controllers Due to International Law Covers the public-international-law basis, such as a Member State's diplomatic or consular posts abroad. Article 3 Compliance Checklist Map each processing activity separately against Art. 3(1) and Art. 3(2); don't make one scope determination for the whole company If you're in scope only via Art. 3(2), appoint an EU representative under Art. 27 unless a public-authority or occasional-low-risk-processing exemption applies Treat EU-directed currency, language, shipping, and advertising as evidence of "targeting" under the EDPB's guidance, not just an EU-facing payment option Re-run the Article 3 analysis whenever a new market, feature, or data flow launches; scope follows the activity, not the date of incorporation Once a processing activity is in scope, the ongoing work is keeping proof of it, which consent banner ran where, at what version. That's the kind of per-market record-keeping a consent management platform like Secure Privacy is built to handle. Learn more about Secure Privacy Related Recitals (22) Processing by an Establishment (23) Applicable to Controllers/Processors Not Established in the Union if Data Subjects Within the Union are Targeted (24) Applicable to Controllers/Processors Not Established in the Union if Data Subjects Within the Union are Profiled (25) Applicable to Controllers Due to International Law Frequently Asked Questions about Article 3 + Who does the GDPR apply to? The GDPR applies to organisations established in the EU that process personal data, and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. + Does the GDPR apply to companies outside the EU? Yes. Under Article 3, a non-EU company is covered if it targets individuals in the EU with goods or services, or monitors the behaviour of people located in the EU, regardless of where the company is based. + What is the extraterritorial scope of the GDPR? Extraterritorial scope means the GDPR can apply beyond EU borders. If a business outside the EU processes the personal data of people in the EU in connection with offering goods, services, or behaviour monitoring, it must comply. + Has a company ever been fined specifically for breaching Article 3? No. Article 3 decides whether the GDPR applies, it isn't itself a provision that gets infringed. Regulators cite it to establish jurisdiction over a non-EU company, then fine that company under whichever substantive article, such as Article 5 or Article 6, its processing actually breached. Related Key Issues GDPR Processing GDPR Data Protection Officer

For the purposes of this Regulation: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future; ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person; ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis; ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; 1‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. 2However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing; ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data; ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed; ‘genetic data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question; ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data; ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; ‘main establishment’ means: as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment; as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation; ‘representative’ means a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation; ‘enterprise’ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity; ‘group of undertakings’ means a controlling undertaking and its controlled undertakings; ‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity; ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51; ‘supervisory authority concerned’ means a supervisory authority which is concerned by the processing of personal data because: the controller or processor is established on the territory of the Member State of that supervisory authority; data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing; or a complaint has been lodged with that supervisory authority; ‘cross-border processing’ means either: processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State. ‘relevant and reasoned objection’ means an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union; ‘information society service’ means a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 of the European Parliament and of the Council (¹); ‘international organisation’ means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries. ¹ Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services (OJ L 241, 17.9.2015, p. 1). Related Recitals (15) Technology Neutrality (24) Applicable to Controllers/Processors Not Established in the Union if Data Subjects Within the Union are Profiled (26) Not Applicable to Anonymous Data (28) Introduction of Pseudonymisation (29) Pseudonymisation at the Same Controller (30) Online Identifiers for Profiling and Identification (31) Not Applicable to Public Authorities in Connection with Their Official Tasks (34) Genetic Data (35) Health Data (36) Determination of the Main Establishment (37) Group of undertakings Frequently Asked Questions about Article 4 + What is personal data under Article 4 GDPR? Personal data is any information relating to an identified or identifiable natural person. This includes names, identification numbers, location data, online identifiers, and factors specific to a person's identity. + What is the difference between a controller and a processor? A controller determines the purposes and means of processing personal data, while a processor acts on the controller's behalf and instructions. Article 4 provides the legal definitions for both roles. + What does 'processing' mean in the GDPR? Processing covers almost any operation performed on personal data, including collection, storage, use, disclosure, alteration, and erasure, whether carried out by automated means or manually. Related Key Issues GDPR Encryption GDPR Records of Processing Activities

  Art. 5(1) Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject lawfulness, fairness and transparency (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes purpose limitation (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed data minimisation (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay accuracy (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject storage limitation (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures integrity and confidentiality Art. 5(2) The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 accountability In shortArticle 5 GDPR sets the seven principles every organisation must follow when handling personal data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Breaching Article 5 carries the highest GDPR fine tier – up to €20 million or 4% of global annual turnover. Chapter Chapter 2 – Principles (Art. 5–11) Applies to Every controller processing personal data of people in the EU/EEA; processors indirectly via Art. 28 Maximum fine €20.000.000 or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)(a)) In force since 25 May 2018 Explained by recitals 39, 40 Closest UK equivalent UK GDPR Art. 5 (identical wording) The seven principles of Article 5 explained Article 5(1) lists six principles and Article 5(2) adds accountability, making seven in total. Each principle imposes a concrete obligation on the controller. Principle What it means What you must have in place 1. Lawfulness, fairness, transparency Art. 5(1)(a) Every processing activity needs a legal basis (Art. 6) and people must be told about it in plain language. Documented legal basis per activity; privacy notice meeting Art. 13/14 2. Purpose limitation Art. 5(1)(b) Collect data for a stated purpose; do not reuse it for something incompatible. Purpose recorded per activity in the ROPA (Art. 30); compatibility test for new uses 3. Data minimisation Art. 5(1)(c) Only collect and keep the data actually needed for the purpose. Field-level review of forms and systems; justification for each data category 4. Accuracy Art. 5(1)(d) Keep data correct and current; fix or delete inaccurate data promptly. Rectification process (Art. 16); periodic data quality checks 5. Storage limitation Art. 5(1)(e) Do not keep identifiable data longer than the purpose requires. Retention schedule with deletion triggers, applied per system 6. Integrity and confidentiality Art. 5(1)(f) Protect data against loss, misuse and unauthorised access. Security measures under Art. 32; access control; breach procedure (Art. 33) 7. Accountability Art. 5(2) The controller must be able to prove compliance with all of the above. ROPA, DPIAs, policies, training records, DPO where required (Art. 37) Fines issued under Article 5 Article 5 is the most-cited article in GDPR enforcement because almost every breach also violates a principle. Selected decisions: Organisation Authority Date Fine Principle breached Clearview AI CNIL (France) Oct 2022 €20.000.000 Lawfulness – facial images scraped without legal basis Meta Platforms Ireland DPC (Ireland) May 2023 €1.200.000.000 Lawfulness – transfers to the US without adequate safeguards Free Mobile CNIL (France) Dec 2022 €300.000 Integrity and confidentiality; accuracy Deutsche Wohnen Berlin DPA (Germany) Oct 2019 €14.500.000 Storage limitation – tenant data kept without deletion routine All Article 5 enforcement cases Recitals that explain Article 5 Recitals are not binding, but courts and authorities use them to interpret the article. Recital 39 – Principles of data processing Explains transparency, minimisation, storage limitation and security, and requires that processing be "reasonably expected" by the data subject. Recital 40 – Lawfulness of data processing Confirms that processing is lawful only with consent or another legal basis set out in the Regulation or in EU/Member State law. What Article 5 requires in practice Under Art. 5(2) the controller must be able to demonstrate compliance. Supervisory authorities typically expect the following documentation: Maintain a record of processing activities (ROPA) with purpose, legal basis, data categories and retention per activity Publish a privacy notice that matches the ROPA Run a DPIA for high-risk processing (Art. 35) Apply a retention schedule with automated deletion Document security measures and test them Keep evidence: policies, training logs, DPIA outcomes, vendor DPAs   Related Recitals (39) Principles of Data Processing (40) Lawfulness of Data Processing Article 5 Enforcement Cases Clearview AI GDPR Fines Free Mobile's €27M Fine Meta's Four Article 5 Fines Deutsche Wohnen's €14.5M Fine Frequently Asked Questions about Article 5 + What are the seven principles of the GDPR? Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. The first six are in Article 5(1)(a)–(f), the seventh in Article 5(2). + What is data minimisation under Article 5? Data minimisation (Art. 5(1)(c)) requires personal data to be adequate, relevant and limited to what is necessary for the stated purpose. In practice: do not collect a field you cannot justify. +What is the maximum fine for breaching Article 5? Up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(5)(a)). Article 5 sits in the upper fine tier. +Does Article 5 apply to processors? Article 5 addresses controllers. Processors are bound indirectly through the Article 28 contract and directly through Article 32 (security). Authorities have fined processors for security failures that also breached Art. 5(1)(f). +How is Article 5 different from Article 6? Article 5 sets the principles; Article 6 lists the six legal bases that satisfy the "lawfulness" principle in Art. 5(1)(a). You need both: a legal basis under Art. 6 and compliance with all seven principles under Art. 5. +How long can personal data be stored under Article 5? No fixed period. Art. 5(1)(e) requires deletion or anonymisation once the purpose is fulfilled, unless a legal retention obligation applies. Controllers must set and document a retention period per purpose. Related Key Issues GDPR Right to be Informed GDPR Privacy by Design GDPR Encryption

Art. 6(1) Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes — consent (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract — contract (c) processing is necessary for compliance with a legal obligation to which the controller is subject — legal obligation (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person — vital interests (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller — public task (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child — legitimate interests. Point (f) does not apply to processing carried out by public authorities in the performance of their tasks. Art. 6(2) Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1. Art. 6(3) The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by Union law or Member State law to which the controller is subject. The purpose of the processing shall be determined in that legal basis. That legal basis shall meet an objective of public interest and be proportionate to the legitimate aim pursued. Art. 6(4) Where processing for a purpose other than that for which the data was collected is not based on consent or a necessary and proportionate Union/Member State law, the controller shall take into account: any link between the purposes; the context of collection; the nature of the data (especially special categories under Art. 9 or criminal data under Art. 10); the possible consequences for data subjects; and the existence of appropriate safeguards such as encryption or pseudonymisation. In short Article 6 sets out the six lawful bases for processing personal data — consent, contract, legal obligation, vital interests, public task, and legitimate interests. At least one must apply before any processing can take place at all; it's the operational backbone of Article 5(1)(a)'s "lawfulness" principle. Getting Article 6 wrong is one of the most heavily fined categories of GDPR breach, because almost nothing else can be compliant if the underlying basis isn't. Chapter Chapter 2 – Principles (Art. 5–11) Applies to Every controller processing personal data of people in the EU/EEA; processors indirectly via Art. 28 Maximum fine €20.000.000 or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)(a)) In force since 25 May 2018 Explained by recitals 40, 41, 42, 43, 44, 45, 46, 47 Closest UK equivalent UK GDPR Art. 6 (identical wording) Which Legal Basis Applies to My Processing? Article 6 doesn't rank the six bases — none is a "default" — but in practice most processing activities map cleanly onto one: Situation Likely basis User explicitly opts in to a marketing newsletter Consent (6(1)(a)) Processing needed to deliver a service the customer signed up for Contract (6(1)(b)) Retaining invoices for a statutory tax or accounting period Legal obligation (6(1)(c)) Sharing a person's medical data in a genuine emergency Vital interests (6(1)(d)) A public authority processing data to carry out its official duties Public task (6(1)(e)) — unavailable to private companies Fraud prevention, network security, or internal analytics not required by any contract Legitimate interests (6(1)(f)), subject to a documented balancing test What Does Choosing a Legal Basis Actually Involve? Picking a basis isn't a one-time checkbox — the choice has consequences that follow the processing for as long as it continues: It determines what rights the data subject has — the right to object works differently under legitimate interest than under consent, and doesn't apply to contract or legal-obligation processing at all It has to be identified before processing starts, not retrofitted after a complaint or an audit Switching bases mid-processing for the same purpose — for example, moving to legitimate interest once someone withdraws consent — is generally not permitted It must be documented and defensible in a ROPA entry, not just technically available as an option Both cases below show what happens when a basis is chosen for convenience rather than tested against these requirements. GDPR Article 6 Fines: Enforcement Cases and Amounts Article 6 is cited whenever a controller's real problem is that no valid legal basis existed for the processing at all — sometimes as the sole finding, sometimes as one line item within a larger multi-article decision. Organisation Authority Date Fine Meta Platforms Ireland DPC (Ireland) Jan 2023 €390.000.000 H&M Germany Hamburg DPA (Germany) Oct 2020 €35.300.000 (Art. 6 portion) Clearview AI (full case under Art. 5) CNIL (France) Oct 2022 €20.000.000 (of a larger multi-country total) All Article 6 enforcement cases → Recitals That Explain Article 6 Recital 40 – Lawfulness of Data Processing Confirms processing is lawful only with consent or another legal basis set out in the Regulation or in EU/Member State law. Recital 41 – Legal Basis or Legislative Measures Clarifies that a legal basis under Art. 6(1)(c) or (e) doesn't need to be a specific statute for every individual processing operation. Recital 42 – Burden of Proof and Requirements for Consent Places the burden on the controller to demonstrate consent was given, and requires it to be distinguishable and in an intelligible, accessible form. Recital 43 – Freely Given Consent Explains why consent is not freely given where there's a clear imbalance of power, such as with public authorities, or where separate consents can't be given for separate processing operations. Recital 44 – Performance of a Contract Confirms the contract basis applies where processing is necessary to enter into or perform a contract with the data subject. Recital 45 – Fulfillment of Legal Obligations Confirms the law relied on for the legal-obligation or public-task bases should specify the purpose of processing, without requiring a dedicated law for every operation. Recital 46 – Vital Interests of the Data Subject Frames the vital-interests basis as fundamentally for life-or-death, humanitarian situations, generally used only when no other basis is available. Recital 47 – Overriding Legitimate Interest Explains the balancing test behind Art. 6(1)(f) and why it doesn't apply to public authorities. Article 6 Compliance Checklist Document which of the six bases applies to each processing activity in the ROPA (Art. 30) Never stack multiple legal bases for the same processing purpose, or switch bases after the fact For legitimate interest, complete and retain a documented balancing test (LIA) before relying on it For consent, ensure it's freely given, specific, informed, and as easy to withdraw as to give Re-assess the basis whenever the purpose of processing changes For bases (c) or (e), identify the specific Union or Member State law being relied upon Related Recitals (40) Lawfulness of Data Processing (47) Overriding Legitimate Interest Article 6 Enforcement Cases Meta Platforms Ireland H&M Germany Frequently Asked Questions about Article 6 + What are the six lawful bases for processing under the GDPR? Article 6 sets six lawful bases: consent, performance of a contract, legal obligation, vital interests, public task, and legitimate interests. At least one must apply for processing to be lawful. + Do I always need consent to process personal data? No. Consent is only one of six lawful bases. Processing can also be lawful when it is necessary for a contract, a legal obligation, vital interests, a public task, or legitimate interests. + What is legitimate interest under the GDPR? Legitimate interest is a lawful basis that allows processing when an organisation has a genuine interest that is not overridden by the individual's rights and freedoms. A balancing test must be documented. + Can you rely on more than one legal basis for the same processing? No — each processing activity needs one clearly identified basis, decided in advance and documented in the ROPA, not stacked or switched after the fact. + How is Article 6 different from Article 9? Article 6 sets the six general bases required for any processing. Article 9 adds a stricter second layer for special categories — health, religion, biometric data — requiring both an Article 6 basis and a separate Article 9 condition. Related Key Issues GDPR Consent GDPR Processing

  In this page Key Facts Is This Consent Actually Valid? Who Proves the Consent When Someone Else Collected It? GDPR Article 7 Fines: Enforcement Cases and Amounts Recitals That Explain Article 7 Article 7 Compliance Checklist Frequently Asked Questions about Article 7 Related Key Issues and Articles Art. 7(1) Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data. demonstrable Art. 7(2) If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. clearly distinguishable Art. 7(3) The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. withdrawable Art. 7(4) When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. freely given In short Article 7 does not create a legal basis. It is the quality control on one. Consent is a lawful basis under Article 6(1)(a) and is defined in Article 4(11) as freely given, specific, informed and unambiguous. Article 7 then says what a controller must be able to prove, how the request must be presented, how withdrawal has to work, and when a consent was never free in the first place. The practical consequence is that an organisation can have a banner, a signed form and a stored timestamp and still have no valid consent. Almost every large consent-related fine in Europe turns on one of Article 7's four paragraphs rather than on whether a box was clicked. Key Facts Chapter Chapter 2 – Principles (Art. 5–11) Applies to Every controller relying on consent, including where consent is collected on its behalf by a partner or publisher Maximum fine €20.000.000 or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)(a)) In force since 25 May 2018 Explained by recitals 32, 33, 42, 43 Depends on Art. 4(11) for the definition of consent, Art. 6(1)(a) for its status as a basis Stricter variant Art. 9(2)(a) requires explicit consent for special category data Closest UK equivalent UK GDPR Art. 7, identical wording Is This Consent Actually Valid? The four qualities in Article 4(11) are what regulators test. Article 7 supplies the evidence and design rules that make each of them hold or fail. Quality required What typically breaks it Governing provision Freely given Access to the service is conditional on processing that is not needed to deliver it, or there is a power imbalance such as employer and employee Art. 7(4), Recital 43 Specific One action covers several distinct purposes, or granular choices sit behind a secondary screen while the top-level option stays bundled Art. 7(2), Recital 32 Informed The request is buried inside a long privacy policy rather than presented distinguishably, so the user cannot tell what they agreed to Art. 7(2), Art. 13 Unambiguous Pre-ticked boxes, continued scrolling, silence or inactivity treated as agreement Art. 4(11), Recital 32 Demonstrable No record linking a named person to a named purpose at a given time, or reliance on a partner's assurance that consent was collected Art. 7(1) Withdrawable Withdrawal stops the visible effect but not the underlying processing, or takes more steps than giving consent did Art. 7(3) Who Proves the Consent When Someone Else Collected It? This is the judgment call that catches adtech, app publishers, lead generators and anyone in a data supply chain. The controller relying on the consent carries the Article 7(1) burden even when it never met the user. Arrangement Who must demonstrate consent What that means in practice You collect consent directly You Keep the record: identity, purpose, timestamp, exact wording shown, and the version of the notice A publisher or partner collects it and you process on the strength of it Still you, as controller of your own processing A clause requiring the partner to obtain consent is not enough. You need a contractual right to demand proof on request, and evidence you have exercised it You and the partner jointly determine purposes and means Both, under an Art. 26 arrangement The arrangement must allocate who informs the user and who handles requests, and its essence must be available to data subjects A processor collects consent on documented instructions You, as controller The Art. 28 contract governs the processing, but the Art. 7(1) evidential burden stays with you GDPR Article 7 Fines: Enforcement Cases and Amounts Article 7 appears in enforcement in two distinct ways. Sometimes an authority makes an express finding under a numbered paragraph, as the CNIL did against Criteo. More often the operative finding sits under Article 6 or Article 9, with Article 7's conditions supplying the reason the consent was worthless. Criteo is the only decision in this table with express Article 7 findings. In Grindr the operative findings are under Articles 6(1) and 9(1), with Article 7 supplying the reasoning. Meta and Google are listed because they are routinely cited in Article 7 discussions, and each is documented at its own source below the table. Organisation Authority Decision date Fine Criteo SA CNIL (France) 15 Jun 2023 €40.000.000 Grindr LLC Datatilsynet (Norway) 13 Dec 2021 NOK 65.000.000, approx. €6.500.000 Meta Platforms Ireland DPC (Ireland) 31 Dec 2022 €390.000.000 Google LLC CNIL (France) 21 Jan 2019 €50.000.000 The Meta Platforms Ireland decision is documented in full under Article 6; its Article 7 relevance is the Art. 7(4) principle that service access cannot be conditioned on processing that is not necessary for the service. The Google LLC decision rested on Articles 6, 12 and 13, not Article 7, but is the leading European statement that pre-ticked boxes and buried granular options defeat consent. All Article 7 enforcement cases → Recitals That Explain Article 7 Recital 32 – Conditions for Consent Sets out what a clear affirmative act looks like. It expressly rules out silence, pre-ticked boxes and inactivity, and requires consent to cover all processing carried out for the same purpose. Where processing serves multiple purposes, consent should be given for each of them. Recital 33 – Consent to Certain Areas of Scientific Research Recognises that the purpose of scientific research often cannot be fully specified at the point of collection, and allows consent to certain areas of research where recognised ethical standards are observed. This is a narrow accommodation for research, not a general licence to describe purposes vaguely. Recital 42 – Burden of Proof and Requirements for Consent Places the evidential burden squarely on the controller and requires a written declaration drafted by the controller to be intelligible and easily accessible, in clear and plain language. It also states that the data subject should know the controller's identity and the purposes, and should be able to withdraw without detriment. Recital 43 – Freely Given Consent Explains why consent fails where there is a clear imbalance between the data subject and the controller, notably where the controller is a public authority. It also says consent is presumed not freely given where separate consents cannot be given for separate processing operations, or where performance of a contract is made dependent on consent that is not necessary for it. Article 7 Compliance Checklist Record, for every consent, who gave it, for which purpose, when, and the exact wording and version of the notice they saw Present the consent request separately from the terms of service and privacy policy, not as a paragraph inside them Offer a genuine per-purpose choice on the first screen, not behind a secondary options page Make the withdrawal path no longer and no harder than the path that granted consent, and surface it in the account or preference centre Ensure withdrawal stops the processing rather than only its visible output, and propagates to downstream recipients under Art. 19 Check whether the service can be delivered without the processing. If it can, do not condition access on consent to it Where a partner collects consent for you, secure a contractual right to proof on demand and audit against it periodically Do not re-use a consent given for one purpose to justify another, and do not switch to legitimate interests after withdrawal For special category data, confirm the consent is explicit as Art. 9(2)(a) requires, which is a higher bar than Art. 7 alone Log the consent basis against each processing activity in the Art. 30 record Every item above is easier to keep true when the consent banner, the per-purpose toggles, and the audit log run off the same system, rather than three tools that don't talk to each other. Secure Privacy's consent management platform is one way to get there. Learn more about Secure Privacy Related Recitals (32) Conditions for Consent (33) Consent to Certain Areas of Scientific Research (42) Burden of Proof and Requirements for Consent (43) Freely Given Consent Article 7 Enforcement Cases Criteo's €40M Fine Grindr's NOK 65M Fine All Article 7 cases Frequently Asked Questions about Article 7 + What are the conditions for valid consent under the GDPR? Consent must be freely given, specific, informed and unambiguous under Article 4(11). Article 7 adds four operational conditions: the controller must be able to demonstrate it, the request must be clearly distinguishable from other matters, withdrawal must be as easy as giving, and consent is not free where service access is conditioned on processing that is not necessary for the service. + What counts as proof of consent under Article 7(1)? A record tying a named individual to a named purpose at a given moment, together with the wording and version of the request they saw. A general statement that a consent banner was in use does not satisfy Article 7(1), and neither does a contractual promise from a partner that consent was collected. The CNIL made exactly this point against Criteo. +Can consent be withdrawn under the GDPR? Yes, at any time, and the user must be told so before consenting. Withdrawal does not make earlier processing unlawful, but it must stop the processing going forward. Continuing to hold and use identifiers while switching off only the visible output was one ground for the Criteo fine. +Is a cookie banner enough to comply with Article 7? Not on its own. A banner is only the collection mechanism. Article 7 governs what it has to offer, whether the choice was real, whether the record survives, and whether withdrawal works afterwards. Many banners that look compliant fail on withdrawal or on the evidential record rather than on the first screen. +Does Article 7 apply if a partner collected the consent? Yes. The controller relying on the consent carries the burden of demonstrating it, whoever was in front of the user. That was the central holding against Criteo, which relied on more than 40.000 partner websites to collect consent for its retargeting cookie and could not produce proof of any of it. +How is Article 7 consent different from explicit consent under Article 9? Article 7 sets the baseline for any consent. Article 9(2)(a) requires explicit consent before special category data such as health, religion, biometric data or sexual orientation can be processed. Explicit means a clear affirmative statement directed at that specific category, which in practice is a higher bar. A single consent to a general privacy policy will rarely satisfy it. Related Key Issues GDPR Email Marketing GDPR Right to be Informed

1Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. 2Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. 3Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child. Related Recitals (38) Special Protection of Children’s Personal Data Frequently Asked Questions about Article 8 + What age can a child consent to data processing under the GDPR? Under Article 8, children can consent to online services from age 16, though member states may lower this to no younger than 13. Below that age, parental consent or authorisation is required. + Do online services need parental consent for children? Yes. When offering information society services directly to a child below the applicable age, the controller must obtain consent from the holder of parental responsibility and make reasonable efforts to verify it. + Does Article 8 apply to all processing of children's data? No. Article 8 applies specifically to consent-based online services offered directly to children. Other lawful bases and protections for children's data still apply outside this scenario. Related Key Issues GDPR Right to be Informed GDPR Privacy by Design

Art. 9(1) Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. Art. 9(2) Paragraph 1 shall not apply if one of the following applies: the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject — explicit consent processing is necessary for carrying out obligations and exercising specific rights in the field of employment and social security and social protection law, in so far as authorised by Union or Member State law or a collective agreement providing appropriate safeguards — employment, social security and social protection law processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent — vital interests processing is carried out in the course of legitimate activities, with appropriate safeguards, by a foundation, association or other not-for-profit body with a political, philosophical, religious or trade union aim, limited to members, former members, or persons with regular contact connected to its purposes, and not disclosed outside that body without consent — not-for-profit body activities processing relates to personal data which are manifestly made public by the data subject — manifestly made public processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity — legal claims processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law proportionate to the aim pursued — substantial public interest processing is necessary for preventive or occupational medicine, working-capacity assessment, medical diagnosis, health or social care provision or management, on the basis of Union or Member State law or pursuant to a contract with a health professional — health and social care processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border health threats or ensuring quality and safety standards for health care, medicinal products or medical devices — public health processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) — archiving, research and statistics Art. 9(3) Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when processed by or under the responsibility of a professional subject to an obligation of professional secrecy under Union or Member State law or rules established by national competent bodies, or by another person also subject to such an obligation of secrecy. Art. 9(4) Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health. In short Article 9 places a blanket ban on processing "special category" data, health, genetic, biometric, racial or ethnic origin, political opinions, religious belief, trade union membership, and sex life or sexual orientation data, unless one of ten specific conditions applies on top of an ordinary Article 6 basis. It is a second, stricter layer of the lawfulness test, not a substitute for it, and it is one of the few GDPR provisions where an inferred or indirectly revealed characteristic (for example, that someone uses an app aimed at a particular community) has been found by regulators to trigger the same protection as data stated outright. Chapter Chapter 2 – Principles (Art. 5–11) Applies to Every controller processing special category data of people in the EU/EEA; processors indirectly via Art. 28 Maximum fine €20.000.000 or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)(a)) In force since 25 May 2018 Explained by recitals 51, 52, 53, 54, 55, 56 Closest UK equivalent UK GDPR Art. 9, read together with Schedule 1 of the Data Protection Act 2018 Which Article 9 Condition Applies to My Processing? Article 9 does not rank its ten conditions, none is a default, and every one of them still needs a separate Article 6 basis sitting alongside it: Situation Likely condition A user explicitly ticks a box to share their health data with a wellness app Explicit consent (9(2)(a)) An employer records a disability accommodation required under national employment law Employment, social security and social protection law (9(2)(b)) A hospital treats an unconscious patient without the ability to obtain consent Vital interests (9(2)(c)) A trade union processes its own members' union-membership records Not-for-profit body activities (9(2)(d)) A public figure discusses their own health condition in a published interview Manifestly made public (9(2)(e)) A law firm processes a client's medical records to run a personal injury claim Legal claims (9(2)(f)) A GP practice processes patient records to provide treatment Health and social care (9(2)(h)) A university processes anonymised health records for a public-interest research study Archiving, research and statistics (9(2)(j)) What Does Relying on an Article 9 Condition Actually Involve? Picking a condition is not a one-time checkbox, and Article 9 is stricter than Article 6 in several concrete ways: An Article 9 condition is always needed in addition to an Article 6 basis, not instead of one, both must be identified and documented before processing starts Consent under 9(2)(a) must be "explicit," a higher bar than the ordinary consent standard under Article 7, it cannot be inferred from silence, pre-ticked boxes, or continued use of a service Special category data can be revealed indirectly. Regulators have found that data which discloses a characteristic by strong inference, rather than stating it outright, can still fall within Article 9(1) Several conditions, points (b), (g), (h), (i) and (j), only apply where a specific Union or Member State law provides for them, a generic business justification is not enough on its own It must be documented and defensible in a ROPA entry (Art. 30), alongside the Article 6 basis it sits next to GDPR Article 9 Fines: Enforcement Cases and Amounts Article 9 is cited whenever the data at issue is a special category, health, biometric, or in Grindr's case, data that strongly indicates sexual orientation, and no valid Article 9(2) condition covered the processing. Organisation Authority Date Fine Grindr LLC Datatilsynet (Norway) Dec 2021 NOK 65.000.000 (approx. €5.5M–€6.5M) Clearview AI (full case under Art. 5) Autoriteit Persoonsgegevens (Netherlands) May 2024 €30.500.000 (Art. 9 cited alongside Art. 5 and 6) All Article 9 enforcement cases → Recitals That Explain Article 9 Recital 51 – Protecting Sensitive Personal Data Explains that data revealing especially sensitive characteristics deserves specific protection, since the context of its processing could create significant risks to fundamental rights and freedoms. Recital 52 – Exceptions to the Prohibition on Processing Special Categories of Personal Data Confirms that derogations from the Article 9 prohibition should be allowed only where justified by an important public interest and accompanied by suitable safeguards. Recital 53 – Processing of Sensitive Data in Health and Social Sector Frames processing for health and social care purposes as serving the public interest, and ties it to safeguards such as professional secrecy obligations. Recital 54 – Processing of Sensitive Data in Public Health Sector Allows processing without the data subject's consent for public health reasons, provided it remains under the control of professionals bound by secrecy obligations. Recital 55 – Public Interest in Processing by Official Authorities for Objectives of Recognized Religious Communities Confirms that processing by official authorities for objectives recognised by constitutional law or public international law is a permitted public-interest ground. Recital 56 – Processing Personal Data on People's Political Opinions by Parties Permits political parties to process data on people's political opinions in the course of electoral activities, subject to appropriate safeguards for fundamental rights. Article 9 Compliance Checklist Identify both an Article 6 basis and a separate Article 9(2) condition before any special category processing begins, and document both in the ROPA For consent, confirm it meets the higher "explicit" standard, not just the ordinary Article 7 standard Review whether data that is not itself a special category could still reveal one by strong inference, membership of a niche-audience app or service is a documented example Where a condition depends on a specific Union or Member State law (points b, g, h, i, j), identify that law by name rather than relying on a general business justification For health data processed under 9(2)(h), confirm the processor is bound by professional secrecy as required by 9(3) Check for Member State add-on conditions under 9(4) for genetic, biometric or health data relevant to your jurisdiction Related Recitals (46) Vital Interests of the Data Subject (51) Protecting Sensitive Personal Data (52) Exceptions to the Prohibition on Processing Special Categories of Personal Data (53) Processing of Sensitive Data in Health and Social Sector (54) Processing of Sensitive Data in Public Health Sector (55) Public Interest in Processing by Official Authorities for Objectives of Recognized Religious Communities (56) rocessing Personal Data on People’s Political Opinions by Parties Article 9 Enforcement Cases Grindr LLC (Norway, NOK 65M) Clearview AI (full case under Art. 5) Frequently Asked Questions about Article 9 + What are special categories of personal data under the GDPR? Special categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health data, and data on a person's sex life or sexual orientation. + Is it illegal to process sensitive personal data under the GDPR? Processing special category data is prohibited by default, but Article 9 lists exceptions such as explicit consent, employment law obligations, vital interests, and substantial public interest grounds. + What lawful conditions allow processing of health data? Health data can be processed where there is explicit consent, a need for medical care or diagnosis, public health interests, or other Article 9 conditions, usually alongside an Article 6 lawful basis. + How is Article 9 different from Article 6? Article 6 sets the six general bases required for any processing. Article 9 adds a stricter second layer for special categories, health, religion, biometric data, requiring both an Article 6 basis and a separate Article 9 condition. + Can data reveal a special category even if it is not stated directly? Yes. Norway's data protection authority found that a person's use of a dating app aimed at a specific sexual minority strongly indicated their sexual orientation, and treated that inference as special category data under Article 9, even though no one explicitly stated their orientation. Related Key Issues GDPR Encryption GDPR Data Protection Officer

In this page Key Facts What Article 10 Actually Restricts Article 10 vs Article 9: Which Applies? The Two Gateways: Official Authority or Member State Law What Typically Breaks Lawful Criminal-Data Processing GDPR Article 10 Fines: Enforcement Cases and Amounts Recitals That Explain Article 10 Article 10 Compliance Checklist Frequently Asked Questions about Article 10 Related Key Issues and Articles Art. 10, s.1 Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority, or when authorised by Union or Member State law providing appropriate safeguards for the rights and freedoms of data subjects. official authority or specific law Art. 10, s.2 Any comprehensive register of criminal convictions shall be kept only under the control of official authority. comprehensive registers In short Article 10 is easy to misread as a short list of special-category data bolted onto Article 9. It isn't. It sits in its own article, outside Article 9's consent-based exceptions, and it is stricter in one specific way: consent alone is never enough. A private company needs either official-authority status (which most companies don't have) or a specific national law authorising the processing with appropriate safeguards. Both enforcement cases below concern private employers processing criminal-record data about people they wanted to hire or already employed — and both regulators found that "the candidate agreed to it" or "our business needs to know" isn't the kind of legal basis Article 10 asks for. One of those findings was later overturned on appeal, which is itself instructive: even courts disagree about exactly what falls inside Article 10's scope. Key Facts Chapter Chapter 2 – Principles relating to processing of personal data (Art. 5–11) Applies to Any controller or processor handling data about criminal convictions, offences, or related security measures — not only courts, police or prosecutors Maximum fine Article 10 isn't explicitly named in either tier of Art. 83. In practice, authorities anchor Art. 10 findings to the linked Art. 6(1) lawfulness violation, which puts the exposure at the upper tier: €20.000.000 or 4% of worldwide annual turnover In force since 25 May 2018 Basis for lawfulness Still requires an ordinary Art. 6(1) ground on top of an Art. 10 gateway; the two requirements are cumulative, not alternatives Depends on Member State law for the specific authorisations that let a private actor process this data at all; these vary significantly across the EU/EEA Companion provision Art. 9 covers a different, listed set of special categories with its own, broader set of exceptions including explicit consent Closest UK equivalent UK GDPR Art. 10, read together with Section 10 and Schedule 1 of the Data Protection Act 2018 What Article 10 Actually Restricts Article 10 covers more than final convictions. It extends to criminal offences, allegations, pending proceedings, and related security measures — any data that reveals something about a person's involvement, alleged or established, with the criminal justice system. Final convictions and sentences Ongoing criminal proceedings and unproven allegations Related security measures, such as measures ordered instead of or alongside a conviction Documents that reveal an absence of convictions, such as a "certificate of good conduct" — though as the Amazon Road Transport case below shows, this specific point is genuinely contested in the courts The second sentence of Article 10 adds a separate, narrower rule: a comprehensive register of criminal convictions — the kind of central database a country's justice ministry keeps — may only be maintained under the control of official authority, full stop, regardless of any Member State law that might otherwise authorise narrower private processing. Article 10 vs Article 9: Which Applies? Article 9 (special categories) Article 10 (criminal data) Covers Racial/ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data, health, sex life and sexual orientation Criminal convictions, offences, allegations and related security measures Default position Processing is prohibited unless an Art. 9(2) exception applies Processing is restricted to official authority or a specific Member State/Union law authorisation Can consent alone unlock it? Yes — explicit consent is one of the listed Art. 9(2) exceptions No — consent isn't listed as a basis in Article 10 itself; some Member States allow it only as part of a specific national authorisation Who can rely on the private-sector exceptions Any controller that meets one of the ten Art. 9(2) conditions Only controllers acting under official authority, or under a specific enabling law — a materially smaller set The practical consequence: a company that has correctly built an Art. 9 compliance process for, say, health data on sick leave, cannot assume the same process (consent forms, legitimate-interest assessments) works for criminal-record data. Article 10 asks a different, narrower question first: is there a law that lets you process this at all. The Two Gateways: Official Authority or Member State Law Article 10 gives exactly two routes to lawful processing, and most private companies only have access to one of them, if that. Gateway Who can use it Example Official authority Courts, police, prosecutors, and bodies exercising a public function established by law A national police force maintaining its own criminal records for law enforcement purposes Specific Union or Member State law Private controllers, but only where their own country's law specifically authorises the processing and sets appropriate safeguards A national law requiring background checks for roles involving contact with children, with a defined retention period and access controls Because the second gateway depends entirely on national law, the answer to "can we run criminal record checks on candidates" differs by country and sometimes by role. Both cases below turned on Spanish and French law specifically saying "no" to a private employer's chosen basis — not on Article 10's own wording alone. What Typically Breaks Lawful Criminal-Data Processing Requirement What typically breaks it Governing provision Legal basis for the Art. 10 gateway itself The controller assumes candidate consent, a service contract, or its own legitimate interest is enough, when no national law actually authorises the processing Art. 10 Scope of what counts as criminal data Treating "no criminal record" certificates, security clearances, or fraud-prevention checks as outside Article 10 without checking how the relevant regulator or court currently interprets that scope Art. 10, Art. 4(1) Retention after use Keeping a copy of a criminal record extract in an employee's file after using it for the one purpose it was legally consulted for Art. 10, Art. 5(1)(e) Proportionality to the role Running the same criminal-record check on every hire regardless of whether the role has any connection to the risk the check is meant to address Art. 5(1)(c), Art. 10 Cooperation with the regulator Providing an incomplete or misleading translation or explanation of the processing once a supervisory authority opens an inquiry Art. 31 GDPR Article 10 Fines: Enforcement Cases and Amounts Article 10 enforcement is a genuinely unsettled area of law. The Amazon Road Transport case below shows a €2 million fine actually overturned on appeal, on the narrow question of whether a "clean record" certificate is Art. 10 data at all — a decision that itself may yet reach Spain's Supreme Court. Organisation Authority Decision date Fine Amazon Road Transport Spain, S.L. Agencia Española de Protección de Datos (Spain) 11 Feb 2022 (annulled on appeal, 8 Jul 2026) €2.000.000 SAF Logistics CNIL (France) 18 Sep 2023 (confirmed on appeal, 19 Nov 2024) €200.000 All Article 10 enforcement cases → Recitals That Explain Article 10 Recital 50 – Further Processing of Personal DataIs the recital gdpr-info.eu's own official text cross-references to Article 10. Its relevance is narrow and specific: it states that a controller indicating possible criminal acts or threats to public security, and passing the relevant personal data to a competent authority, should be treated as acting in its own legitimate interest. That's a purpose-limitation carve-out for reporting suspected crime onward — not a general licence to collect or store criminal-conviction data, which Article 10 still separately restricts to official authority or a specific legal basis. Recital 51 – Protecting Special Categories of Personal DataExplains why certain categories of data deserve heightened protection, since their processing could create significant risks to fundamental rights and freedoms. This recital is written for Article 9's special categories rather than Article 10 specifically, but it's the closest general framing for why criminal-conviction data gets its own restrictive regime; the specific safeguards for that data are left to Member State law, as Article 10's own text anticipates. Article 10 Compliance Checklist Identify the specific national law, not a general legitimate-interest argument, that authorises the criminal-data processing you're planning Confirm you have a separate, ordinary Art. 6(1) lawful basis on top of the Art. 10 gateway — the two are cumulative Check current national guidance on whether "no record" certificates, fraud databases or background-check outputs actually fall inside your jurisdiction's Art. 10 scope, since this is an evolving area Limit consultation of criminal record extracts to roles where a specific authorisation procedure applies, and don't retain the extract once consulted unless the law says you may Restrict access to a small, defined set of roles, and log who accessed the data and when Run a DPIA before starting any new criminal-record screening process Respond completely and accurately to a supervisory authority's requests once an inquiry opens — both cases below added a separate cooperation finding Both fines below started with a screening step a business thought was routine — a driver hiring check, an internal transfer form. Neither company had checked, before rolling the process out, whether their own country's law actually authorised what they were doing under Article 10. That's a five-minute legal question that's much cheaper to ask before rollout than after a regulator's inquiry. Learn more about Secure Privacy Related Recitals (50) Further Processing of Personal Data Article 10 Enforcement Cases Amazon Road Transport's Overturned €2M Fine SAF Logistics' €200,000 Fine All Article 10 cases Frequently Asked Questions about Article 10 + Can a private company ever process criminal record data under GDPR? Yes, but only where Union or Member State law specifically authorises it and sets out appropriate safeguards. There's no general legitimate-interest or consent-based route into Article 10 the way there is for several Article 9 special categories, so the answer depends heavily on the specific country and role involved. + Is a "certificate of no criminal record" covered by Article 10? This is genuinely contested. Spain's data protection authority took the view that it is, since it still reveals information tied to a person's criminal history; Spain's National High Court disagreed in a 2026 ruling, reasoning that a certificate confirming the absence of a conviction is favourable information about the person, not data about a conviction or offence. The question may yet reach Spain's Supreme Court. + Can an employer keep a copy of an employee's criminal record extract on file? Generally no, even where the employer was entitled to consult it. Several national frameworks distinguish between the right to consult a criminal record extract for a specific, authorised purpose and the right to retain a copy afterwards; retaining it without a specific legal basis to do so is a separate Article 10 violation, as the SAF Logistics case below shows. +Does candidate consent make a criminal-record check lawful under Article 10? Not by itself, and not in every Member State. Article 10 doesn't list consent as a basis the way Article 9(2)(a) does for special categories; consent may feature as part of a specific national authorisation scheme, but "the candidate agreed" is not, on its own, the legal basis Article 10 requires. + Which fine tier applies to an Article 10 breach? Article 10 isn't explicitly listed in either Art. 83(4) or Art. 83(5). In practice, authorities have anchored Article 10 findings to a linked Article 6(1) lawfulness breach, which falls under the upper tier of up to €20 million or 4% of worldwide annual turnover — as the AEPD did in the Amazon Road Transport decision below. Related Key Issues GDPR Privacy Impact Assessment GDPR Records of Processing Activities

If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. 1Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. 2In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification. Related Recitals (57) Additional Data for Identification Purposes Frequently Asked Questions about Article 11 + What does Article 11 GDPR say about identification? Article 11 states that controllers are not obliged to maintain, acquire, or process additional information just to identify a data subject solely to comply with the GDPR. + Do data subject rights apply if a controller cannot identify the person? If the controller cannot identify the individual, certain rights such as access, rectification, and erasure may not apply, unless the individual provides additional information enabling identification. + Does Article 11 encourage data minimisation? Yes. Article 11 supports minimisation by confirming that organisations should not collect extra identifying data purely to satisfy compliance obligations when processing does not otherwise require identification. Related Key Issues GDPR Right of Access GDPR Right to be Forgotten

1The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. 2The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. 3When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means. 1The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. 2In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject. 1The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. 2That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. 3The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. 4Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. 1Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. 2Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or refuse to act on the request. 3The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject. 1The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. 2Where the icons are presented electronically they shall be machine-readable. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons. Related Recitals (38) Special Protection of Children’s Personal Data (58) The Principle of Transparency (59) Procedures for the Exercise of the Rights of the Data Subjects (60) Information Obligation (73) Restrictions of Rights and Principles Frequently Asked Questions about Article 12 + How quickly must a company respond to a data subject request? Under Article 12, controllers must respond to data subject requests without undue delay and within one month. This can be extended by two further months for complex or numerous requests. + Can a company charge a fee for handling a data subject request? Requests are generally free of charge. A reasonable fee may be charged, or the request refused, only where it is manifestly unfounded or excessive, particularly if repetitive. + How must privacy information be presented under the GDPR? Information must be concise, transparent, intelligible, and easily accessible, using clear and plain language. This is especially important when information is addressed to children. Related Key Issues GDPR Right to be Informed GDPR Right of Access GDPR Right to be Forgotten

In this page Key Facts The 12 Mandatory Notice Items at a Glance Article 13 vs Article 14: Which Applies? What Typically Breaks a Compliant Article 13 Notice GDPR Article 13 Fines: Enforcement Cases and Amounts Recitals That Explain Article 13 Article 13 Compliance Checklist Frequently Asked Questions about Article 13 Related Key Issues and Articles Art. 13(1)(a) The identity and contact details of the controller and, where applicable, its representative. controller identity Art. 13(1)(b) The contact details of the data protection officer, where applicable. DPO contact Art. 13(1)(c) The purposes of the processing for which the personal data are intended, as well as the legal basis for the processing. purposes & legal basis Art. 13(1)(d) Where processing rests on Art. 6(1)(f), the legitimate interests pursued by the controller or a third party. legitimate interests Art. 13(1)(e) The recipients or categories of recipients of the personal data, if any. recipients Art. 13(1)(f) Where applicable, the intention to transfer data to a third country, whether an adequacy decision exists, and, absent one, the safeguard relied on and how to obtain a copy of it. international transfers Art. 13(2)(a) The storage period, or the criteria used to determine it. storage period Art. 13(2)(b) The existence of the rights to access, rectification, erasure, restriction, objection, and data portability. data subject rights Art. 13(2)(c) Where processing rests on consent, the right to withdraw it at any time. right to withdraw consent Art. 13(2)(d) The right to lodge a complaint with a supervisory authority. complaint right Art. 13(2)(e) Whether providing the data is a statutory or contractual requirement, and the consequences of not providing it. mandatory & consequences Art. 13(2)(f) The existence of automated decision-making, including profiling under Art. 22, and meaningful information about its logic, significance and envisaged consequences. automated decision-making Art. 13(3) Where the controller intends to further process the data for a purpose other than the one it was collected for, it must give the data subject information on that other purpose before the further processing begins. further processing Art. 13(4) Paragraphs 1 to 3 do not apply where and insofar as the data subject already has the information. exception In short Article 13 is the checklist for the moment a controller collects data straight from the person it concerns. It does not decide whether the processing is lawful; that is Article 6's job. It decides whether the person was told enough, at the right time, in the right form, to understand what is happening to their data and to act on it. In practice, most fines under this article are not about a missing privacy policy. Uber and Netflix both had one. The failures were narrower and more specific: no concrete retention period, no named recipients where the controller could have named them, no explanation of the safeguard used for a transfer outside the EEA. A privacy policy that exists but stays vague on these points is the pattern regulators keep finding. Key Facts Chapter Chapter 3 – Rights of the data subject (Art. 12–23) Applies to Every controller collecting personal data directly from the data subject. Where the data comes from somewhere else, Art. 14 applies instead Maximum fine €20.000.000 or 4% of worldwide annual turnover, whichever is higher, since Art. 13 sits among the data subject's rights under Art. 12–22 (Art. 83(5)(b)) In force since 25 May 2018 Explained by recitals 60, 61, 62 Depends on Art. 5(1)(a) for the fairness and transparency principle, Art. 12 for how the information must be presented Companion provision Art. 14 imposes the equivalent duty, with more exceptions, where data was not collected from the data subject Closest UK equivalent UK GDPR Art. 13, identical wording The 12 Mandatory Notice Items at a Glance Article 13 has no single list of "the" requirements; they run across two paragraphs. Laid out together, there are twelve of them. # Item What it requires Provision 1 Controller identity Name and contact details of the controller and, where applicable, its representative Art. 13(1)(a) 2 DPO contact Contact details of the data protection officer, where one has been appointed Art. 13(1)(b) 3 Purposes & legal basis Each purpose of processing, paired with the specific legal basis relied on for it Art. 13(1)(c) 4 Legitimate interests Where relied on under Art. 6(1)(f), the specific interest pursued by the controller or a third party Art. 13(1)(d) 5 Recipients The recipients, or categories of recipients, who receive the data Art. 13(1)(e) 6 International transfers Any intended transfer outside the EEA, the adequacy status, and the safeguard relied on absent one Art. 13(1)(f) 7 Storage period A concrete retention period, or the criteria used to determine one Art. 13(2)(a) 8 Data subject rights The existence of the rights to access, rectification, erasure, restriction, objection and portability Art. 13(2)(b) 9 Right to withdraw consent Where consent is the basis, that it can be withdrawn at any time Art. 13(2)(c) 10 Complaint right The right to lodge a complaint with a supervisory authority Art. 13(2)(d) 11 Mandatory or voluntary Whether providing the data is a statutory or contractual requirement, and the consequence of refusing Art. 13(2)(e) 12 Automated decision-making The existence of profiling or automated decisions under Art. 22, with meaningful information on the logic and consequences Art. 13(2)(f) Article 13 vs Article 14: Which Applies? Article 13 Article 14 Triggered by Data collected directly from the data subject Data obtained from a source other than the data subject Content required The 12 items above Largely the same 12 items, plus the categories of personal data concerned and the source it came from Timing At the time of collection Within a reasonable period, at the latest one month, or at first communication or disclosure if sooner Exceptions One: the data subject already has the information (Art. 13(4)) Several, including where notice proves impossible or would involve disproportionate effort, or where a Union or Member State law expressly provides for the data's collection or disclosure In practice, most controllers need both: Article 13 for data a customer submits directly, Article 14 for anything appended later from a third-party source, such as an enrichment or credit-reference provider. How Article 12 interacts with Article 13. Article 13 sets what has to be said; Article 12 sets how. A controller may satisfy Article 13's content requirement in full and still fail if the notice is not presented in a layered, accessible way: a short first layer covering the most important points, with the complete detail available at a click, rather than one dense page or, worse, information scattered across several linked documents a user has to hunt for. The Uber and Netflix findings above cited failures under both articles for exactly this reason. What Typically Breaks a Compliant Article 13 Notice Most Article 13 findings are not about missing a privacy policy altogether. They are about specific, checkable gaps inside one that otherwise looks complete. Requirement What typically breaks it Governing provision Purposes tied to a legal basis Purposes are listed in general terms without stating which legal basis supports which purpose, so the reader cannot tell what specific data feeds what specific use Art. 13(1)(c), Recital 60 Recipients Only categories are named ("advertising partners", "service providers") when the controller knows the actual, limited set of recipients and could name them Art. 13(1)(e) International transfers A generic statement that data "may be transferred outside the EEA" without naming the safeguard relied on or how to get a copy of it Art. 13(1)(f) Storage period No retention period and no criteria for determining one, just silence on the point Art. 13(2)(a) Rights and complaint route Rights are listed but the practical mechanism to exercise them is buried several menus deep or is otherwise disproportionately hard to use Art. 13(2)(b), Art. 12(2) Timing Information about a new processing purpose is given after the fact rather than before the further processing starts Art. 13(3), Recital 61 GDPR Article 13 Fines: Enforcement Cases and Amounts Both Dutch decisions below rest on express Article 13 findings, cited paragraph by paragraph. Google is listed because it is routinely cited in Article 13 discussions; its operative findings sat across several articles and it is documented at its own source below the table. Organisation Authority Decision date Fine Uber B.V. / Uber Technologies Inc. Autoriteit Persoonsgegevens (Netherlands) 11 Dec 2023 €10.000.000 Netflix International B.V. Autoriteit Persoonsgegevens (Netherlands) 18 Dec 2024 €4.750.000 Google LLC CNIL (France) 21 Jan 2019 €50.000.000 The Google LLC decision, upheld by the Conseil d'État on 19 June 2020, found insufficiently accessible and clear information among its grounds alongside Article 6 and Article 12, rather than resting on Article 13 alone, which is why it sits outside the two case studies below. It remains the leading European statement that scattering the required information across many linked documents defeats the transparency purpose Article 13 exists to serve. All Article 13 enforcement cases → Recitals That Explain Article 13 Recital 60 – Information Obligation. Grounds the notice duty in the fairness and transparency principle: the person has to be told the processing exists and what it is for, told about any profiling and its consequences, and, where the data comes from them directly, told whether providing it is mandatory and what happens if they refuse. It allows the information to be paired with standardised, machine-readable icons for a quick overview. Recital 61 – Time of Information Fixes when the notice is due: at collection, or within a reasonable period if the data came from elsewhere. If data is later passed to a new recipient, the person should be told at that point. If the controller later wants to use the data for a different purpose, it has to give notice of that purpose before the further processing starts. Where several sources were used and the exact origin cannot be traced item by item, general information about the sources is enough. Recital 62 – Exceptions to the Obligation to Provide Information Narrows the duty rather than removing it: no notice is needed where the person already has the information, where the law itself requires the recording or disclosure, or where giving notice is impossible or a disproportionate effort. That last exception is aimed particularly at archiving, scientific, historical or statistical processing, weighed against how many people are affected, how old the data is, and what safeguards are in place. Article 13 Compliance Checklist Name the controller and, where applicable, its representative and DPO by contact detail, not just a generic support inbox State each purpose next to its own legal basis; do not let one basis stand in for several distinct purposes Name the actual recipients where the set is known and limited, not just a category label For any transfer outside the EEA, name the specific safeguard relied on and how to obtain a copy of it Give a concrete storage period, or the criteria that fix one, for every category of data collected List the rights in Art. 15–21 and the complaint route, and make the mechanism to exercise them easy to find, not buried in a settings menu State plainly whether providing the data is mandatory and what happens if the person declines Where Art. 22 profiling is involved, explain the logic, significance and envisaged consequences, not just that profiling occurs Give notice of any new processing purpose before starting it, not after Keep the required content out of buried sub-pages; Article 12 governs the form, and a technically complete notice can still fail if it is not accessible Most of the gaps in the cases above trace back to the same thing: a privacy notice written once and never rechecked against what the business actually collects. Keeping the notice tied to a live data inventory, rather than a document someone updates when they remember, is the underlying fix. Secure Privacy's platform is built around that kind of ongoing sync. Learn more about Secure Privacy Related Recitals (60) Information Obligation (61) Time of Information (62) Exceptions to the Obligation to Provide Information Article 13 Enforcement Cases Uber's €10M Fine Netflix's €4.75M Fine All Article 13 cases Frequently Asked Questions about Article 13 + What information must Article 13 GDPR provide? The controller's identity and contact details, DPO contact where one exists, the purposes and legal basis for processing, recipients, any international transfer and its safeguard, storage period, the data subject's rights, whether providing the data is mandatory, and any automated decision-making involved. Paragraph 1 covers the minimum; paragraph 2 adds what fairness and transparency additionally require. + When must the Article 13 notice be given? At the time the data is collected from the person, per Art. 13(1) and Recital 61. If the controller later decides to use the data for a different purpose, notice of that new purpose is required before the further processing starts, under Art. 13(3), not afterwards. + What is the difference between Article 13 and Article 14? Article 13 applies when the controller collects the data directly from the person it concerns. Article 14 applies when the data comes from somewhere else, such as a third party or a public register. Article 14 covers largely the same content but carries a longer list of exceptions, reflecting that the person was never directly involved in the collection. + Does Article 13 apply if the data subject already knows the information? No. Art. 13(4) removes the obligation where, and to the extent, the data subject already has the information. This is a narrow exception tied to what the specific person already knows, not a general assumption that customers understand common industry practice. + Can naming "categories of recipients" instead of actual companies satisfy Article 13? Sometimes, but not always. Art. 13(1)(e) allows recipients or categories of recipients. The Dutch DPA's Netflix decision held that where the controller knows the actual set of recipients and the number is limited, naming them is required to give meaningful information; a category label was not enough on those facts. + Is a long, complete privacy policy automatically Article 13 compliant? Not necessarily. Both Uber and Netflix had privacy policies in place. The findings against them were about specific gaps inside those policies, such as an unstated retention period or an unnamed transfer safeguard, and, separately, about whether the required information was presented accessibly under Article 12. Length and the presence of a document are not the test. Related Key Issues GDPR Right of Access GDPR Third Countries

Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: the identity and the contact details of the controller and, where applicable, of the controller’s representative; the contact details of the data protection officer, where applicable; the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; the categories of personal data concerned; the recipients or categories of recipients of the personal data, if any; where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability; where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; the right to lodge a complaint with a supervisory authority; from which source the personal data originate, and if applicable, whether it came from publicly accessible sources; the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. The controller shall provide the information referred to in paragraphs 1 and 2: within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed; if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2. Paragraphs 1 to 4 shall not apply where and insofar as: the data subject already has the information; the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available; obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject’s legitimate interests; or where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy. Related Recitals (60) Information Obligation (61) Time of Information (62) Exceptions to the Obligation to Provide Information Frequently Asked Questions about Article 14 + What information must be given when data is obtained indirectly? Article 14 requires similar information to Article 13, plus the categories of data and the source it came from, when personal data is collected from a third party rather than the individual. + When must individuals be informed if their data came from another source? The information must be provided within a reasonable period and at the latest within one month, or at first communication with the individual if that happens sooner. + Are there exceptions to Article 14 notification? Yes. Notification is not required where the individual already has the information, where it is impossible or disproportionate, or where collection or disclosure is laid down by law with safeguards. Related Key Issues GDPR Consent GDPR Third Countries

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; the right to lodge a complaint with a supervisory authority; where the personal data are not collected from the data subject, any available information as to their source; the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. 1The controller shall provide a copy of the personal data undergoing processing. 2For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. 3Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Related Recitals (63) Right of Access (64) Identity Verification Frequently Asked Questions about Article 15 + What is the right of access under the GDPR? Article 15 gives individuals the right to confirm whether their data is being processed and to obtain a copy of that data, along with information about the purposes, recipients, and retention period. + Is a subject access request free under the GDPR? Yes. The first copy of personal data must be provided free of charge. A reasonable fee based on administrative costs may be charged for additional copies or excessive requests. + What is a subject access request (SAR)? A subject access request is when an individual exercises their Article 15 right to access the personal data an organisation holds about them. The organisation must usually respond within one month. Related Key Issues GDPR Right of Access GDPR Records of Processing Activities

In this page Key Facts The Two Rights Article 16 Actually Grants Article 16 vs Article 17 vs Article 18: Which Applies? What Typically Breaks a Compliant Rectification Process GDPR Article 16 Fines: Enforcement Cases and Amounts Recitals That Explain Article 16 Article 16 Compliance Checklist Frequently Asked Questions about Article 16 Related Key Issues and Articles Art. 16, s.1 The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning them. rectification of inaccurate data Art. 16, s.2 Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. completion of incomplete data In short Article 16 is one sentence doing two jobs: it makes a controller fix what's wrong, and complete what's missing, once someone points it out. It doesn't require the controller to have gotten the data right in the first place — that's Article 5(1)(d)'s job. It requires the controller to actually act once notified, "without undue delay." Both fines documented below are small next to headline GDPR numbers, and that's the point: rectification cases rarely turn on complex legal theory. CaixaBank and the operator of a French business directory were fined for the same underlying failure — a customer or data subject asked, repeatedly, for one wrong field to be corrected, and nobody with the ability to fix it ever did. Key Facts Chapter Chapter 3 – Rights of the data subject (Art. 12–23) Applies to Every controller holding personal data about a person who asks for an inaccuracy to be corrected or a gap to be filled Maximum fine €20.000.000 or 4% of worldwide annual turnover, whichever is higher, since Art. 16 sits among the data subject's rights under Art. 12–22 (Art. 83(5)(b)) In force since 25 May 2018 Explained by recitals 65 (jointly with Art. 17), and the accuracy principle discussed in Recital 39 Depends on Art. 5(1)(d) for the accuracy principle, Art. 12 for the one-month response clock and the duty to give reasons for a refusal Companion provision Art. 19 requires the controller to notify every recipient the data was disclosed to that a rectification happened, unless that is impossible or disproportionate Closest UK equivalent UK GDPR Art. 16, identical wording The Two Rights Article 16 Actually Grants Article 16 is short — two sentences, no sub-paragraphs — but it grants two distinct things, and enforcement decisions treat them separately. Right What it covers What "compliance" looks like Rectification Data that is factually wrong: a misspelled name, an old address, an incorrect balance The controller corrects the field itself, without undue delay, and in every system where that field is stored or displayed Completion Data that is accurate as far as it goes, but missing something relevant to the purpose of processing The controller adds the missing element, or, where the record can't simply be extended, accepts a supplementary statement from the data subject Unlike Article 13's twelve-item checklist, Article 16 carries no exceptions written into its own text. The exceptions come from elsewhere: Article 12(5) lets a controller refuse a manifestly unfounded or excessive request, and Article 23 allows Member State law to restrict the right in narrow, listed circumstances. Absent one of those, "without undue delay" is the only real defence a controller has, and both cases below turned on how loosely that phrase was interpreted. Article 16 vs Article 17 vs Article 18: Which Applies? Article 16 Article 17 Article 18 Right Rectification / completion Erasure ("right to be forgotten") Restriction of processing Triggered by Data that is wrong or incomplete Data no longer necessary, consent withdrawn, unlawful processing, or a successful objection Accuracy or lawfulness is contested while the dispute is being resolved Typical use "This field is wrong, fix it" "Delete this data about me" "Don't delete it, but stop using it while we sort out whether it's accurate" Interacts with Art. 19 (notify recipients) Art. 19 (notify recipients), Art. 17(2) (search engines/public data) Art. 18(2) restricts processing to storage only, with narrow exceptions In practice the three rights chain together: a person disputing accuracy can invoke Art. 18 to freeze processing while the controller investigates, then Art. 16 once the correct value is confirmed. The SNAF case below shows both Art. 16 and Art. 17 being invoked side by side, for different reasons, by different complainants against the same controller. What Typically Breaks a Compliant Rectification Process Neither case below involved a company with no rectification process at all. Both had a channel a customer could, in theory, use. The failures were narrower. Requirement What typically breaks it Governing provision Actually completing the correction The request is acknowledged, even repeatedly, but the underlying field is never changed in the system the customer actually sees Art. 16 Response timing "Without undue delay" is treated as open-ended rather than the one-month default (extendable by two months for complexity) that Art. 12(3) sets Art. 16, Art. 12(3) Reasoned refusal A request is rejected with no explanation and no mention of the right to complain to a supervisory authority Art. 12(4) Internal routing The request reaches a support agent with no way to escalate it to whoever owns the underlying database or public-facing record Art. 16, Art. 24 (accountability) Cooperation with the regulator Once a supervisory authority opens an inquiry, the controller misses its own compliance deadlines or fails to supply requested evidence Art. 31 GDPR Article 16 Fines: Enforcement Cases and Amounts Article 16 fines run small compared to headline GDPR numbers — both decisions below are administrative penalties well under €50,000. That reflects the nature of the right: a single, individual, checkable failure rather than a systemic processing violation. Organisation Authority Decision date Fine CaixaBank, S.A. Agencia Española de Protección de Datos (Spain) 2022 (PS-00183-2022) €25.000 Société Nouvelle de l'Annuaire Français (SNAF) CNIL (France) 15 Sep 2021 €3.000 All Article 16 enforcement cases → Recitals That Explain Article 16 Recital 65 – Right of Rectification and ErasureStates that a data subject should have the right to have inaccurate data about them rectified, and a right to erasure ("right to be forgotten") where retaining the data breaches the Regulation or applicable law. It ties rectification and erasure together as parallel corrective remedies rather than treating them as unrelated rights. Recital 39 – Principles of Data ProcessingSets out the fairness, transparency, minimisation and accuracy principles that Article 5 codifies, and states directly that every reasonable step should be taken to ensure inaccurate personal data is erased or rectified without delay. Article 16 is the individual's mechanism for invoking that principle; the principle itself doesn't require a request to already apply. Article 16 Compliance Checklist Give customer-facing staff and support agents a real path to whoever owns the record, not just a script for acknowledging the request Track every rectification request against the one-month clock in Art. 12(3), and document any extension for complexity Verify the correction actually landed in the system the data subject can see — not just in a back-office ticket marked "resolved" Where a request is refused, give a written reason and tell the person about their right to complain to the supervisory authority, per Art. 12(4) Notify every recipient the data was shared with once it's corrected, per Art. 19, unless that's impossible or disproportionate Respond fully and on time to a supervisory authority's information requests once an inquiry opens — both cases below added a separate finding for failing this Don't require identity documentation disproportionate to the risk of a wrongful correction Both cases below share a root cause: the request reached a support queue, but nothing forced the correction through to the system of record. Tying rectification requests directly to the live data inventory, rather than routing them through a ticket that can be closed without the underlying field changing, is what actually closes the gap. Learn more about Secure Privacy Related Recitals (65) Right of Rectification and Erasure Article 16 Enforcement Cases CaixaBank's €25,000 Fine SNAF's €3,000 Fine All Article 16 cases Frequently Asked Questions about Article 16 + What exactly does Article 16 GDPR require? Two things: correcting personal data that's factually inaccurate, and completing personal data that's incomplete relative to the purpose it's processed for, including by accepting a supplementary statement from the data subject where the record itself can't simply be extended. Both must happen without undue delay. +How long does a controller have to respond? Article 16 itself doesn't set a deadline; it borrows the one-month default from Art. 12(3), extendable by up to two further months for complex or numerous requests, provided the data subject is told about the extension and the reason for it within the first month. + Can a company ever refuse a rectification request? Yes, where the data is actually accurate and the controller can support that, or where the request is manifestly unfounded or excessive under Art. 12(5). A refusal has to be reasoned and has to tell the person about their right to complain to a supervisory authority or seek a judicial remedy, per Art. 12(4). + Does correcting the data mean telling everyone it was shared with? Yes, under Art. 19, unless notifying each recipient proves impossible or requires disproportionate effort. If the data subject asks, the controller also has to tell them who those recipients were. + Why are Article 16 fines so much smaller than Article 5 or Article 6 fines? Article 16 breaches are typically individual and checkable — one person's one field, not stated wrong for one system versus another. Regulators size the fine to the harm and scope, and a single unresolved correction request affects far fewer people than a defective lawful-basis or transparency failure across an entire customer base. Related Key Issues GDPR Records of Processing Activities GDPR Privacy by Design

Art. 17(1) The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. No longer necessary (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing. Consent withdrawn (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects pursuant to Article 21(2). Objection (d) the personal data have been unlawfully processed. Unlawful processing (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject. Legal obligation (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). Child's consent Art. 17(2) Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase it, the controller, taking account of available technology and cost of implementation, shall take reasonable steps, including technical measures, to inform controllers processing the data that the data subject has requested erasure of any links to, copy of, or replication of those personal data. Art. 17(3) Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and information. Freedom of expression (b) for compliance with a legal obligation, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Legal obligation or public task (c) for reasons of public interest in the area of public health in accordance with Article 9(2)(h),(i) and Article 9(3). Public health (d) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes under Article 89(1), insofar as erasure is likely to render impossible or seriously impair those objectives. Archiving or research (e) for the establishment, exercise or defence of legal claims. Legal claims In short Article 17 gives individuals the right to have their personal data erased in defined circumstances, most commonly when it's no longer needed, consent is withdrawn, or processing was unlawful. It isn't absolute, since five exceptions let a controller refuse, from freedom of expression to legal claims. Getting the exceptions wrong in either direction, by refusing a valid request or erasing data the company was still entitled to keep, is what tends to draw regulatory attention. Chapter Chapter 3, Rights of the data subject (Art. 12 to 23) Applies to Every controller processing personal data of an identifiable individual in the EU/EEA Maximum fine €20.000.000 or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)(b)) In force since 25 May 2018 Explained by recitals 65, 66 Closest UK equivalent UK GDPR Art. 17 (identical wording) When Can a Controller Refuse an Erasure Request? Article 17 is one of the most frequently exercised, and most commonly mishandled, data subject rights. A refusal is only valid if it maps to a specific Art. 17(3) exception: Situation Can the controller refuse? Data is still needed for the original purpose it was collected for Yes, refusal is valid Data is needed to comply with a legal retention obligation, for example tax records Yes, refusal is valid Data is needed to establish, exercise, or defend a legal claim Yes, refusal is valid Journalistic or archival content protected by freedom of expression Yes, refusal is valid Individual simply changed their mind about a lawful, ongoing service No, not a ground on its own unless another Art. 17(1) ground applies Data was unlawfully processed in the first place No, it must be erased What Does Complying With an Erasure Request Actually Involve? Confirm which Art. 17(1) ground applies before acting either way. A blanket policy of never deleting data is not compliant If the data was made public, take reasonable steps to inform other controllers processing copies of it or links to it (Art. 17(2)) Respond within one month (Art. 12(3)), extendable by two months for complex requests, with a clear explanation either way Refusing a request requires citing a specific Art. 17(3) exception rather than internal discretion Track downstream processors and copies. Erasure isn't complete if a backup, processor, or cached copy still exists GDPR Article 17 Fines: Enforcement Cases and Amounts Article 17 failures rarely headline on their own. They tend to surface as one finding within a broader decision about how a company handles data subject rights generally. Organisation Authority Date Fine Google IMY (Sweden) Mar 2020 SEK 75.000.000 (approx. €7.000.000) Carrefour France CNIL (France) Nov 2020 €2.250.000 All Article 17 enforcement cases → Recitals That Explain Article 17 Recital 65, Right of Rectification and Erasure Explains the grounds for erasure, including when data is no longer needed, consent is withdrawn, or an objection succeeds, and situates the right alongside the right to rectification. Recital 66, Right to Be Forgotten Extends the erasure obligation to publicly available data, directing controllers to take reasonable steps, including technical measures, to inform other controllers processing that data, taking available technology and cost into account. Article 17 Compliance Checklist Build a documented process for logging, evaluating, and responding to erasure requests within one month Map which Art. 17(1) ground and, if refusing, which Art. 17(3) exception applies before responding Include downstream processors and any publicly posted copies in the erasure scope, not just the primary system Request additional identity verification only where there is genuine doubt about who is asking, rather than as a routine step for every request Track response time performance, since a spike in request volume does not excuse missed deadlines even though corrective measures taken afterward can still count in a company's favour Distinguish erasure from anonymisation or access restriction, since they are not automatically the same thing Related Recitals (65) Right of Rectification and Erasure (66) Right to be Forgotten Article 17 Enforcement Cases Google's Fine (Sweden) Carrefour France's Fine Frequently Asked Questions about Article 17 + What is the right to be forgotten under the GDPR? Article 17 gives individuals the right to have their personal data erased in certain circumstances, such as when the data is no longer needed, consent is withdrawn, or processing was unlawful. +Is the right to erasure absolute under the GDPR? No. Erasure can be refused where processing is necessary for freedom of expression, legal obligations, public health, archiving in the public interest, or the establishment of legal claims. + When can a company refuse a deletion request? A controller can refuse erasure where it still has a valid legal basis or obligation to keep the data, for example to comply with law or to defend legal claims. + Does erasure mean the data has to be physically destroyed? Not necessarily by one specific method, but the data must be effectively and irreversibly removed. Regulators have found that anonymising or restricting access, without rendering the data truly unidentifiable, does not satisfy Article 17. + How is Article 17 different from Article 21's right to object? Article 21 lets someone object to processing in the first place, particularly for direct marketing or legitimate interest processing. A successful objection under Art. 21 is itself one of the six grounds that then triggers the Art. 17 erasure obligation. Related Key Issues GDPR Right to be Forgotten GDPR Consent GDPR Email Marketing

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted. Suitable Recitals (67) Recital 67 – Restriction of Processing Frequently Asked Questions about Article 18 + What is the right to restriction of processing under the GDPR? Article 18 lets individuals limit how their data is used in certain situations, such as while accuracy is contested or when processing is unlawful but the person prefers restriction over erasure. +What does restricting processing actually mean? When processing is restricted, the data may be stored but not otherwise used, except with consent, for legal claims, to protect another person, or for important public interest reasons. + When can a data subject request restriction instead of deletion? Restriction can be requested when the accuracy of data is disputed, processing is unlawful, the data is no longer needed but required for legal claims, or an objection is pending verification. Related Key Issues GDPR Records of Processing Activities GDPR Right of Access

In this page Key Facts When Article 19 Applies EDPB Guidance and Enforcement Focus Decisions and Rulings Involving Article 19 Article 19 in Court Recitals Behind the Rights in Article 19 Checklist: Passing Changes Downstream Frequently Asked Questions about Article 19 Related Articles Sentence 1 The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. notify each recipient Sentence 2 The controller shall inform the data subject about those recipients if the data subject requests it. name them on request In short Article 19 makes sure a correction, deletion or restriction doesn't stop at your own systems. When you act on a request under Articles 16, 17(1) or 18, you have to tell everyone you disclosed the data to, unless that's impossible or would take disproportionate effort. And if the person asks, you have to tell them who those recipients are. In Proximus, the Court of Justice read Article 19 together with the accountability rules to require a directory provider to pass a consent withdrawal on to the other directory providers it supplied and, in the circumstances of that case, to the operator that supplied the data. Sweden reprimanded Klarna for not telling a customer which recipients had received his data. And authorities in Spain and Sweden fined Google over the reverse problem: passing details of removal requests to parties the law didn't require it to tell (AEPD, €10.000.000; IMY, final fine SEK 50.000.000). Key Facts Chapter Chapter III – Rights of the data subject, Section 3: Rectification and erasure (Art. 16–20) Addressed to Controllers that have disclosed personal data to one or more recipients Triggered by Rectification under Art. 16, erasure under Art. 17(1) and restriction under Art. 18. Data you've made public is covered separately by Art. 17(2) Exception Notification proves impossible or involves disproportionate effort. The Swedish authority placed the burden of showing this on the controller (Klarna) Maximum fine €20.000.000 or 4% of worldwide annual turnover, whichever is higher, as an infringement of data subject rights under Art. 83(5)(b) National classification Spain lists failing to notify under Art. 19, and failing to tell the person who the recipients were, as minor infringements (LOPDGDD, Art. 74(e) and (f)) Leading case CJEU, C-129/21 Proximus, 27 Oct 2022 In force since 25 May 2018 Works with Art. 15(1)(c) (recipients in an access request), Art. 17(2) (data made public), Art. 24 and Art. 5(2) (accountability) When Article 19 Applies Article 19 is a follow-on duty. It only bites once you've carried out one of three actions, and it covers everyone the data went to: You carried out Under What recipients need to hear A rectification Art. 16 That the data was inaccurate or incomplete and has been corrected or completed An erasure Art. 17(1) That the data has been erased. In Proximus, a withdrawal of consent to publication counted as an erasure request A restriction Art. 18 That processing of the data has been restricted A request from the person Art. 19, second sentence Nothing: this one runs the other way. You tell the person which recipients you notified Where you've made the data public, Art. 17(2) adds a separate duty to take reasonable steps to inform other controllers processing it, such as search engines. The Court applied both in Proximus. EDPB Guidance and Enforcement Focus These are the EDPB outputs that address Article 19 or the rights it follows from most directly: Topic EDPB output Key point Keeping a list of recipients Guidelines 01/2022 on the right of access (adopted for consultation 18 Jan 2022), para. 115, as cited by the Swedish authority Storing information on the actual recipients is needed to comply with Arts. 5(2) and 19 How erasure works in practice Coordinated enforcement report on the right to erasure (Feb 2026) 32 authorities and 764 controllers took part; nine authorities opened or continued formal investigations. Recurring problems included a lack of appropriate internal procedures for handling requests (see also Reed Smith) Decisions and Rulings Involving Article 19 These decisions and rulings either apply Article 19 or turn on who should, and shouldn't, be told about a change: Case Authority Year What was found Outcome Proximus APD (Belgium), then CJEU 2020, 2022 Erased directory entry reappeared via an operator's data feed; the Court held the withdrawal must be passed both downstream and upstream €20.000 Klarna Bank IMY (Sweden) 2022 Didn't name the recipients of a customer's data when asked; Art. 15(1)(c) read with Art. 19 Reprimand Österreichische Post (C-154/21) CJEU 2023 Individuals are entitled to the actual identity of recipients; the Court found this confirmed by Art. 19 Ruling Google LLC IMY (Sweden) 2020 No legal basis for telling site owners about delistings; ordered to stop. Upheld on appeal SEK 50.000.000 (final; IMY had set SEK 75.000.000) Google LLC AEPD (Spain) 2022 Forwarded erasure requests to the Lumen database without a legal basis €10.000.000 All Article 19 cases Article 19 in Court Both Court of Justice rulings came on questions about other articles, and both used Article 19 to decide them: Case Question What the Court said about Art. 19 Source Proximus (C-129/21), 27 Oct 2022 Must a directory provider pass on a consent withdrawal? Arts. 5(2) and 24, read with Art. 19, require it to inform the other providers it supplied and the operator that supplied it Judgment, para. 83 Österreichische Post (C-154/21), 12 Jan 2023 Can a controller name only categories of recipient? No, unless recipients can't yet be identified or the request is manifestly unfounded or excessive. The Court saw this as confirmed by Art. 19 Judgment, paras. 40–41 Recitals Behind the Rights in Article 19 No recital addresses Article 19 on its own. These explain the three rights it follows from. Recital 65 – Right of rectification and erasurePeople should be able to have inaccurate data about them corrected and to have data erased where keeping it infringes the Regulation, particularly where they gave consent as a child and later want the data removed. Recital 66 – Right to be forgottenA controller that has made data public should take reasonable steps, taking account of available technology and means, to inform other controllers processing the data of the erasure request, including removing links, copies or replications. Recital 67 – Restriction of processingRestriction can be achieved by, for example, moving data to another system, making it unavailable to users or temporarily removing published data from a website, with the restriction clearly indicated in the system. Checklist: Passing Changes Downstream Record who each dataset goes to by name, not just by category. You'll need the list both for Art. 19 notifications and for access requests (Klarna) Build rectification, erasure and restriction workflows so the change reaches every recipient, not only your own database (Proximus) Check your inbound feeds too. If a partner keeps sending you data that someone has asked you to erase, tell the source, or the data will come back (Proximus) Treat a consent withdrawal as potentially triggering erasure and onward notification, not just an internal flag change (Proximus) If you rely on "impossible or disproportionate effort," document why at the time. The Swedish authority noted Klarna hadn't shown either (Klarna) Passing details of a request to anyone else is processing in its own right and needs its own legal basis. Spain and Sweden both fined Google for this (AEPD, IMY) Consent withdrawals are the Article 19 trigger most organisations miss. A consent record that shows which vendors received data under each consent makes it possible to pass a withdrawal on to the right parties, and to name them if the person asks. Learn more about Secure Privacy Related Recitals (66) Right to be Forgotten Frequently Asked Questions about Article 19 + Who counts as a recipient? Article 4(9) defines a recipient as a natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether a third party or not. +Do I have to tell the person who I notified? Yes, if they ask. The second sentence of Article 19 requires it, and the Court of Justice has held that people are generally entitled to the actual identity of recipients, not just categories (C-154/21). +What counts as disproportionate effort? The GDPR doesn't define it for Article 19. In the Klarna decision the Swedish authority expected the controller to show that naming recipients was impossible or disproportionate, and found Klarna hadn't. +Does withdrawing consent trigger Article 19? It can. In Proximus the Court treated a subscriber's request to leave phone directories as an erasure request, and held the provider had to inform both the other directory providers and the operator that sent it the data. +Is Article 19 the same as Article 17(2)? No. Article 19 covers recipients you disclosed data to. Article 17(2) covers data you made public, and requires reasonable steps to inform other controllers, such as search engines, that are processing it. +How much can a breach of Article 19 cost? Up to €20.000.000 or 4% of worldwide annual turnover under Article 83(5)(b). For limitation purposes, Spanish law classifies it as a minor infringement (LOPDGDD, Art. 74). Related Key Issues GDPR Records of Processing Activities GDPR Right to be Informed

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and the processing is carried out by automated means. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible. 1The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. 2That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others. Related Recitals (68) Right of Data Portability Frequently Asked Questions about Article 20 + What is the right to data portability under the GDPR? Article 20 lets individuals receive the personal data they provided in a structured, commonly used, and machine-readable format, and to transmit it to another controller without hindrance. +When does the right to data portability apply? It applies only when processing is based on consent or a contract and is carried out by automated means. It does not cover data processed under other lawful bases. + Can individuals move their data directly between providers? Yes, where technically feasible. Article 20 gives individuals the right to have their data transmitted directly from one controller to another. Related Key Issues GDPR Privacy by Design GDPR Right to be Informed

Art. 21(1) The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. Qualified objection, legitimate interest or public task Art. 21(2) Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Absolute objection, direct marketing Art. 21(3) Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. No balancing test Art. 21(4) At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information. Transparency duty Art. 21(5) In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. Automated objection Art. 21(6) Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest. Research exception In short Article 21 gives two different rights. Objecting to processing based on legitimate interests or a public task is a qualified right, where the controller can keep processing if it can show compelling grounds that override the individual. Objecting to direct marketing is absolute, with no balancing test at all. Confusing the two, or treating an unconditional marketing opt-out as if it required a case-by-case assessment, is the most common way Article 21 gets breached. Chapter Chapter 3, Rights of the data subject (Art. 12 to 23) Applies to Every controller processing personal data based on legitimate interest, public task, or for direct marketing purposes Maximum fine €20.000.000 or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)(b)) In force since 25 May 2018 Explained by recitals 69, 70 Closest UK equivalent UK GDPR Art. 21 (identical wording) Which Kind of Objection Is This? Article 21 is really two rights, and they work differently. Getting them mixed up is where most enforcement cases start: Situation What the controller must do Someone objects to processing based on legitimate interest (Art. 6(1)(f)) Stop, unless the controller can show compelling legitimate grounds that override the individual, or the data is needed for a legal claim Someone objects to processing carried out as a public task (Art. 6(1)(e)) Same qualified test as above Someone objects to direct marketing, including related profiling Stop immediately. No balancing test, no exceptions Someone objects to research or statistical processing under Art. 89(1) Stop, unless the processing is necessary for a task carried out for reasons of public interest What Does Complying With an Objection Actually Involve? Identify which of the two regimes applies before responding. A marketing opt-out gets no balancing test; a legitimate-interest objection does For marketing objections, stop processing for that purpose without undue delay, across every channel the data was used for For legitimate-interest objections, actually run and document a fresh balancing assessment rather than defaulting to "no" Tell people about the right to object clearly and separately at first contact, not buried inside a longer privacy notice (Art. 21(4)) For online services, provide an automated way to object, since a manual-only process does not satisfy Art. 21(5) Test that unsubscribe and opt-out mechanisms actually work in practice, not just in the privacy notice's description of them GDPR Article 21 Fines: Enforcement Cases and Amounts Most Article 21 fines trace back to one of two failure patterns: a company keeps marketing to someone after they object, or the mechanism for objecting does not actually work. Organisation Authority Date Fine H&M IMY (Sweden) Oct 2023 SEK 350.000 (approx. €28.500) ACCOR CNIL (France) Aug 2022 €600.000 All Article 21 enforcement cases → Recitals That Explain Article 21 Recital 69, Right to Object Explains that even where processing is otherwise lawful under legitimate interest or public task, the data subject can still object on grounds relating to their particular situation, and it falls to the controller to show its compelling legitimate interest overrides the individual's rights. Recital 70, Right to Object to Direct Marketing Confirms the right to object to direct marketing, including related profiling, applies to both initial and further processing, at any time and free of charge. Article 21 Compliance Checklist Give every marketing message a working, one-click way to object or unsubscribe, and test it regularly rather than assuming it still works Log objections and confirm they have actually taken effect across every system and channel, not just the one the request arrived through Keep objection records for long enough to demonstrate compliance if a regulator asks, rather than letting them expire with routine data retention schedules Build a documented process for legitimate-interest objections that requires a real, case-specific assessment rather than a default refusal State the right to object clearly and separately from other information at first contact, in line with Art. 21(4) Related Recitals (69) Right to Object (70) Right to Object to Direct Marketing Article 21 Enforcement Cases H&M's Fine (Sweden) ACCOR's Fine (France) Frequently Asked Questions about Article 21 + What is the right to object under the GDPR? Article 21 gives individuals the right to object to processing based on legitimate interests or public task, and an absolute right to object to processing for direct marketing purposes. +Can I stop a company using my data for marketing? Yes. Under Article 21, individuals have an absolute right to object to direct marketing, and the controller must stop processing the data for that purpose immediately. + Can a company continue processing after an objection? For legitimate interest processing, a controller may continue only if it demonstrates compelling legitimate grounds that override the individual's interests, or if processing is needed for legal claims. +Does an unsubscribe link have to work perfectly, or is a good-faith effort enough? Regulators have treated a broken or ineffective unsubscribe mechanism as a violation in its own right, separate from any intent. If the link does not actually stop the marketing, the objection has not been honoured regardless of what the privacy notice says should happen. +How is Article 21 different from Article 7's withdrawal of consent? Withdrawal of consent applies where consent was the lawful basis for processing. Objection under Article 21 applies where the basis was legitimate interest, public task, or direct marketing. Both require the controller to stop processing, but they are triggered by different lawful bases and, for legitimate interest, involve a different test. Related Key Issues GDPR Fines / Penalties GDPR Privacy Impact Assessment

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Paragraph 1 shall not apply if the decision: is necessary for entering into, or performance of, a contract between the data subject and a data controller; is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or is based on the data subject’s explicit consent. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place. Related Recitals (71) Profiling (72) Guidance of the European Data Protection Board Regarding Profiling (91) Necessity of a Data Protection Impact Assessment Frequently Asked Questions about Article 22 + What does the GDPR say about automated decision-making? Article 22 gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on them. +When is automated decision-making allowed under the GDPR? It is permitted where necessary for a contract, authorised by law, or based on explicit consent, with safeguards such as the right to human intervention and to contest the decision. + Does Article 22 apply to AI and profiling? Yes. Where AI or profiling makes solely automated decisions with significant effects on a person, Article 22 applies and individuals must be given meaningful safeguards. Related Key Issues GDPR Privacy by Design GDPR Privacy Impact Assessment

Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard: national security; defence; public security; the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security; the protection of judicial independence and judicial proceedings; the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions; a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g); the protection of the data subject or the rights and freedoms of others; the enforcement of civil law claims. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to: the purposes of the processing or categories of processing; the categories of personal data; the scope of the restrictions introduced; the safeguards to prevent abuse or unlawful access or transfer; the specification of the controller or categories of controllers; the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing; the risks to the rights and freedoms of data subjects; and the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction. Related Recitals (73) Restrictions of Rights and Principles Frequently Asked Questions about Article 23 + What does Article 23 GDPR allow? Article 23 allows EU or member state law to restrict certain GDPR rights and obligations where necessary and proportionate to safeguard interests such as national security, defence, or public safety. +Can data subject rights be limited under the GDPR? Yes. Article 23 permits limited restrictions of rights for specific public interest objectives, but any restriction must respect the essence of fundamental rights and be necessary and proportionate. + What safeguards apply to restrictions under Article 23? Legislative measures imposing restrictions must include specific provisions on purposes, scope, safeguards, retention, and the risks to individuals, ensuring restrictions are not arbitrary. Related Key Issues GDPR Third Countries GDPR Fines / Penalties

In this page Key Facts What Article 24 Requires Can Article 24 Be Fined? Decisions finding an Article 24 infringement Recitals That Explain Article 24 Checklist for Controllers Frequently Asked Questions about Article 24 Related Articles Art. 24(1) Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary. ensure and demonstrate Art. 24(2) Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller. data protection policies Art. 24(3) Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller. codes and certification In short Article 24 makes the controller answerable for the whole of its processing. It has to put measures in place that fit the nature, scope, context, purposes and risks of what it does, keep them under review, and be able to prove that they work. Where proportionate, those measures include data protection policies. Authorities have enforced the "prove it" part most sharply. The Irish DPC fined Meta €17.000.000 because it couldn't show its security measures in action for twelve breaches, and found TikTok in breach for failing to assess risks to children, but imposed no fine for that finding because the GDPR doesn't set one. In Norway, where national law does, Østre Toten municipality was fined NOK 4.000.000 after a ransomware attack exposed missing internal controls. Key Facts Chapter Chapter IV – Controller and processor, Section 1: General obligations (Art. 24–31) Applies to Controllers Core duty Implement appropriate technical and organisational measures to ensure and to be able to demonstrate compliance, and review and update them where necessary Maximum fine None set by the GDPR for Article 24 itself: Art. 83(4)(a) covers Articles 8, 11, 25 to 39, 42 and 43. Authorities fine the linked provision instead, and some national laws add a fine (see below) In force since 25 May 2018 Explained by recitals Recitals 74 to 78 Depends on Art. 5(2) (accountability principle), which Article 24 spells out in more detail Works with Art. 25 (by design and by default), Art. 30 (records), Art. 32 (security) and Art. 35 (DPIA) Closest UK equivalent UK GDPR, Article 24 What Article 24 Requires Article 24 is short and open-ended, so most of its practical meaning comes from decisions. Supervisory authorities have answered these questions: Question Answer Source Are written policies and procedures enough? No. Internal wiki pages and high-level summaries of a security framework didn't show that the measures worked in practice. Saying a step was taken under a policy, without records of it, doesn't meet the duty to demonstrate Art. 24(1); DPC, Meta (12 breaches) Does state-of-the-art security excuse missing evidence? No. The DPC accepted that Meta's described measures were comparable to industry best practice, and still found an infringement because Meta couldn't readily demonstrate them DPC, Meta (12 breaches) Do tools that run automatically need records? Yes. Standards the tools follow, testing and reviews of them, and the logs they produce are the kind of documentation a controller should be able to supply DPC, Meta (12 breaches) Must the risk assessment cover people the service doesn't allow? Yes. TikTok's DPIA on children's data didn't address the risk of under-13s getting onto the platform, and the DPC treated that gap as an Article 24(1) infringement DPC, TikTok Can the controller rely on users changing risky defaults? No. Making children's accounts public by default and expecting them to have the technical knowledge to change it meant the risks weren't properly accounted for DPC, TikTok How often must measures be reviewed? "Where necessary" (Art. 24(1)). In the TikTok dispute, the EDPB said the appropriateness of age-verification measures changes regularly with the state of the art and risks, so they need periodic review Art. 24(1); EDPB, TikTok Who in the organisation is responsible? Management. The Norwegian authority held that security is entirely a management responsibility: tasks can be delegated, the responsibility can't Datatilsynet, Østre Toten Can Article 24 Be Fined? Not directly under the GDPR. Article 83 lists which provisions carry an administrative fine, and Article 24 isn't among them. That hasn't made Article 24 findings toothless: authorities attach the fine to a linked provision, pair it with orders, and in some countries rely on national law. Approach What happened Source The GDPR's fining provisions Art. 83(4)(a) covers the controller's and processor's obligations under Articles 8, 11, 25 to 39, 42 and 43. Article 24 falls outside that range Art. 83(4)(a) No fine, order instead The DPC imposed no fine for TikTok's Article 24 infringements because the GDPR doesn't provide one, and ordered TikTok to bring its processing into compliance DPC, 1 Sep 2023 Fine attached to Article 5(2) The DPC found Meta infringed Articles 5(2) and 24(1). The €17.000.000 fine was imposed in respect of Article 5(2), the accountability principle, which is fineable under Art. 83(5)(a) DPC, 15 Mar 2022 National law fills the gap Section 26(1) of Norway's Personal Data Act applies Art. 83(4) to Article 24, so Datatilsynet could fine Østre Toten for Articles 32 and 24 together Datatilsynet, 7 Jan 2022 Decisions finding an Article 24 infringement Article 24 rarely stands alone: each decision below paired it with other provisions. The fine shown is the total for the decision. Selected decisions: Organisation Authority Date Fine Provisions breached TikTok Technology DPC (Ireland) Sep 2023 €345.000.000 Art. 24(1) – risks to children not assessed; also Art. 5(1)(a), 5(1)(c), 5(1)(f), 12(1), 13(1)(e), 25(1) and 25(2). No fine for Art. 24 Meta Platforms Ireland (Instagram, children's data) DPC (Ireland) Sep 2022 €405.000.000 Art. 24 – risks to child users not taken into account; also Art. 5(1)(a), 5(1)(c), 6(1), 12(1), 25(1), 25(2) and 35(1) Meta Platforms Ireland (12 breaches) DPC (Ireland) Mar 2022 €17.000.000 Art. 5(2) and 24(1) – security measures couldn't be demonstrated in practice Østre Toten municipality Datatilsynet (Norway) Jan 2022 NOK 4.000.000 Art. 32 and 24 – security and internal control; Art. 5(1)(f) also infringed All Article 24 enforcement cases Recitals That Explain Article 24 Recital 74 – Responsibility and liability of the controllerThe controller's responsibility and liability for any processing it carries out, or that is carried out on its behalf, should be established. It should implement appropriate and effective measures and be able to demonstrate compliance, including the effectiveness of those measures, taking into account the nature, scope, context, purposes and risks of the processing. Recital 75 – Risks to the rights and freedoms of natural personsLists the kinds of physical, material and non-material damage processing can cause, from discrimination, identity theft and financial loss to loss of control over personal data, and names situations of particular risk, including processing of special categories of data, data of vulnerable people such as children, and large-scale processing. Recital 76 – Risk assessmentThe likelihood and severity of the risk should be judged by reference to the nature, scope, context and purposes of the processing, through an objective assessment of whether the processing involves a risk or a high risk. Recital 77 – Risk assessment guidelinesGuidance on implementing appropriate measures and demonstrating compliance can come from approved codes of conduct, approved certifications, guidelines of the Board or indications from a data protection officer. Recital 78 – Appropriate technical and organisational measuresTo demonstrate compliance, the controller should adopt internal policies and measures that meet data protection by design and by default, such as minimising data, pseudonymising it as soon as possible and giving people transparency about the processing. Checklist for Controllers Keep contemporaneous records of how your measures ran in practice, not only the policies that describe them: tickets, intake forms, review notes and logs (Meta 12 breaches) If your incident plan says something must be documented, check that it is, and that you can retrieve it when asked (Meta 12 breaches) Make sure third-party assurance reports cover the services in question; a report scoped to one product won't evidence another (Meta 12 breaches) In your risk assessments and DPIAs, cover users you don't intend to serve but can foresee, such as children under your minimum age (TikTok) Set defaults to the lower-risk option where vulnerable users are involved, instead of relying on them to change settings (TikTok, Instagram) Schedule reviews of measures such as age verification, since what counts as appropriate changes with the state of the art (EDPB, TikTok) Run risk and vulnerability analyses for all central systems and act on them: two-factor authentication, protected backups and central logging were the gaps in Østre Toten Give senior management clear ownership of the internal control system; the duty can be delegated in tasks but not in responsibility (Østre Toten) Every decision on this page asked the same question: can you show what you did, when, and why? Keeping risk assessments, DPIAs, policies and processing records in one maintained place makes that answer ready before an authority asks for it. Learn more about Secure Privacy Related Recitals (74) Responsibility and Liability of the Controller (75) Risks to the Rights and Freedoms of Natural Persons (76) Risk Assessment (77) Risk Assessment Guidelines Article 24 Enforcement Cases TikTok's €345.000.000 Fine and the Unfined Article 24 Findings Meta's €17.000.000 Fine for 12 Breaches Østre Toten Municipality's NOK 4.000.000 Fine Frequently Asked Questions about Article 24 +What does Article 24 require in practice? Measures suited to your processing and its risks, reviewed when needed, and the ability to prove they work. In the Meta decision, the DPC described this as including effective policies and incident procedures, checks that those procedures are followed, audits, and records that show the measures are effective. +Can a company be fined for breaching Article 24? Not under the GDPR alone, because Article 83 doesn't list it. The DPC imposed no fine for TikTok's Article 24 findings for that reason. Fines can still follow through linked provisions such as Article 5(2), and national law can add one, as Norway's Personal Data Act does. +How is Article 24 different from Article 5(2)? Article 5(2) makes the controller responsible for the data protection principles and able to demonstrate compliance with them. Article 24 sets out that accountability requirement in more detail, as a duty to implement and review appropriate measures across all processing. +Is having good security enough if I can't document it? No. The DPC accepted that Meta's described measures were comparable to industry best practice, but found an infringement because Meta couldn't provide records showing how they had operated in the twelve breaches. +Do my risk assessments need to cover users my terms don't allow? Where you can foresee them, yes. TikTok's terms excluded under-13s, but its DPIA didn't assess the risk of them getting onto the platform anyway, and the DPC found that gap breached Article 24(1). +Can codes of conduct or certification help? Yes, as one element. Article 24(3) says adherence to an approved code of conduct or certification mechanism may be used to demonstrate compliance, but it doesn't replace the controller's own measures. Related Key Issues GDPR Data Protection Officer GDPR Privacy by Design

Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. 1The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. 2That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. 3In particular, such measures shall ensure that by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons. An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate compliance with the requirements set out in paragraphs 1 and 2 of this Article. Related Recitals (78) Appropriate Technical and Organisational Measures Frequently Asked Questions about Article 25 + What is data protection by design and by default? Article 25 requires controllers to build data protection into processing from the outset and to ensure that, by default, only the personal data necessary for each purpose is processed. +What does data protection by default mean? By default, settings must limit the amount of data collected, the extent of processing, the storage period, and accessibility, so personal data is not made available to an indefinite number of people. + How do you implement privacy by design under the GDPR? Privacy by design is implemented through measures like pseudonymisation, data minimisation, access controls, and embedding safeguards into systems and processes at the design stage. Related Key Issues GDPR Encryption GDPR Privacy Impact Assessment

In this page Key Facts When Are You a Joint Controller? EDPB Guidance and Authority Positions Enforcement Decisions on Joint Control Joint Control in Court Recitals That Explain Article 26 Checklist: Working With Another Controller Frequently Asked Questions about Article 26 Related Articles Art. 26(1) Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner determine their respective responsibilities for compliance with the obligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their respective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement may designate a contact point for data subjects. definition and arrangement Art. 26(2) The arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint controllers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject. share the essence Art. 26(3) Irrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her rights under this Regulation in respect of and against each of the controllers. rights against each In short When two or more organisations decide together why and how personal data is processed, they're joint controllers. They have to agree who does what, especially on rights requests and privacy notices, make the essence of that agreement available to the people concerned, and accept that those people can go to either of them. Courts have found joint control for a Facebook page operator, a website embedding a Like button, and IAB Europe as author of the ad industry's consent framework. It covers only the operations each party actually helps determine, and in 2025 a German court declined to find joint control for the federal government's Facebook page. Where joint control exists, the arrangement has to be complete: one of the five findings behind Criteo's €40.000.000 fine was the failure to provide for an agreement between joint controllers. Key Facts Chapter Chapter IV – Controller and processor, Section 1: General obligations (Art. 24–31) Addressed to Two or more controllers that jointly determine the purposes and means of processing Main duty An arrangement allocating responsibilities, unless EU or national law already does, with its essence available to data subjects Does the arrangement create joint control? No. Joint control follows from jointly determining purposes and means; no formal arrangement is needed for the status to arise (CJEU, C-683/21, 5 Dec 2023) Maximum fine €10.000.000 or 2% of worldwide annual turnover, whichever is higher, under Art. 83(4)(a) National classification Spain lists a missing joint-controller agreement as a minor infringement (LOPDGDD, Art. 74(h)) Leading cases CJEU C-210/16 Wirtschaftsakademie (2018), C-40/17 Fashion ID (2019), C-683/21 Nacionalinis (2023), C-604/22 IAB Europe (2024) In force since 25 May 2018 Explained by recitals Recital 79; on liability between controllers, Recital 146 Works with Art. 4(7) (definition of controller), Art. 13 and 14 (information), Art. 28 (processors), Art. 82(4) (liability for the entire damage) When Are You a Joint Controller? Joint control depends on what each party actually decides, not on what the contract calls them. These are the situations courts and authorities have ruled on: Situation Decided by Joint control? Scope Operating a Facebook fan page CJEU, C-210/16 (2018) Yes The operator could shape Facebook's audience analysis through its settings (bITs) Embedding a Like button CJEU, C-40/17 (2019) Yes Only for collecting and transmitting visitors' data to Facebook, not what Facebook does afterwards (SCL) Behavioural retargeting with partner websites CNIL (2023) Yes, not contested The CNIL did not challenge the parties' legal qualification as joint controllers (Bird & Bird; Criteo) Setting the rules of a consent framework CJEU, C-604/22 (2024); Brussels Market Court (2025) Yes For processing TC Strings, not downstream real-time bidding (IAB Europe) A government Facebook page Administrative Court of Cologne (2025) No, at first instance Under appeal (German federal government) EDPB Guidance and Authority Positions The main Board guidance on joint control, and the clearest authority statement on what an arrangement has to cover: Topic Source Key point Who is a controller, joint controller or processor EDPB Guidelines 07/2020 (v2.0 adopted 7 Jul 2021; v2.1 with minor corrections, 20 Sep 2022) The concepts are functional: responsibilities follow the parties' actual roles, and a contract helps identify them but isn't decisive in every case What the arrangement must cover CNIL, Criteo decision (15 Jun 2023), as reported by Bird & Bird The arrangement should cover all GDPR obligations and determine, for each, which joint controller is responsible. Criteo's original arrangement left out rights requests, breach notification and DPIAs Enforcement Decisions on Joint Control In these cases, joint control shaped who was responsible and for what: Case Authority Year Joint control finding Outcome Criteo CNIL (France) 2023 Failure to provide for an agreement between joint controllers (Art. 26), one of five findings; upheld by the Conseil d'État in 2026 (EDPB) €40.000.000 IAB Europe APD (Belgium) 2022 Found a joint controller in its consent framework; the Market Court limited this to TC Strings in 2025 €250.000 German federal government Facebook page BfDI (Germany) 2023 Treated the Press Office as joint controller with Meta; annulled at first instance in 2025 Ban annulled All Article 26 cases Joint Control in Court Most of what Article 26 means in practice comes from the courts: Case What was decided Status Source Fashion ID (C-40/17), 29 Jul 2019 A site embedding a Like button is joint controller with Facebook for collecting and transmitting visitors' data, even without access to it Final Data Protection Report Nacionalinis visuomenės sveikatos centras (C-683/21), 5 Dec 2023 Joint control doesn't depend on a formal arrangement; a fine requires an intentional or negligent infringement Final HFW IAB Europe (C-604/22), 7 Mar 2024 IAB Europe can be a joint controller for TC Strings, but not automatically for participants' later processing Applied by the Market Court, 14 May 2025 Lewis Silkin Federal Press Office v BfDI (VG Köln, 13 K 1419/23), 17 Jul 2025 No joint control for the government's Facebook page; the cookie consent duty lay with Meta Appeal pending before the OVG Münster Ferner Alsdorf Criteo (Conseil d'État, No. 482872), 4 Mar 2026 Criteo's challenge to its €40.000.000 fine rejected Final Conseil d'État Recitals That Explain Article 26 Recital 79 – Allocation of the responsibilitiesProtecting people's rights, and the monitoring work of supervisory authorities, require a clear allocation of responsibilities, including where a controller determines the purposes and means of processing jointly with other controllers. Recital 146 – IndemnityExplains Art. 82 rather than Art. 26, but matters for joint controllers: where controllers or processors are involved in the same processing, each should be held liable for the entire damage, and one that has paid full compensation can bring recourse proceedings against the others. Checklist: Working With Another Controller Map where you and a platform or partner both shape the processing: embedded plugins and tags, social media pages, shared frameworks and joint programmes (Fashion ID, Wirtschaftsakademie) Define the scope. Joint control covers the operations you co-decide, not everything the other party does with the data afterwards (IAB Europe) Allocate every obligation in the arrangement, not just privacy notices: rights requests, breach notification and impact assessments were the gaps the CNIL identified (Criteo) Make the essence of the arrangement available to the people concerned, as Art. 26(2) requires Expect requests to reach you whatever the arrangement says. Under Art. 26(3) people can exercise their rights against each controller Where the position is contested, as with social media pages in Germany, document your assessment and follow the appeal (federal government page) In most website joint-control setups, the consent collected on your site is what both controllers rely on. A consent banner that blocks third-party tags until consent is given, and records which vendors each visitor agreed to, gives both parties the evidence the arrangement assumes someone holds. Learn more about Secure Privacy Related Recitals (58) The Principle of Transparency (79) Allocation of the Responsibilities Article 26 Enforcement Cases Criteo's €40M Fine: A Contract Saying Consent Exists Is Not Proof That It Does A Standard-Setter as Joint Controller: IAB Europe (Belgian DPA, €250.000) Joint Control Contested: The German Government's Facebook Page (BfDI) Frequently Asked Questions about Article 26 + Do we need a signed contract to be joint controllers? No. The Court of Justice held in C-683/21 that joint control arises from jointly determining purposes and means, not from an arrangement. But once you are joint controllers, Article 26 requires you to set out your respective responsibilities. +Does embedding a social media plugin make us a joint controller? It can. In Fashion ID the Court held a website embedding Facebook's Like button was joint controller for collecting and transmitting visitors' data to Facebook, though not for Facebook's later processing. + What must we tell individuals about the arrangement? Article 26(2) requires the essence of the arrangement to be made available to them. The arrangement may also name a contact point for data subjects. + Can someone make a request to either controller? Yes. Under Article 26(3) people can exercise their rights against each controller, whatever the arrangement says about who handles requests. + What's the difference between a joint controller and a processor? A processor acts on a controller's behalf. A joint controller helps decide the purposes and means. The EDPB's Guidelines 07/2020 treat these as functional concepts based on the parties' actual roles. +How much can a breach of Article 26 cost? Up to €10.000.000 or 2% of worldwide annual turnover under Article 83(4)(a). Joint control also affects liability for compensation: under Article 82(4) each controller involved can be held liable for the entire damage. Related Key Issues GDPR Data Protection Officer GDPR Privacy Impact Assessment GDPR Records of Processing Activities

Art. 27(1) Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union. Art. 27(2) The obligation laid down in paragraph 1 of this Article shall not apply to: (a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing — occasional/low-risk exemption (b) a public authority or body — public authority exemption Art. 27(3) The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are. Art. 27(4) The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation. Art. 27(5) The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or processor themselves. In short Article 27 GDPR requires organisations based outside the EU — but still caught by the GDPR's extraterritorial reach — to appoint a written, named representative established in the Union as a local point of contact for regulators and data subjects. Two narrow exemptions exist: occasional, low-risk processing, and public authorities. It's often called a "quick win" — cheap to satisfy, but frequently skipped by companies unaware it applies to them. Chapter Chapter 4 – Controller and processor (Art. 24–43) Applies to Controllers and processors with no EU establishment who fall under Art. 3(2)'s extraterritorial scope Maximum fine €10.000.000 or 2% of worldwide annual turnover, whichever is higher (Art. 83(4)(a)) In force since 25 May 2018 Explained by recitals 80 Closest UK equivalent UK GDPR Art. 27 (near-identical wording; representative must be based in the UK, not the EU) Who Needs an Article 27 GDPR Representative? Article 27 only bites once Article 3(2) already applies — meaning the organisation has no establishment in the EU but either offers goods or services to people in the EU (paid or free) or monitors their behaviour (analytics, tracking, profiling). If neither of those is true, Article 27 is irrelevant regardless of where the company is based. Situation Representative required? Non-EU SaaS company with paying EU customers Yes, unless an exemption applies Non-EU e-commerce site shipping to and marketing toward the EU Yes Non-EU mobile app using analytics/tracking SDKs on EU users Yes — counts as monitoring behaviour Non-EU company processing EU data only occasionally, low risk, no special-category data at scale No — Art. 27(2)(a) exemption Non-EU public authority or public body No — Art. 27(2)(b) exemption Company with a genuine EU establishment No — Article 27 doesn't apply; Article 3(2) itself doesn't trigger What Does an Article 27 Representative Actually Do? The representative is a communication relay, not a compliance substitute. They: Serve as the contact point supervisory authorities reach out to when opening an inquiry Receive and forward data-subject requests (access, erasure, objection, etc.) to the controller and help facilitate a response Must be named in the organisation's privacy notice, with contact details, per the transparency obligations in Art. 13/14 They don't manage processing activities, make governance decisions, or reduce the controller's liability. Art. 27(5) keeps the controller or processor directly liable regardless; Art. 27(4) additionally exposes the representative itself to enforcement for the represented company's non-compliance. GDPR Article 27 Fines: Enforcement Cases and Amounts Article 27 fines are smaller and less frequent than headline GDPR decisions, but they're a real and growing enforcement category — sometimes as the sole violation, sometimes as one line item within a larger multi-article fine. Organisation Authority Date Fine (Art. 27 portion) Locatefamily.com Dutch AP May 2021 €525.000 Clearview AI Garante (Italy) Feb 2022 €600.000 (of €20M total) Shanghai Moonton Technology AEPD (Spain) 2023 €90.000, reduced to €72.000 Tiger Media Inc. AEPD (Spain) 2026 €72.000 (combined with cookie violation) All Article 27 enforcement cases → Recitals That Explain Article 27 Recital 80 – Designation of a Representative Explains the purpose of the representative — ensuring effective enforcement against non-EU controllers and processors falling within Art. 3(2) scope — and confirms the representative should be explicitly designated by written mandate. Article 27 Compliance Checklist Confirm whether Article 3(2) applies at all — does the organisation offer goods/services to, or monitor, people in the EU, with no EU establishment? If so, check whether the narrow Art. 27(2) exemptions genuinely apply — most ongoing commercial activity does not qualify Appoint a representative by written mandate, established in a Member State where the relevant data subjects are located Name the representative and their contact details in the privacy notice (Art. 13/14 transparency requirement) Keep the mandate current — a representative based in a country that later leaves the EU (as UK-based representatives did after Brexit) stops counting Related Recitals (80) Designation of a Representative Article 27 Enforcement Cases Locatefamily.com's €525K Fine Clearview AI's €600K Art. 27 Fine Shanghai Moonton's €72K Fine Tiger Media's €72K Fine Frequently Asked Questions about Article 27 + What is Article 27 of the GDPR? It requires organisations with no establishment in the EU, but that offer goods or services to people in the EU or monitor their behaviour, to appoint a written, named representative based in the EU. +Who is exempt from appointing an Article 27 representative? Public authorities, and organisations whose relevant processing is occasional, doesn't involve large-scale special-category or criminal-offence data, and is unlikely to pose risk to individuals' rights. + What's the maximum fine for breaching Article 27? Up to €10 million or 2% of total worldwide annual turnover, whichever is higher (Art. 83(4)(a)) — one step below Article 5's fine tier. + Can the representative be held liable instead of the company? The representative can face enforcement under Art. 27(4) for the controller's non-compliance, but Art. 27(5) keeps the controller or processor themselves fully open to legal action regardless. + Does a UK-based representative satisfy Article 27 post-Brexit? No. Since the UK is no longer an EU member state, a representative based there no longer satisfies the EU GDPR's Article 27 requirement. + Is appointing a representative expensive? Generally not — usually a written mandate with an EU-based person or firm, with no changes required to the underlying processing. Related Key Issues GDPR Records of Processing Activities GDPR Third Countries

In this page Key Facts The Two Duties Article 28 Actually Creates What a Compliant DPA Actually Needs Article 28 vs Article 26 vs Article 24: Which Applies? What Typically Breaks Article 28 Compliance GDPR Article 28 Fines: Enforcement Cases and Amounts Recitals That Explain Article 28 Article 28 Compliance Checklist Frequently Asked Questions about Article 28 Related Key Issues and Articles Art. 28, s.1 Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures so that processing meets the Regulation's requirements and protects the rights of the data subject. selection duty Art. 28, s.3 Processing by a processor shall be governed by a contract or other legal act, binding on the processor with regard to the controller, setting out the subject-matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. binding written contract Art. 28, s.3(h) The processor shall make available to the controller all information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. audit & evidence rights Art. 28, s.10 Without prejudice to Articles 82, 83 and 84, if a processor infringes the Regulation by determining the purposes and means of processing, the processor shall be considered a controller in respect of that processing. processor becomes controller In short Article 28 is GDPR's answer to a simple fact: almost no controller processes personal data entirely by itself. A cloud host, a payroll bureau, a debt-collection contractor, a software vendor — all of them are processors, and Article 28 says two things about that relationship. First, the controller has to pick a processor that can actually meet GDPR's bar, not just the cheapest or most convenient one. Second, the relationship has to be governed by a written contract that spells out, in specific terms, what the processor is allowed to do and what it has to guarantee. Both fines documented below turn on the same missing document: a written data processing agreement (DPA) that Article 28(3) requires but that, in practice, nobody got around to signing. One case involves a debt collector handling tens of thousands of financial records; the other involves a small-town mayor's office running a public information website. The size of the organisation didn't change what Article 28 required. Key Facts Chapter Chapter 4 – Controller and processor (Art. 24–43) Applies to Every controller that engages a processor to handle personal data on its behalf, and every processor carrying out that processing Maximum fine €10.000.000 or 2% of worldwide annual turnover, whichever is higher, under the lower Art. 83(4)(a) tier that covers Art. 8, 11, 25–39, 42 and 43 In force since 25 May 2018 Explained by recitals 81 (use of processors) Depends on Art. 5(1)(f) for the integrity and confidentiality principle the contract exists to protect, Art. 32 for the specific security measures the contract must guarantee Companion provision Art. 29 requires the processor to process data only on the controller's documented instructions; Art. 30 requires both parties to keep their own records Closest UK equivalent UK GDPR Art. 28, identical wording The Two Duties Article 28 Actually Creates Article 28 runs to ten paragraphs, but it rests on two distinct obligations, and enforcement decisions treat them separately. Duty What it covers What "compliance" looks like Selection Choosing which processor to engage in the first place The controller assesses, before signing anything, whether the processor's expertise, reliability and resources can actually meet GDPR's security and reliability bar Contract Governing the relationship once a processor is engaged A written contract (or other binding legal act) sets out the mandatory content listed in Art. 28(3)(a)–(h), not a generic services agreement that never mentions data protection Both duties are the controller's responsibility, but Article 28 binds the processor directly too: a processor that ignores the contract's terms, or that acts outside the controller's instructions by deciding its own purposes for the data, can be treated as a controller in its own right under Art. 28(10) — and become directly liable rather than sheltering behind the controller. What a Compliant DPA Actually Needs Art. 28(3) lists eight things the processor must be contractually bound to do. A contract missing several of these isn't a shorter DPA — regulators treat it as no DPA at all. Ref. The processor must be bound to 28(3)(a) Process personal data only on the controller's documented instructions 28(3)(b) Ensure everyone authorised to process the data is under a confidentiality obligation 28(3)(c) Take all the security measures required under Art. 32 28(3)(d) Respect the conditions in Art. 28(2) and (4) before engaging a sub-processor 28(3)(e) Assist the controller in responding to data subject rights requests 28(3)(f) Assist the controller with its Art. 32–36 obligations (security, breach notification, DPIAs) 28(3)(g) Delete or return all personal data at the controller's choice once services end 28(3)(h) Make information available to demonstrate compliance and allow for audits Article 28 vs Article 26 vs Article 24: Which Applies? Article 28 Article 26 Article 24 Applies when An external party processes data on the controller's behalf, following the controller's instructions Two or more parties jointly determine the purposes and means of processing The controller processes data itself, alone Typical use "This vendor handles data for us — we need a written contract" "We both decide why and how this data is processed — we need an arrangement" "Are our own measures appropriate to the risk?" Instrument required A contract or other binding legal act (Art. 28(3)) A transparent arrangement setting out each party's respective responsibilities No specific instrument; the controller demonstrates compliance under Art. 5(2) Interacts with Art. 32 (the security measures the contract must guarantee), Art. 29 (processing only on instructions) Art. 82 (joint and several liability for damage) Art. 5(2) accountability principle, Art. 25 data protection by design Getting this wrong in one direction is common: a company treats a genuine joint-controller relationship as a simple vendor contract, or vice versa. Both cases below are unambiguous processor relationships — a debt-collection bureau and a website hosting provider — which is exactly why the missing Art. 28(3) contract was such a clean, easily established finding. What Typically Breaks Article 28 Compliance Neither case below involved a processor relationship no one knew existed. Both controllers were actively sending data to a known third party; the gap was narrower and more specific. Requirement What typically breaks it Governing provision Having a DPA at all The vendor relationship started informally, or predates the controller's GDPR programme, and no written contract was ever put in place to cover the processing Art. 28(3) Selecting the processor The controller doesn't (or can't) assess whether a processor's security and reliability actually meet the bar before handing over data Art. 28(1) Sub-processor authorisation The processor brings in a further vendor without the controller's prior specific or general written authorisation Art. 28(2) Security measures flowing through The contract references "appropriate security" in the abstract rather than tying it to Art. 32's actual measures Art. 28(3)(c), Art. 32 Audit rights that are real The contract grants an audit or information right on paper, but it's never exercised or the processor never actually supplies the information Art. 28(3)(h) GDPR Article 28 Fines: Enforcement Cases and Amounts Article 28 fines span a much wider range than most data subject rights provisions — from a modest sum against a small public body to a seven-figure penalty tied to tens of thousands of financial records, because Art. 28 sits within Art. 83(4)'s tier alongside broader accountability failures. Organisation Authority Decision date Fine B2 Kapital d.o.o. AZOP (Croatia) 4 May 2023 €2.265.000 Mayor of Aleksandrów Kujawski UODO (Poland) 18 Oct 2019 40.000 zł All Article 28 enforcement cases → Recitals That Explain Article 28 Recital 81 – Use of ProcessorsStates that to ensure compliance, a controller should use only processors providing sufficient guarantees, particularly in expert knowledge, reliability and resources, to meet the Regulation's requirements including for the security of processing. It confirms that this relationship should be governed by a contract or other legal act setting out the subject-matter, duration, nature and purpose of the processing, and that the controller and processor may use an individual contract or standard contractual clauses adopted by the Commission or a supervisory authority. Article 28 Compliance Checklist Put a written DPA in place with every vendor that touches personal data on your behalf — including long-standing or informal relationships that predate a formal privacy programme Vet a prospective processor's security and reliability before signing, not just its price or convenience, per Art. 28(1) Make sure the contract names every mandatory element: subject-matter, duration, nature and purpose, type of data, categories of data subjects, and the controller's rights and processor's obligations Require prior specific or general written authorisation before the processor engages any sub-processor, and flow the same obligations down the chain Build an audit mechanism into the contract that actually gets used, not just a clause that's never exercised, per Art. 28(3)(h) Update the DPA whenever the processing relationship changes — a new sub-processor, a new data type, a new hosting location Confirm the processor will delete or return all personal data at the end of the engagement, and delete existing copies unless law requires otherwise Both cases below share a root cause: a real, ongoing vendor relationship that was never put on paper in the way Art. 28(3) requires. Treating every processor relationship as needing a signed, specific agreement from day one — rather than something to formalise once a regulator asks — is what actually closes that gap. Learn more about Secure Privacy Related Recitals (81) The Use of Processors Article 28 Enforcement Cases B2 Kapital's €2.265M Fine Aleksandrów Kujawski's 40,000 zł Fine All Article 28 cases Frequently Asked Questions about Article 28 + What exactly does Article 28 GDPR require? Two things: the controller may only use processors offering sufficient guarantees to meet GDPR's requirements, and the processing relationship must be governed by a written contract (or other binding legal act) covering the eight elements listed in Art. 28(3)(a)–(h). +Who does Article 28 apply to — the controller, the processor, or both? Primarily the controller, who bears the duty to select a suitable processor and to put the contract in place. But the processor is directly bound by whatever the contract requires, and can be fined directly for breaching it — and if a processor starts determining its own purposes for the data, Art. 28(10) treats it as a controller in its own right. +Can a processor bring in a sub-processor without asking? No. Art. 28(2) requires either prior specific written authorisation for that particular sub-processor, or prior general written authorisation with the controller given the chance to object to changes. Either way, the sub-processor has to be bound by the same data protection obligations under a further contract. +What happens if there's no DPA at all? Both cases below show the answer: a straightforward Art. 28(3) finding, often paired with a lawfulness finding, since sharing data with a processor under no valid contractual basis can amount to disclosing personal data without a legal basis in the first place. +How is Article 28 different from Article 32? Art. 32 sets the actual security measures — encryption, resilience, testing — that both controllers and processors must implement. Art. 28 is the mechanism that makes those measures contractually binding on a processor in the first place; a controller can breach Art. 28 by never signing the contract, independently of whether the processor's actual security was adequate. Related Key Issues GDPR Encryption GDPR Records of Processing Activities

In this page Key Facts Who Article 29 Covers, and What Binds Them Who Looked at the Data, and Why? Access Logs and Article 29 Article 29 in Practice: The CJEU Cases Recitals Linked to Article 29 Checklist: Controllers and Processors Frequently Asked Questions about Article 29 Related Articles Art. 29 The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law. processor & staff obligation In short Article 29 says that the processor, and anyone working under the authority of the controller or the processor who has access to personal data, may process that data only on the controller's instructions. The one exception is where Union or Member State law requires them to process it. Article 32(4) puts the matching duty on the controller and processor: they must take steps to ensure people acting under their authority stick to those instructions. In Pankki S (C-579/21) in June 2023, the Court of Justice relied on Article 29 to hold that employees who consult data under the controller's authority and instructions are not "recipients". A data subject is entitled to the dates and purposes of those consultations, but as a rule not to the names of the employees who carried them out. Key Facts Chapter Chapter IV – Controller and processor (Art. 24–43) Applies to Processors, and any person acting under the authority of the controller or processor who has access to personal data. Employees and temporary staff acting under the controller's direct authority are not processors; they process data as part of the controller's entity (EDPB Guidelines 07/2020) Maximum fine Up to €10.000.000 or 2% of total worldwide annual turnover, whichever is higher. Art. 83(4)(a) covers the controller's and processor's obligations under Articles 25 to 39 In force since 25 May 2018 Related recitals Recitals 39, 40 and 74 Depends on Art. 28(3)(a) (processor acts only on documented instructions), Art. 28(10) (a processor that determines purposes and means becomes a controller for that processing), Art. 32(4) (steps to ensure staff follow instructions) and Art. 4(10) (persons under direct authority are not third parties) Implemented by Directly applicable. The exception depends on Union or Member State law that requires the processing Closest UK equivalent UK GDPR Art. 29, which keeps the rule with "domestic law" in place of "Union or Member State law" Who Article 29 Covers, and What Binds Them Article 29 is short, but it ties together several provisions. The instructions always come from the controller, whoever is doing the work: Who What binds them Source Employees and temporary staff of the controller The controller's instructions. They are part of the controller's entity, not processors Art. 29; EDPB Guidelines 07/2020 Processor The controller's documented instructions, set out in the Article 28 contract Art. 28(3)(a), Art. 29 Processor's staff The controller's instructions. The processor must ensure its authorised staff have committed to confidentiality or are under a statutory duty of confidentiality Art. 29, Art. 28(3)(b) Anyone, where the law requires processing Union or Member State law can require processing without the controller's instruction Art. 29 Processor that decides purposes and means itself Treated as a controller for that processing, without prejudice to Articles 82 to 84 Art. 28(10) A processor must immediately inform the controller if, in its opinion, an instruction infringes the GDPR or other data protection law (Art. 28(3), final subparagraph). Who Looked at the Data, and Why? Access Logs and Article 29 When employees consult a customer's data, the customer may later want to know who did it. In Pankki S the Court of Justice used Article 29 to answer that question: Question Answer Source Are employees who consult the data "recipients"? No, when they process the data under the controller's authority and in line with its instructions C-579/21, paras. 73–74 Is the data subject entitled to the dates and purposes of consultations? Yes. Both are information the data subject can obtain under Article 15(1) C-579/21, para. 83 Is the data subject entitled to the employees' identities? Not as a rule. Only where it's essential for the data subject to exercise their GDPR rights, and after taking the employees' rights and freedoms into account C-579/21, para. 83 What are access logs, legally? They correspond to records of activities under Article 30 and are among the measures a controller uses to demonstrate compliance C-579/21, para. 67 What if the data subject doubts the stated purposes? They can complain to the supervisory authority, which can order the controller to provide the information it needs C-579/21, para. 82; Art. 77(1), Art. 58(1)(a) Article 29 in Practice: The CJEU Cases Both cases arose from bank employees consulting a customer's data. Only Pankki S interprets Article 29 directly; Land Hessen shows what happens when an employee accesses data without authorisation. Case Body Outcome Pankki S: a former employee asks who consulted his customer data CJEU (First Chamber), Case C-579/21 Employees acting under Article 29 aren't recipients; dates and purposes of consultations must be given, employee identities only where essential (22 Jun 2023) Land Hessen: savings bank employee's unauthorised access CJEU (First Chamber), Case C-768/21 The bank notified the unlawful access as a personal data breach and disciplined the employee. The Court held the authority isn't obliged to impose a fine where that isn't appropriate, necessary or proportionate (26 Sep 2024) Recitals Linked to Article 29 Recital 74 – Responsibility and liability of the controllerThe controller is responsible and liable for processing carried out by it or on its behalf, and must be able to demonstrate compliance. The CJEU cited it in Pankki S when describing access logs. Recital 39 – Principles of data processingPersonal data should be processed with appropriate security and confidentiality, including to prevent unauthorised access to or use of the data and the equipment used to process it. Recital 40 – Lawfulness of data processingProcessing is lawful only on the basis of the data subject's consent or another legitimate basis laid down by law. Checklist: Controllers and Processors Controller: set clear instructions on which roles may access which data, and for what purpose (Art. 29, Art. 32(4)) Controller: log consultations with date and purpose; the CJEU treated such logs as records of activities (Pankki S, para. 67) Controller: when answering an access request, give the dates and purposes of consultations; withhold staff names unless they're essential and the balance favours disclosure (Pankki S) Controller: keep access logs long enough to investigate misuse; in Land Hessen the authority asked the bank to keep them for longer than three months Processor: process only on the controller's documented instructions, and tell the controller immediately if an instruction seems to infringe the GDPR (Art. 28(3)) Processor: make sure staff with access are bound by confidentiality (Art. 28(3)(b)) Article 29 comes down to two records: what each processing activity is for, and who is allowed to carry it out. Keeping both current makes it simple to show an authority that access matched instructions. Learn more about Secure Privacy Related Recitals (39) Principles of Data Processing (40) Lawfulness of Data Processing (74) Responsibility and Liability of the Controller Frequently Asked Questions about Article 29 +Does Article 29 require written instructions? Article 29 itself refers only to "instructions". For processors, Article 28(3)(a) requires the contract to state that the processor acts only on documented instructions from the controller. +Are employees processors under the GDPR? No. According to the EDPB, employees and other persons acting under the controller's direct authority, such as temporary staff, process data as part of the controller's entity. They are bound by the controller's instructions through Article 29. + Can I find out which employee looked at my data? Usually not their names. In Pankki S the CJEU held that you're entitled to the dates and purposes of the consultations, and to employee identities only where that's essential to exercise your rights, after the employees' rights are taken into account. + When can staff process data without the controller's instructions? Only where Union or Member State law requires them to process it. Article 29 contains no other exception. +What happens if a processor ignores the controller's instructions? If it determines the purposes and means of processing itself, Article 28(10) treats it as a controller for that processing, without prejudice to the liability and penalty rules in Articles 82 to 84. +Must an authority fine a company whose employee snooped on customer data? No. In Land Hessen (C-768/21) the CJEU held that the authority must react appropriately but isn't obliged to impose a fine where that isn't appropriate, necessary or proportionate, for example where the controller has already taken the measures needed to end the breach and prevent it recurring. Related Key Issues GDPR Encryption GDPR Data Protection Officer GDPR Privacy by Design

In this page Key Facts What the Record Must Contain Controller Records vs Processor Records What Typically Breaks Article 30 Compliance GDPR Article 30 Fines: Enforcement Cases and Amounts Recitals That Explain Article 30 Article 30 Compliance Checklist Frequently Asked Questions about Article 30 Related Key Issues and Articles Art. 30(1)(a) The name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the DPO. controller identity Art. 30(1)(b) The purposes of the processing. purposes Art. 30(1)(c) A description of the categories of data subjects and of the categories of personal data. categories of data Art. 30(1)(d) The categories of recipients to whom the data have been or will be disclosed, including recipients in third countries or international organisations. recipients Art. 30(1)(e) Where applicable, transfers to a third country or international organisation, the identification of that country or organisation, and the documentation of the safeguard used. international transfers Art. 30(1)(f) Where possible, the envisaged time limits for erasure of the different categories of data. retention periods Art. 30(1)(g) Where possible, a general description of the technical and organisational security measures referred to in Art. 32(1). security measures Art. 30(2) A processor must separately keep a record of every category of processing carried out on behalf of each controller, covering the processor's own identity, the categories of processing, transfers and their safeguards, and a general description of security measures. processor record Art. 30(3) The records must be in writing, including in electronic form. form Art. 30(4) The controller, the processor and their representatives must make the record available to a supervisory authority on request. availability on request Art. 30(5) Organisations with fewer than 250 employees are exempt, unless the processing is likely to result in a risk to data subjects' rights and freedoms, is not occasional, or includes special category data under Art. 9(1) or criminal-conviction data under Art. 10. small-enterprise exception In short Article 30 is the GDPR's paperwork requirement: an internal inventory, kept by the controller and separately by the processor, of what personal data is processed, why, who sees it, where it goes, how long it is kept and what protects it. It is rarely the only finding in a decision. Regulators reach for it once they have already found a substantive problem elsewhere, because a record that is missing, generic or contradicted by the facts is itself evidence that the controller did not actually understand its own processing. Both enforcement cases below follow that pattern. Deliveroo and Foodinho were fined primarily over the algorithms used to manage their riders, but in each case the Italian Garante also found the underlying record of processing did not match what the algorithm was actually doing, particularly around retention periods and the safeguards applied to automated decisions. Key Facts Chapter Chapter 4 – Controller and processor (Art. 24–43) Applies to Every controller and processor, except organisations under 250 employees whose processing is occasional, low-risk, and does not involve special category or criminal-conviction data Maximum fine €10.000.000 or 2% of worldwide annual turnover, whichever is higher, since Art. 30 sits among the controller's and processor's obligations under Art. 83(4)(a) In force since 25 May 2018 Explained by recitals 82, 13 Depends on Art. 5(2) for the accountability principle the record is meant to evidence Companion provision Art. 24 requires the controller to be able to demonstrate compliance generally; Art. 30 is the specific documentation format that demonstration usually takes Closest UK equivalent UK GDPR Art. 30, identical wording What the Record Must Contain Article 30 splits into two separate obligations, one for controllers and one for processors, each with its own list of required content. # Item What it requires Provision 1 Controller identity Name and contact details of the controller, any joint controller, its representative and the DPO Art. 30(1)(a) 2 Purposes Each purpose the processing serves Art. 30(1)(b) 3 Categories of data The categories of data subjects and the categories of personal data collected on them Art. 30(1)(c) 4 Recipients Categories of recipients the data has been or will be disclosed to, including in third countries Art. 30(1)(d) 5 International transfers The destination country or organisation and the safeguard documentation for any transfer outside the EEA Art. 30(1)(e) 6 Retention periods Envisaged erasure time limits for each category of data, where possible Art. 30(1)(f) 7 Security measures A general description of the technical and organisational measures under Art. 32(1) Art. 30(1)(g) Controller Records vs Processor Records Controller record (Art. 30(1)) Processor record (Art. 30(2)) Who keeps it The controller and, where applicable, its representative The processor and, where applicable, its representative, separately from the controller's own record Organised around Each processing purpose the controller runs Each category of processing carried out on behalf of each controller Content required The seven items listed above Its own identity and that of each controller it processes for, the categories of processing performed, transfers and their safeguards, and a general description of security measures Purposes and retention Must state its own purposes and, where possible, retention periods Not required to state purposes or retention, since these belong to the controller In practice, a company is often both: a controller for its own HR and marketing data, and a processor for whatever it handles on behalf of clients. Both records have to exist side by side, and a processor's record does not substitute for the controller's. How Article 24 interacts with Article 30. Article 24 sets the general duty to be able to demonstrate compliance with the GDPR; Article 30 is the concrete artefact regulators most often ask for to test that duty. A controller can, in principle, demonstrate compliance some other way, but in practice an incomplete or absent record of processing is treated as first-order evidence that the accountability principle in Art. 5(2) has not been met. What Typically Breaks Article 30 Compliance Most Article 30 findings are not about having no record at all. They are about a record that exists but does not reflect what the processing actually does. Requirement What typically breaks it Governing provision Retention periods A flat, uniform retention period applied across very different categories of data, rather than a period tied to what each category is actually used for Art. 30(1)(f) Automated decision-making The record does not capture that an algorithm makes or materially shapes decisions about data subjects, so the safeguards that Art. 22 requires are never mapped to a specific processing entry Art. 30(1)(b), Art. 22(3) Categories of data Granular data actually collected, such as continuous device geolocation, is not distinguished from the coarser category the record describes Art. 30(1)(c) Security measures The general description of technical and organisational measures is not updated as new systems are added to the processing it is supposed to describe Art. 30(1)(g) Availability on request The record cannot be produced promptly and in full when a supervisory authority asks for it during an inspection Art. 30(4) GDPR Article 30 Fines: Enforcement Cases and Amounts Article 30 rarely stands as the sole finding in a decision; the four cases below show it turning up alongside very different underlying problems, from gig-economy algorithms to a car maker's test fleet to an industry standard body's own flagship product. Organisation Authority Decision date Fine Deliveroo Italy s.r.l. Garante (Italy) 22 Jul 2021 €2.500.000 Foodinho s.r.l. Garante (Italy) 10 Jun 2021 €2.600.000 IAB Europe APD (Belgium) 2 Feb 2022 €250.000 Volkswagen AG LfD Niedersachsen (Germany) 26 Jul 2022 €1.100.000 All Article 30 enforcement cases → Recitals That Explain Article 30 Recital 82 – Record of Processing ActivitiesExplains why the record exists: to let the controller and processor demonstrate compliance with the Regulation, each must be obliged to cooperate with the supervisory authority and make its record available on request, so the authority can use it to monitor the processing. Recital 13 – Taking Account of Micro, Small and Medium-Sized EnterprisesThe basis for the small-enterprise exception in Art. 30(5): the Regulation takes account of the specific needs of micro, small and medium enterprises, which is why organisations under 250 employees are relieved of the record-keeping duty unless their processing carries a particular risk. Article 30 Compliance Checklist Keep a separate, written record for every role the organisation plays: one as controller, one as processor, if it is both List every purpose separately; do not fold several distinct purposes into one generic entry Match the categories of data in the record to what is actually collected, including data gathered incidentally by a monitoring or geolocation system, not only what the privacy notice describes Give a concrete retention period, or the criteria that fix one, per category of data, rather than one flat period applied to everything Where a system under Art. 22 makes or shapes decisions about people, record that fact and map it to the safeguards actually in place Name the destination and safeguard for any transfer outside the EEA, not just a general statement that transfers occur Update the general description of security measures whenever the systems it describes change Be able to produce the full, current record to a supervisory authority on request, not a version that predates recent changes to the processing Treat the record as internal working documentation to keep current, not a one-off compliance exercise completed at the time of GDPR implementation Both cases below share a pattern: the gap wasn't a missing record, it was a record that no longer matched what an automated system was actually doing. Keeping the record synced to what a data inventory shows, rather than reviewing it only when asked, is the underlying fix. Secure Privacy's platform is built around that kind of ongoing sync. Learn more about Secure Privacy Related Recitals (13) Taking Account of Micro, Small and Medium-Sized Enterprises (82) Record of Processing Activities Article 30 Enforcement Cases Deliveroo's €2.5M Fine Foodinho's €2.6M Fine IAB Europe's €250K Fine Volkswagen's €1.1M Fine All Article 30 cases   Frequently Asked Questions about Article 30 +What must a record of processing activities contain? For a controller: its own identity and contact details, the purposes of each processing activity, the categories of data subjects and data, the categories of recipients, any international transfers and their safeguards, envisaged retention periods, and a general description of security measures. A processor keeps a separate, shorter record centred on the categories of processing it performs for each controller. +Does Article 30 apply to small businesses? Organisations with fewer than 250 employees are exempt under Art. 30(5), but only if the processing is occasional, is not likely to risk data subjects' rights and freedoms, and does not involve special category data under Art. 9 or criminal-conviction data under Art. 10. In practice, most small businesses run at least one processing activity, such as ongoing HR administration, that is not "occasional," so the exception is narrower than it first appears. +Is Article 30 usually the main finding in a fine, or a secondary one? Usually secondary. In both Deliveroo and Foodinho, the headline issue was the lack of transparency and safeguards around an automated management system; the Art. 30 finding came from the record of processing not accurately reflecting what that system did, particularly on retention and automated decision-making. +Who can request to see the record of processing? A supervisory authority, on request, under Art. 30(4). The record is an internal accountability document, not something the GDPR requires be published or given to individual data subjects on request, though the categories of information it contains overlap with what Articles 13 and 14 require to be disclosed to data subjects directly. +Does having a record of processing automatically satisfy Article 30? No. Both cases below had some form of documentation in place. The findings were about specific gaps: a retention period that did not correspond to the actual purpose of the data, and automated decision-making that was not adequately captured or safeguarded within the record. Existence of a document is not the same as its accuracy. Related Key Issues GDPR Privacy Impact Assessment GDPR Third Countries

The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance of its tasks. Related Recitals (82) Record of Processing Activities Frequently Asked Questions about Article 31 + What does Article 31 GDPR require? Article 31 requires controllers and processors to cooperate with the supervisory authority on request in the performance of its tasks. +Must companies cooperate with data protection authorities? Yes. Cooperation is a legal obligation, and organisations must respond to requests from the supervisory authority and support its investigative and corrective functions. + How does Article 31 support GDPR enforcement? By requiring cooperation, Article 31 enables authorities to investigate complaints, audit processing, and take corrective action effectively when handling data protection matters. Related Key Issues GDPR Fines / Penalties GDPR Privacy Impact Assessment

  In this page Key Facts What "Appropriate" Security Actually Means Which Security Measures Fit Which Situation Article 32 in Practice: The Enforcement Cases Recitals That Explain Article 32 Checklist: Article 32 Compliance Frequently Asked Questions about Article 32 Related Articles Art. 32(1)(a) Taking into account the state of the art, implementation costs, and the nature, scope, context and risk of the processing, controllers and processors shall implement the pseudonymisation and encryption of personal data as appropriate. Technical measure Art. 32(1)(b) The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services. Technical measure Art. 32(1)(c) The ability to restore availability and access to personal data in a timely manner following a physical or technical incident. Technical measure Art. 32(1)(d) A process for regularly testing, assessing and evaluating the effectiveness of the technical and organisational measures in place. Organisational measure Art. 32(2) The appropriate level of security must account for the risks presented by processing — in particular accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to personal data. Risk assessment Art. 32(3) Adherence to an approved Art. 40 code of conduct or an approved Art. 42 certification may be used to demonstrate compliance with paragraph 1. Compliance evidence Art. 32(4) Controllers and processors must ensure that any person acting under their authority with access to personal data processes it only on the controller's instructions, unless required to do otherwise by law. Access control In short Article 32 is the GDPR's security backbone. It requires controllers and processors to put technical and organisational measures in place that match the actual risk their processing poses, not a fixed checklist. Pseudonymisation and encryption, resilient systems, the ability to recover from an incident, and a process for regularly testing all of it are named as examples of what "appropriate" can look like, but there's no single compliant configuration; it depends on the state of the art, the cost of implementing it, and how much harm a breach could do. Unlike some of its neighbouring articles, Article 32 is directly finable, and it's one of the most heavily cited provisions in enforcement history — because a data breach is usually the event that exposes a security failure a regulator can point to directly. The cases below show what that looks like once a data breach turns into a formal Article 32 finding. Key Facts Chapter Chapter IV – Controller and processor (Art. 24–43), Section 2 – Security of personal data (Art. 32–34) Applies to Every controller and every processor, for every processing activity, regardless of size or sector Maximum fine Up to €10,000,000 or 2% of total worldwide annual turnover, whichever is higher (Art. 83(4)) In force since 25 May 2018 Explained by recitals 83 Depends on Art. 25 sets complementary design obligations; Art. 35 DPIAs feed the risk assessment Art. 32(2) requires Implemented by Internal security policies, encryption and pseudonymisation controls, access management, and incident testing procedures Closest UK equivalent UK GDPR Art. 32, substantively unchanged post-Brexit What "Appropriate" Security Actually Means Article 32 doesn't hand out a list of mandatory controls; it hands out a method. Controllers and processors are expected to weigh four things — the state of the art, the cost of implementing a given measure, the nature and scope of the processing, and the risk to the people whose data it is — and land on measures proportionate to that risk. Pseudonymisation and encryption are named as examples, not requirements for every processing activity; they're expected wherever the sensitivity of the data or the consequences of exposure justify them. That risk-based framing cuts both ways. It means a small business handling a handful of contact records isn't held to the same standard as a company processing health or financial data at scale — but it also means "we didn't think it was necessary" is not, on its own, a defence. Regulators expect the risk assessment itself to be documented, and "appropriate" is judged against the state of the art at the time, so a measure that was reasonable in 2018 can be indefensible today. Which Security Measures Fit Which Situation Because Article 32 is deliberately open-ended, most of the practical guidance on what it requires comes from how regulators have applied it after something went wrong, rather than from the text itself. Situation Likely expectation under Art. 32 Large volumes of special-category or financial data (health records, card numbers) High risk profile; encryption, strict access control, and regular penetration testing expected A small business holding basic contact details for a handful of clients Lower risk profile; proportionate measures such as access controls and routine patching may suffice A processor operating infrastructure on the controller's behalf Independently bound by Art. 32; can't rely solely on the controller's instructions to excuse weak security An organisation that never re-tests or audits its security measures after go-live Non-compliant with Art. 32(1)(d), regardless of how strong the original measures were Employees or contractors with standing access to personal data outside their role Breaches the Art. 32(4) requirement that access be tied to instructions from the controller The cases below are where this got tested for real — two of the largest early UK fines, both turning on gaps this table describes. Article 32 in Practice: The Enforcement Cases Article 32 is one of the most frequently cited articles in enforcement decisions, because a data breach is usually the trigger that brings a regulator in, and the breach itself is treated as evidence that security wasn't "appropriate to the risk." Two of the largest early UK cases both turned on Article 32 findings. Case Authority Outcome British Airways plc ICO (UK), 16 Oct 2020 £20,000,000 fine for failing to have appropriate security measures in place, allowing attackers to skim payment data undetected for over two months Marriott International, Inc. ICO (UK), 30 Oct 2020 £18,400,000 fine for infringing Art. 5(1)(f) and Art. 32 after inherited Starwood systems went undetected-compromised from 2014, exposing 339 million guest records All Article 32 enforcement cases → Recitals That Explain Article 32 Recital 75 – Risks to the Rights and Freedoms of Natural PersonsSets out the kinds of harm — discrimination, identity theft, financial loss, reputational damage among them — that inadequate security under Article 32 is meant to guard against. Recital 76 – Risk AssessmentExplains that the likelihood and severity of risk should be determined by reference to the nature, scope, context and purposes of the processing, the same factors Art. 32(1) uses to judge "appropriate" security. Recital 77 – Risk Assessment GuidelinesPoints to guidance from the Commission, the Board and supervisory authorities as a source for how to carry out the risk assessment Article 32 requires. Recital 78 – Appropriate Technical and Organisational MeasuresLinks Article 32's security measures to the data-protection-by-design obligations of Article 25, framing both as expressions of the same underlying principle. Recital 79 – Allocation of the ResponsibilitiesNotes that responsibility for security measures should be clearly allocated between joint controllers and between controllers and processors. Recital 83 – Security of ProcessingExplains the risk-based approach behind Article 32: controllers and processors should evaluate the risks their processing presents and mitigate them with measures such as encryption, taking into account the state of the art and the costs of implementation. Checklist: Article 32 Compliance Run a documented risk assessment per processing activity before choosing security measures; "appropriate" is measured against that risk, not a generic standard Apply pseudonymisation and encryption wherever the data's sensitivity or the risk of unauthorised access justifies it, particularly for special-category and financial data Build in a process for regularly testing, assessing and evaluating your measures under Art. 32(1)(d); a one-off setup at go-live is not enough Restrict access to personal data to what each role requires, and ensure access is only ever exercised on the controller's instructions (Art. 32(4)) Processors: don't assume the controller's instructions cover security; Art. 32 binds you independently, alongside whatever your Art. 28 processing agreement says Revisit measures whenever the state of the art moves on; a control that was defensible at launch can become inadequate over time Related Recitals (75) Risks to the Rights and Freedoms of Natural Persons (76) Risk Assessment (77) Risk Assessment Guidelines (78) Appropriate Technical and Organisational Measures (79) Allocation of the Responsibilities (83) Security of Processing Article 32 Enforcement Cases British Airways GDPR Fines Marriott's £18.4M Fine Frequently Asked Questions about Article 32 + What does Article 32 of the GDPR require? Controllers and processors must implement technical and organisational measures appropriate to the risk of their processing, taking into account the state of the art, implementation costs, and the nature and purpose of the processing. Pseudonymisation, encryption, resilient systems, incident recovery, and regular testing are named as examples. +Does Article 32 require encryption? Not always. Encryption is listed as an example measure, to be used "as appropriate" given the risk. High-risk processing — special-category or financial data — generally warrants it; lower-risk processing may only need other proportionate measures. +Who is responsible for Article 32 compliance, the controller or the processor? Both. Article 32 binds controllers and processors independently, so a processor can't rely solely on the controller's instructions to excuse inadequate security, and a controller remains responsible for choosing processors that can meet Article 32's requirements. +What happens if a company breaches Article 32? Article 32 is directly finable under Art. 83(4), with fines of up to €10,000,000 or 2% of global annual turnover, whichever is higher. In practice, most Article 32 findings surface during the investigation of an actual data breach, as in the British Airways and Marriott cases. Related Key Issues GDPR Data Protection Officer GDPR Privacy by Design

In this page Key Facts What Article 33 Requires When the 72-Hour Clock Starts Fines issued under Article 33 Recitals That Explain Article 33 Checklist: Controllers and Processors Frequently Asked Questions about Article 33 Related Articles Art. 33(1) In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay. 72-hour notification Art. 33(2) The processor shall notify the controller without undue delay after becoming aware of a personal data breach. processor to controller Art. 33(3) The notification referred to in paragraph 1 shall at least: describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; describe the likely consequences of the personal data breach; describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. minimum content Art. 33(4) Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay. notification in phases Art. 33(5) The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article. internal breach record In short When personal data are breached, the controller has to tell its supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. If the investigation isn't finished, the information can follow in phases. Every breach, notified or not, goes into an internal record that the authority can use to check compliance. Regulators have enforced each part of the Article separately. The Dutch authority fined Booking.com €475.000 for notifying 22 days late, and the Irish DPC fined Twitter €450.000 for a late notification and an inadequate breach record. Against Meta, the DPC imposed €11.000.000 for an incomplete notification and missing record, and €16.000.000 for a breach it never notified in time. Key Facts Chapter Chapter IV – Controller and processor, Section 2: Security of personal data (Art. 32–34) Applies to Controllers, which notify the supervisory authority; processors, which notify the controller (Art. 33(2)) Deadline Without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach. A later notification must give reasons for the delay Maximum fine Up to €10.000.000 or 2% of total worldwide annual turnover, whichever is higher (Art. 83(4)(a)) In force since 25 May 2018 Explained by recitals Recitals 85, 87 and 88 Depends on Art. 4(12) (definition of personal data breach), Art. 55 and Art. 56 (which authority to notify) and Art. 32 (security of processing) Works with Art. 34: where the breach is likely to result in a high risk, the data subjects must also be told Official guidance EDPB Guidelines 9/2022 on personal data breach notification, version 2.0, adopted 28 March 2023 Pending change The Commission's Digital Omnibus proposal (COM(2025) 837, 19 Nov 2025) would raise the threshold to "high risk", extend the deadline to 96 hours and add a single entry point for notifications. It is not law: the European Parliament is still handling it in committee EU institutions Not covered. EU institutions and bodies notify the European Data Protection Supervisor under Regulation (EU) 2018/1725, which replaces the GDPR for them (Art. 2(3)) Closest UK equivalent UK GDPR, Article 33 (retained with the same 72-hour deadline) What Article 33 Requires Article 33 sets out five obligations. Supervisory authorities and the EDPB have clarified how each one works in practice: Question Answer Source Does every breach have to be notified? No. Notification is required unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where data end up with an unauthorised person, the Dutch authority held that a risk already exists Art. 33(1); AP, Booking.com Can I wait until the investigation is complete? No. An investigation can take longer than 72 hours, which is why Art. 33(4) allows the information to follow in phases. The initial notification still has to meet the deadline Art. 33(4); AP, Booking.com What does a late notification need? Reasons for the delay Art. 33(1) What must the notification contain? At least the four elements in Art. 33(3). Leaving out information the controller could and should have included is a separate infringement Art. 33(3); DPC, Meta (token breach) Which breaches must be documented? Any personal data breach, including those not notified. The record must cover the facts, effects and remedial action, and let the authority verify compliance Art. 33(5) Is incident-management paperwork enough as a record? Not by itself. The DPC held that general reports and internal communications weren't a record of a personal data breach, and that the record must also explain any delay and the risk assessment Art. 33(5); DPC, Twitter Where does a non-EU controller notify? Having an EU representative under Art. 27 doesn't trigger the one-stop-shop, so the breach must be notified to every authority in whose Member State affected data subjects live EDPB Guidelines 9/2022, para. 73 When the 72-Hour Clock Starts The deadline runs from the moment the controller becomes "aware" of the breach. Under the EDPB guidelines, that is when the controller has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised. Authorities have been strict about how early that point arrives: Situation What the authority decided Source Warnings reached front-line staff but weren't escalated Booking.com was aware on 13 January 2019, when a hotel reported a second, similar fraud attempt, not on 4 February when its security team finished investigating. Staff breaching the company's own escalation policy was attributed to the company AP, 10 Dec 2020 The processor knew but the controller's DPO didn't Twitter International ought to have been aware by 3 January 2019, when its processor assessed a potential breach, even though it was actually told on 7 January. The controller's duty can't depend on the processor's compliance with Art. 33(2) DPC, 9 Dec 2020 The delay fell over a holiday period Not accepted. Risks to data subjects can't be put on hold because of a weekend or public holiday, especially when the service itself keeps running DPC, 9 Dec 2020 Internal data were found stored insecurely Plaintext password logs were each a personal data breach under Art. 4(12), even without external access; notification was due within 72 hours of their discovery on 31 January 2019 DPC, 26 Sep 2024 (case covered on our Meta Article 5 page) Fines issued under Article 33 Each decision below turned on a different part of Article 33: timing, content or documentation. Selected decisions: Organisation Authority Date Fine Provision breached Meta Platforms Ireland ("View As" token breach) DPC (Ireland) Dec 2024 €11.000.000 Art. 33(3) and 33(5) – notification left out required information; no contemporaneous record. Total fines €251.000.000, including Art. 25 Meta Platforms Ireland (plaintext passwords) DPC (Ireland) Sep 2024 €16.000.000 Art. 33(1) and 33(5) – breach not notified within 72 hours and not documented. Total fines €91.000.000, including Art. 5(1)(f) and 32(1) Booking.com AP (Netherlands) Dec 2020 €475.000 Art. 33(1) – breach notified 22 days late Twitter International DPC (Ireland) Dec 2020 €450.000 Art. 33(1) and 33(5) – late notification after a processor delay; inadequate breach record All Article 33 enforcement cases Recitals That Explain Article 33 Recital 85 – Notification obligation of breaches to the supervisory authorityA breach not addressed in time can cause physical, material or non-material damage, such as loss of control over data, identity theft or fraud. The controller should notify without undue delay and, where feasible, within 72 hours, unless it can show, in line with the accountability principle, that the breach is unlikely to result in a risk. Late notifications give reasons, and information may follow in phases. Recital 87 – Promptness of reporting / notificationThe controller should check that it has the technical and organisational measures in place to establish immediately whether a breach has happened. Whether a notification was made without undue delay depends on the nature and gravity of the breach and its consequences, and the notification may lead the authority to intervene. Recital 88 – Format and procedures of the notificationRules on the format and procedure should take into account the circumstances of the breach, including whether the data were protected by technical measures that limit the likelihood of identity fraud, and the legitimate interests of law-enforcement authorities where early disclosure could hamper an investigation. Checklist: Controllers and Processors Controller: route every suspected incident to the team that assesses breaches straight away, including reports from partners and customers (Booking.com) Controller: make sure the DPO or privacy lead is automatically part of the incident workflow, and staff the process over weekends and holidays (Twitter) Controller: notify within 72 hours with what you know, and send the rest in phases under Art. 33(4) rather than waiting for the full investigation (Booking.com) Controller: fill in every Art. 33(3) element you can already answer, including the categories of data subjects and records and the likely consequences (Meta token breach) Controller: keep a dedicated, contemporaneous record for every breach, notified or not, including the reasons for any delay and how you assessed the risk (Twitter, Meta passwords) Processor: tell the controller without undue delay; your delay can still count against the controller (Art. 33(2); Twitter) Non-EU controller: plan to notify each authority where affected data subjects live (EDPB Guidelines 9/2022, para. 73) Everyone: keep working to the 72-hour rule; the 96-hour Digital Omnibus proposal isn't law Each of these cases came down to evidence: when the organisation knew, what it reported and what it wrote down. A breach register that sits next to your records of processing makes that evidence ready before the authority asks for it. Learn more about Secure Privacy Related Recitals (85) Notification Obligation of Breaches to the Supervisory Authority (87) Promptness of Reporting / Notification (88) Format and Procedures of the Notification Article 33 Enforcement Cases Meta's "View As" Token Breach Fine Meta's Plaintext Passwords Fine (Meta Article 5 case page) Booking.com's €475.000 Fine Twitter International's €450.000 Fine Frequently Asked Questions about Article 33 + When does the 72-hour deadline start? When the controller becomes aware of the breach, meaning it has a reasonable degree of certainty that a security incident has compromised personal data. Authorities look at when the organisation should have known: in Booking.com, that was the second warning from a hotel, weeks before the security team finished its review. +What if I don't have all the facts within 72 hours? Notify anyway. Article 33(4) lets you provide the information in phases without undue further delay. The Dutch authority rejected the argument that a thorough investigation justified a late initial notification. + Do breaches I don't notify still need to be recorded? Yes. Article 33(5) covers any personal data breach. The record should set out the facts, effects and remedial action in a way that lets the supervisory authority verify compliance. + Is my processor responsible for notifying the authority? No. The processor notifies the controller without undue delay (Art. 33(2)); the controller notifies the authority. In Twitter, the DPC held the controller liable for the delay even though it arose at its processor. + How does Article 33 differ from Article 34? Article 33 covers notifying the supervisory authority, unless the breach is unlikely to result in a risk. Article 34 covers telling the affected individuals, which is required only where the breach is likely to result in a high risk. + Has the deadline changed to 96 hours? No. The Digital Omnibus proposal would move to 96 hours and a "high risk" threshold, and the EDPB and EDPS supported both changes in their Joint Opinion of February 2026. Until the co-legislators adopt it, the 72-hour rule applies. Related Key Issues GDPR Data Protection Officer GDPR Fines / Penalties

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3). The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met: the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption; the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise; it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner. If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met. Related Recitals (86) Notification of Data Subjects in Case of Data Breaches (87) Promptness of Reporting / Notification (88) Format and Procedures of the Notification Frequently Asked Questions about Article 34 + When must individuals be told about a data breach? Article 34 requires controllers to inform affected individuals without undue delay when a personal data breach is likely to result in a high risk to their rights and freedoms. +When is notifying individuals about a breach not required? Notification is not required if the data was encrypted or otherwise unintelligible, if subsequent measures removed the high risk, or if it would involve disproportionate effort, in which case a public communication may suffice. + What should a breach notice to individuals contain? It must describe the breach in clear language and include the contact point for more information, the likely consequences, and the measures taken or proposed to address it. Related Key Issues GDPR Data Protection Officer GDPR Right to be Informed

In this page Key Facts Does This Processing Actually Need a DPIA? Who Carries the Burden When a Vendor Built the System? GDPR Article 35 Fines: Enforcement Cases and Amounts Recitals That Explain Article 35 Article 35 Compliance Checklist Frequently Asked Questions about Article 35 Related Key Issues and Articles Art. 35(1) Where a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. high-risk trigger Art. 35(2) The controller shall seek the advice of the data protection officer, where one is designated, when carrying out a data protection impact assessment. DPO consulted Art. 35(3) An assessment is required in particular for: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal or similarly significant effects; large-scale processing of special category or criminal offence data; or systematic monitoring of a publicly accessible area on a large scale. mandatory cases Art. 35(7) The assessment shall contain at least: a systematic description of the envisaged processing and its purposes; an assessment of necessity and proportionality; an assessment of the risks to the rights and freedoms of data subjects; and the measures envisaged to address those risks. minimum content Art. 35(9) Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of the processing. consultation Art. 35(11) Where necessary, the controller shall carry out a review to assess whether processing is performed in accordance with the assessment, at least when there is a change in the risk represented by the processing. kept current In short Article 35 doesn't prohibit anything. It is the discipline that has to happen before a high-risk processing operation goes live: a documented assessment of what the processing is, whether it's necessary and proportionate, what could go wrong for the people affected, and what will be done about it. Article 35(1) requires this prior to the processing, not as a document written up afterwards to answer a regulator's question. The practical consequence is that an organisation can have a privacy policy, signed contracts with every vendor, and a folder of paperwork labelled "DPIA," and still be in breach of Article 35 if none of it actually assessed the risk of the specific high-risk processing it deployed. Every fine below turns on exactly that gap: a system went live before its risk was ever genuinely assessed, or the document on file wasn't a real assessment. Key Facts Chapter Chapter 4 – Controller and processor (Art. 24–43), Section 3 – Data protection impact assessment and prior consultation (Art. 35–36) Applies to Every controller, before starting a type of processing likely to result in a high risk to individuals' rights and freedoms Maximum fine €10.000.000 or 2% of worldwide annual turnover, whichever is higher, for the Article 35 obligation on its own (Art. 83(4)(a)). Where the same processing also breaches a higher-tier provision such as Art. 6 or 9, the total fine is capped at the amount for the gravest infringement, which can run well above the Article 35 ceiling alone In force since 25 May 2018 Explained by recitals 84, 90, 91, 92 Depends on Art. 24 for the controller's general accountability duty, Art. 39(1)(c) for the DPO's role in a DPIA, Art. 36 for consulting the supervisory authority where residual risk stays high Who else publishes triggers National supervisory authorities publish their own list of processing types requiring a DPIA under Art. 35(4); both the Garante and the AEPD have issued one Closest UK equivalent UK GDPR Art. 35, identical wording; the ICO maintains a separate Art. 35(4) list Does This Processing Actually Need a DPIA? Article 35(3) names three cases where an assessment is mandatory, but the language is abstract enough that real deployments slip past it. This is where each of the fines below actually started. Trigger What's typically missed Governing provision Systematic, automated evaluation of a person, including profiling, that produces legal or similarly significant effects A scoring or shift-assignment algorithm is treated as an operational rollout rather than as processing that decides who gets work Art. 35(3)(a) Large-scale processing of special category data (Art. 9) or criminal offence data (Art. 10) Biometric identifiers such as a face or voice template are treated as a convenience feature rather than as special category data in their own right Art. 35(3)(b) Systematic monitoring of a publicly accessible area on a large scale Camera or location-based monitoring is assumed to be low-risk because the area itself is public Art. 35(3)(c) Any criteria on the supervisory authority's own published DPIA list The national list under Art. 35(4) is never checked because Art. 35(3) is read as the complete test Art. 35(4) A new technology deployed at scale, even where the underlying data type is familiar "We've always processed this kind of data" is used to skip a fresh assessment of the new method of processing it Art. 35(1), Recital 91 Who Carries the Art. 35 Burden When a Vendor or Platform Built the System? This is the judgment call that catches every organisation that buys rather than builds its algorithm, its biometric kiosk, or its platform. The Article 35 obligation sits with the controller deploying the system, whoever engineered it. Arrangement Who must carry out the DPIA What that means in practice You build and run the automated system in-house You, as controller Run the assessment before launch, and again whenever you retrain the model or change the scoring logic A vendor supplies the platform or algorithm and you deploy it to manage people Still you, as controller of that processing A vendor's own "DPIA-ready" documentation is an input, not a substitute; it has to be adapted to your actual data subjects and your actual deployment You and the platform provider jointly determine purposes and means Both, under an Art. 26 arrangement Allocate in the arrangement who runs and updates the DPIA, and who informs data subjects A processor operates the system on your documented instructions You, as controller The Art. 28 contract governs the processing, but the Art. 35 assessment burden stays with you GDPR Article 35 Fines: Enforcement Cases and Amounts Article 35 rarely appears alone in a decision, but two of the cases below rest on it almost entirely: no other provision does the real work of explaining the fine. Aena and Foodinho each deployed technology that was high-risk by its nature, facial recognition and algorithmic worker management, without an assessment on file that could show the risk had genuinely been thought through first. Deliveroo and FC Barcelona are listed because their Article 35 findings sit alongside other, better-known infringements and are each documented at their own source below the table. Organisation Authority Decision date Fine Aena, S.M.E., S.A. AEPD (Spain) 25 Nov 2025 €10.043.002 Foodinho S.r.l. Garante (Italy) 10 Jun 2021, further decision 22 Nov 2024 €2.600.000 + €5.000.000 Deliveroo Italy s.r.l. Garante (Italy) 22 Jul 2021 €2.500.000 Fútbol Club Barcelona AEPD (Spain) Mar 2026 €500.000 The Deliveroo Italy decision is documented in full in the Garante's own registry; its Article 35 finding is one of eight infringements in a single order and turns on the same point as Foodinho's, that the algorithmic management of riders was rolled out without ever assessing its risk. The FC Barcelona decision turns on a DPIA that existed in form but not in substance, a distinction worth reading given how many organisations treat a completed template as compliance. Recitals That Explain Article 35 Recital 84 – Risk Evaluation and Impact AssessmentExplains that the point of the assessment is to help the controller comply where the risk is high, in particular by working out the origin, nature, likelihood and severity of that risk, and by building the outcome into the measures taken to address it, including where the outcome means consulting the supervisory authority before processing starts. Recital 90 – Data Protection Impact AssessmentSets out what a proper assessment covers: a description of the processing and its purposes, an evaluation of the legitimate interest pursued, and an assessment of the necessity, proportionality and risks of the processing to the rights and freedoms of the people concerned, together with the measures and safeguards envisaged to address those risks and demonstrate compliance. Recital 91 – Large-Scale Processing OperationsDefines "large scale" for this purpose. It excludes the processing of patient or client data by an individual physician, other health professional or lawyer, but includes processing intended to profile or monitor a large number of data subjects on a wide geographical scale, or that could otherwise significantly affect a large number of people. Recital 92 – Processing Operations Not Related to a Specific ProjectRecognises that an assessment can, and sometimes should, cover more than a single project, for instance where several public authorities plan a common application or processing platform, or where a general assessment is already under way in the context of legislation that will provide the legal basis for the processing. Article 35 Compliance Checklist Screen every new processing activity against the three Art. 35(3) triggers, and against your supervisory authority's own published Art. 35(4) list, before it goes live Carry out the assessment before processing starts, not after a regulator asks for one Seek the DPO's advice at the outset and record that advice and whether it was followed (Art. 35(2), Art. 39(1)(c)) Include, at minimum, the four Art. 35(7) elements: a description of the processing and purposes, a necessity and proportionality assessment, a risk assessment, and the measures to address the risks identified For an algorithm or automated system, document how the accuracy and non-discrimination of its results are actually verified, not only that a human can intervene under Art. 22(3) Where a less intrusive alternative exists, such as a QR code instead of a facial scan, document why it was or wasn't adopted; the AEPD treats this comparison as central, not optional Where appropriate, seek the views of data subjects or their representatives (Art. 35(9)) and record why this was or wasn't done Don't treat consent as a substitute for the assessment. They are separate obligations, and satisfying one says nothing about the other Review and update the DPIA whenever the nature, scope, context or purposes of the processing change, or the risk otherwise changes (Art. 35(11)), rather than treating it as a one-time document Where the DPIA shows a high residual risk you cannot mitigate, consult the supervisory authority under Art. 36 before starting Keep the DPIA on file as accountability evidence. In every case below, the absence of a genuine one was treated as an independent infringement Every fine on this page traces back to a DPIA that was never done, done too late, or done as a template rather than a genuine assessment. Secure Privacy's consent and data governance platform keeps a live record of which processing activities need one and when they were last reviewed, so the answer to "do we have a DPIA for this" isn't a scramble the day a regulator asks. Learn more about Secure Privacy Related Recitals (75) Risks to the Rights and Freedoms of Natural Persons (84) Risk Evaluation and Impact Assessment (89) Elimination of the General Reporting Requirement (90) Data Protection Impact Assessement (91) Necessity of a Data Protection Impact Assessment (92) Broader Data Protection Impact Assessment (93) Data Protection Impact Assessment at Authorities Article 35 Enforcement Cases Aena's €10.04M Fine Foodinho's €2.6M and €5M Fines All Article 35 cases Frequently Asked Questions about Article 35 + When is a DPIA required under the GDPR? Under Art. 35(1), whenever a type of processing, particularly one using new technologies, is likely to result in a high risk to individuals' rights and freedoms. Art. 35(3) lists three cases where it is mandatory: systematic profiling with legal or similarly significant effects, large-scale processing of special category or criminal offence data, and large-scale systematic monitoring of a public area. National supervisory authorities publish their own lists under Art. 35(4) too. +What must a DPIA actually contain? At minimum the four elements in Art. 35(7): a systematic description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risk to the rights and freedoms of the people affected, and the measures envisaged to address that risk. A document that skips the risk assessment and jumps straight to "measures," as the AEPD found against FC Barcelona, is not a DPIA in substance even if it's labelled one. +Does using an algorithm to manage or evaluate people always require a DPIA? Not automatically, but very often it will. Art. 35(3)(a) is aimed specifically at systematic, automated evaluation that produces legal or similarly significant effects, which is exactly what an algorithm that assigns shifts, scores performance, or affects access to work does. Both Deliveroo and Foodinho were found to have deployed exactly this kind of system without ever assessing it. +Who has to be involved in carrying out a DPIA? The controller carries the obligation, and Art. 35(2) requires seeking the DPO's advice where one is designated. Art. 35(9) adds that, where appropriate, the views of data subjects or their representatives should be sought. Consent from the people affected does not substitute for any of this, a point the AEPD made explicitly against FC Barcelona. +What happens if a controller skips or doesn't update a DPIA? The processing is unlawful from the point the risk should have been assessed, whether or not anything goes wrong operationally. Under Art. 35(11), a DPIA also has to be revisited when the risk changes, so a document written for the original rollout doesn't automatically cover a materially different version of the system later. +What's the maximum fine for an Article 35 breach? Up to €10.000.000 or 2% of worldwide annual turnover, whichever is higher, under Art. 83(4)(a). Where the same processing also breaches a higher-tier provision, such as Art. 6 or 9, the total fine is capped at the amount for the gravest infringement under Art. 83(3), which can push it well above the Article 35 ceiling alone. Related Key Issues GDPR Data Protection Officer GDPR Privacy by Design

The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk. 1Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58. 2That period may be extended by six weeks, taking into account the complexity of the intended processing. 3The supervisory authority shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay. 4Those periods may be suspended until the supervisory authority has obtained information it has requested for the purposes of the consultation. When consulting the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory authority with: where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings; the purposes and means of the intended processing; the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation; where applicable, the contact details of the data protection officer; the data protection impact assessment provided for in Article 35; and any other information requested by the supervisory authority. Member States shall consult the supervisory authority during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing. Notwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior authorisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health. Related Recitals (94) Consultation of the Supervisory Authority (95) Support by the Processor (96) Consultation of the Supervisory Authority in the Course of a Legislative Process Frequently Asked Questions about Article 36 + What is prior consultation under Article 36 GDPR? Article 36 requires controllers to consult the supervisory authority before processing when a DPIA indicates a high risk that cannot be mitigated by the measures available to the controller. +When must you consult the data protection authority before processing? Consultation is required when a DPIA shows that processing would result in a high residual risk to individuals in the absence of measures taken by the controller to mitigate it. + What can the supervisory authority do during prior consultation? The authority can provide written advice and use its powers, including warnings or restrictions, if it considers the intended processing would infringe the GDPR. Related Key Issues GDPR Privacy Impact Assessment GDPR Right to be Informed

The controller and the processor shall designate a data protection officer in any case where: the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10. A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment. Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size. 1In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. 2The data protection officer may act for such associations and other bodies representing controllers or processors. The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39. The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract. The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority. Related Recitals (97) Data Protection Officer Frequently Asked Questions about Article 37 + When is a Data Protection Officer (DPO) required under the GDPR? Article 37 requires a DPO where processing is carried out by a public authority, or where core activities involve large-scale systematic monitoring or large-scale processing of special category data. +Does every company need a DPO under the GDPR? No. A DPO is mandatory only in the cases set out in Article 37, though any organisation may appoint one voluntarily as a matter of good practice. + Can a DPO be an external consultant? Yes. The DPO can be a staff member or fulfil the role under a service contract, provided they have the required expertise and can act independently. Related Key Issues GDPR Data Protection Officer GDPR Privacy Impact Assessment

The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data. The controller and processor shall support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge. 1The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks. 2He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks. 3The data protection officer shall directly report to the highest management level of the controller or the processor. Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation. The data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law. 1The data protection officer may fulfil other tasks and duties. 2The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests. Related Recitals (97) Data Protection Officer Frequently Asked Questions about Article 38 + What is the role of a DPO within an organisation? Article 38 requires that the DPO is involved properly and in a timely way in all data protection matters, has adequate resources, and reports to the highest level of management. +Must a DPO be independent under the GDPR? Yes. The DPO must perform their duties independently, cannot be dismissed or penalised for doing so, and must not receive instructions on how to carry out their tasks. + Can a DPO have other duties in the company? A DPO may carry out other tasks, but the organisation must ensure those duties do not create a conflict of interest with their data protection responsibilities. Related Key Issues GDPR Privacy Impact Assessment GDPR Records of Processing Activities

The data protection officer shall have at least the following tasks: to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions; to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits; to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35; to cooperate with the supervisory authority; to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter. The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing. Related Recitals (97) Data Protection Officer Frequently Asked Questions about Article 39 + What are the tasks of a Data Protection Officer? Article 39 tasks the DPO with advising on obligations, monitoring compliance, advising on DPIAs, cooperating with the supervisory authority, and acting as its contact point. +Is the DPO responsible for GDPR compliance? No. The DPO monitors and advises on compliance, but legal responsibility for compliance remains with the controller or processor. + Who does the DPO act as a contact point for? The DPO is the contact point for the supervisory authority and may also handle queries from individuals about how their personal data is processed and their rights. Related Key Issues GDPR Fines / Penalties GDPR Records of Processing Activities

The Member States, the supervisory authorities, the Board and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Regulation, taking account of the specific features of the various processing sectors and the specific needs of micro, small and medium-sized enterprises. Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to: fair and transparent processing; the legitimate interests pursued by controllers in specific contexts; the collection of personal data; the pseudonymisation of personal data; the information provided to the public and to data subjects; the exercise of the rights of data subjects; the information provided to, and the protection of, children, and the manner in which the consent of the holders of parental responsibility over children is to be obtained; the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing referred to in Article 32; the notification of personal data breaches to supervisory authorities and the communication of such personal data breaches to data subjects; the transfer of personal data to third countries or international organisations; or out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing, without prejudice to the rights of data subjects pursuant to Articles 77 and 79. 1In addition to adherence by controllers or processors subject to this Regulation, codes of conduct approved pursuant to paragraph 5 of this Article and having general validity pursuant to paragraph 9 of this Article may also be adhered to by controllers or processors that are not subject to this Regulation pursuant to Article 3 in order to provide appropriate safeguards within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (e) of Article 46(2). 2Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards including with regard to the rights of data subjects. A code of conduct referred to in paragraph 2 of this Article shall contain mechanisms which enable the body referred to in Article 41(1) to carry out the mandatory monitoring of compliance with its provisions by the controllers or processors which undertake to apply it, without prejudice to the tasks and powers of supervisory authorities competent pursuant to Article 55 or 56. 1Associations and other bodies referred to in paragraph 2 of this Article which intend to prepare a code of conduct or to amend or extend an existing code shall submit the draft code, amendment or extension to the supervisory authority which is competent pursuant to Article 55. 2The supervisory authority shall provide an opinion on whether the draft code, amendment or extension complies with this Regulation and shall approve that draft code, amendment or extension if it finds that it provides sufficient appropriate safeguards. Where the draft code, or amendment or extension is approved in accordance with paragraph 5, and where the code of conduct concerned does not relate to processing activities in several Member States, the supervisory authority shall register and publish the code. Where a draft code of conduct relates to processing activities in several Member States, the supervisory authority which is competent pursuant to Article 55 shall, before approving the draft code, amendment or extension, submit it in the procedure referred to in Article 63 to the Board which shall provide an opinion on whether the draft code, amendment or extension complies with this Regulation or, in the situation referred to in paragraph 3 of this Article, provides appropriate safeguards. Where the opinion referred to in paragraph 7 confirms that the draft code, amendment or extension complies with this Regulation, or, in the situation referred to in paragraph 3, provides appropriate safeguards, the Board shall submit its opinion to the Commission. 1The Commission may, by way of implementing acts, decide that the approved code of conduct, amendment or extension submitted to it pursuant to paragraph 8 of this Article have general validity within the Union. 2Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2). The Commission shall ensure appropriate publicity for the approved codes which have been decided as having general validity in accordance with paragraph 9. The Board shall collate all approved codes of conduct, amendments and extensions in a register and shall make them publicly available by way of appropriate means. Related Recitals (98) Preparation of Codes of Conduct by Organisations and Associations (99) Consultation of Stakeholders and Data Subjects in the Development of Codes of Conduct Frequently Asked Questions about Article 40 + What are codes of conduct under the GDPR? Article 40 encourages associations to draw up codes of conduct that specify how the GDPR applies in a sector, helping organisations demonstrate compliance and good practice. +How do codes of conduct help with GDPR compliance? Adhering to an approved code can be used to demonstrate compliance with obligations such as security and accountability, and signals a commitment to good data protection practice. + Who approves a GDPR code of conduct? Codes are submitted to the competent supervisory authority for approval, and codes with cross-border relevance involve the European Data Protection Board. Related Key Issues GDPR Privacy by Design GDPR Third Countries

Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the monitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by the competent supervisory authority. A body as referred to in paragraph 1 may be accredited to monitor compliance with a code of conduct where that body has: demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of the competent supervisory authority; established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the code, to monitor their compliance with its provisions and to periodically review its operation; established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is being, implemented by a controller or processor, and to make those procedures and structures transparent to data subjects and the public; and demonstrated to the satisfaction of the competent supervisory authority that its tasks and duties do not result in a conflict of interests. The competent supervisory authority shall submit the draft requirements for accreditation of a body as referred to in paragraph 1 of this Article to the Board pursuant to the consistency mechanism referred to in Article 63. 1Without prejudice to the tasks and powers of the competent supervisory authority and the provisions of Chapter VIII, a body as referred to in paragraph 1 of this Article shall, subject to appropriate safeguards, take appropriate action in cases of infringement of the code by a controller or processor, including suspension or exclusion of the controller or processor concerned from the code. 2It shall inform the competent supervisory authority of such actions and the reasons for taking them. The competent supervisory authority shall revoke the accreditation of a body as referred to in paragraph 1 if the requirements for accreditation are not, or are no longer, met or where actions taken by the body infringe this Regulation. This Article shall not apply to processing carried out by public authorities and bodies. Related Recitals (77) Guidance on Risk Assessment (81) The Use of Processors (98) Drawing Up Codes of Conduct (99) Consultation of Stakeholders and Data Subjects Frequently Asked Questions about Article 41 + Who monitors compliance with GDPR codes of conduct? Article 41 allows an accredited body with the appropriate expertise to monitor compliance with an approved code of conduct, in addition to the supervisory authority's own powers. +What happens if an organisation breaches a code of conduct? The monitoring body can take action, including suspending or excluding the organisation from the code, and must inform the supervisory authority of such measures. + Do code monitoring bodies replace supervisory authorities? No. Monitoring bodies supplement but do not replace the supervisory authority, which retains its full enforcement powers under the GDPR. Related Key Issues GDPR Privacy Impact Assessment GDPR Records of Processing Activities

1The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors. 2The specific needs of micro, small and medium-sized enterprises shall be taken into account. 1In addition to adherence by controllers or processors subject to this Regulation, data protection certification mechanisms, seals or marks approved pursuant to paragraph 5 of this Article may be established for the purpose of demonstrating the existence of appropriate safeguards provided by controllers or processors that are not subject to this Regulation pursuant to Article 3 within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (f) of Article 46(2). 2Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards, including with regard to the rights of data subjects. The certification shall be voluntary and available via a process that is transparent. A certification pursuant to this Article does not reduce the responsibility of the controller or the processor for compliance with this Regulation and is without prejudice to the tasks and powers of the supervisory authorities which are competent pursuant to Article 55 or 56. 1A certification pursuant to this Article shall be issued by the certification bodies referred to in Article 43 or by the competent supervisory authority, on the basis of criteria approved by that competent supervisory authority pursuant to Article 58(3) or by the Board pursuant to Article 63. 2Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal. The controller or processor which submits its processing to the certification mechanism shall provide the certification body referred to in Article 43, or where applicable, the competent supervisory authority, with all information and access to its processing activities which are necessary to conduct the certification procedure. 1Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant criteria continue to be met. 2Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met. The Board shall collate all certification mechanisms and data protection seals and marks in a register and shall make them publicly available by any appropriate means. Related Recitals (100) Certification Frequently Asked Questions about Article 42 + What is GDPR certification under Article 42? Article 42 encourages data protection certification mechanisms, seals, and marks that allow organisations to demonstrate compliance of their processing operations with the GDPR. +Does GDPR certification prove full compliance? No. Certification helps demonstrate compliance but does not reduce the responsibility of the controller or processor, who remain fully accountable under the GDPR. + Is GDPR certification mandatory? No. Certification is voluntary and available through a transparent process, serving as a tool to show good practice and build trust with individuals and partners. Related Key Issues GDPR Encryption GDPR Privacy Impact Assessment

In this page Key Facts Who Can Certify, and How They Get Accredited The Two Accreditation Routes Article 43 in Practice: The First Accreditations Recitals That Explain Article 43 Checklist: Article 43 Compliance Related Recitals Frequently Asked Questions about Article 43 Related Articles Article 43 paragraph by paragraph Paragraph What it says Covers Art. 43(1) Certification bodies with an appropriate level of expertise issue and renew certification, after informing the supervisory authority so it can use its powers under Art. 58(2)(h). Member States ensure they are accredited by the competent supervisory authority, the national accreditation body, or both. Who certifies Art. 43(2) Accreditation only where the body has shown independence and expertise, committed to the approved criteria, set up procedures for issuing, periodic review and withdrawal, set up transparent complaint handling, and shown it has no conflict of interests. Accreditation conditions Art. 43(3) Accreditation is based on requirements approved by the competent supervisory authority or by the Board under Article 63. On the national accreditation body route they complement Regulation (EC) No 765/2008. Accreditation requirements Art. 43(4) The body is responsible for the proper assessment behind a certification or its withdrawal, without prejudice to the responsibility of the controller or processor. Accreditation lasts up to five years, renewable. Responsibility and duration Art. 43(5) The body gives the supervisory authority its reasons for granting or withdrawing a certification. Reporting Art. 43(6) The authority publishes the accreditation requirements and the certification criteria in an easily accessible form and sends them to the Board. Transparency Art. 43(7) The authority or the national accreditation body shall revoke an accreditation where the conditions are not or no longer met, or the body’s actions infringe the GDPR. Revocation Art. 43(8)–(9) The Commission may adopt delegated acts on certification requirements (Article 92) and implementing acts on technical standards (Article 93(2)). Commission powers Full text of Article 43 1Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, certification bodies which have an appropriate level of expertise in relation to data protection shall, after informing the supervisory authority in order to allow it to exercise its powers pursuant to point (h) of Article 58(2) where necessary, issue and renew certification. 2Member States shall ensure that those certification bodies are accredited by one or both of the following: the supervisory authority which is competent pursuant to Article 55 or 56; the national accreditation body named in accordance with Regulation (EC) No 765/2008 of the European Parliament and of the Council in accordance with EN-ISO/IEC 17065/2012 and with the additional requirements established by the supervisory authority which is competent pursuant to Article 55 or 56. Certification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where they have: demonstrated their independence and expertise in relation to the subject-matter of the certification to the satisfaction of the competent supervisory authority; undertaken to respect the criteria referred to in Article 42(5) and approved by the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63; established procedures for the issuing, periodic review and withdrawal of data protection certification, seals and marks; established procedures and structures to handle complaints about infringements of the certification or the manner in which the certification has been, or is being, implemented by the controller or processor, and to make those procedures and structures transparent to data subjects and the public; and demonstrated, to the satisfaction of the competent supervisory authority, that their tasks and duties do not result in a conflict of interests. 1The accreditation of certification bodies as referred to in paragraphs 1 and 2 of this Article shall take place on the basis of requirements approved by the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63. 2In the case of accreditation pursuant to point (b) of paragraph 1 of this Article, those requirements shall complement those envisaged in Regulation (EC) No 765/2008 and the technical rules that describe the methods and procedures of the certification bodies. 1The certification bodies referred to in paragraph 1 shall be responsible for the proper assessment leading to the certification or the withdrawal of such certification without prejudice to the responsibility of the controller or processor for compliance with this Regulation. 2The accreditation shall be issued for a maximum period of five years and may be renewed on the same conditions provided that the certification body meets the requirements set out in this Article. The certification bodies referred to in paragraph 1 shall provide the competent supervisory authorities with the reasons for granting or withdrawing the requested certification. 1The requirements referred to in paragraph 3 of this Article and the criteria referred to in Article 42(5) shall be made public by the supervisory authority in an easily accessible form. 2The supervisory authorities shall also transmit those requirements and criteria to the Board. Without prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall revoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation. The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of specifying the requirements to be taken into account for the data protection certification mechanisms referred to in Article 42(1). 1The Commission may adopt implementing acts laying down technical standards for certification mechanisms and data protection seals and marks, and mechanisms to promote and recognise those certification mechanisms, seals and marks. 2Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). In short Article 43 is about the certifiers, not the certified. Article 42 lets controllers and processors get their processing operations certified; Article 43 decides who is allowed to issue those certifications. Certification bodies need data protection expertise, independence, no conflict of interests, and proper procedures for issuing, reviewing and withdrawing certificates and handling complaints. They are accredited for up to five years by the supervisory authority, the national accreditation body, or both. A certificate never shifts the controller’s own responsibility for compliance. Key Facts Chapter Chapter IV – Controller and processor (Art. 24–43), Section 5 – Codes of conduct and certification (Art. 40–43) Applies to Certification bodies, and the supervisory authorities and national accreditation bodies that accredit them Maximum fine Up to €10.000.000 or 2% of total worldwide annual turnover, whichever is higher, for breaching a certification body’s obligations under Articles 42 and 43 (Art. 83(4)(b)) Validity Accreditation: up to five years, renewable (Art. 43(4)). Certification issued by the body: up to three years, renewable (Art. 42(7)) In force since 25 May 2018 Explained by recitals 100; see also 77 and 81 Depends on Article 42 (the certification criteria); Art. 57(1)(p)–(q) and Art. 58(3)(e) (the authority’s tasks and powers to set requirements and accredit); Art. 64(1)(c) (EDPB opinion on draft accreditation requirements) EDPB guidance Guidelines 4/2018 on the accreditation of certification bodies under Article 43, adopted version published 4 June 2019 (ICO summary) Who Can Certify, and How They Get Accredited Certification under the GDPR has two layers. Article 42 sets out the certification itself: criteria approved by a supervisory authority or, for a European Data Protection Seal, by the Board. Article 43 sets out the bodies that apply those criteria. A body can issue and renew certifications only if it has an appropriate level of data protection expertise, and it has to tell the supervisory authority first, so the authority can step in under Art. 58(2)(h) if needed, for example by ordering it not to issue a certification whose requirements aren’t met. To be accredited, the body must satisfy the authority that it is independent and expert in the subject of the certification and has no conflict of interests. It must commit to the approved criteria and set up procedures for issuing, periodically reviewing and withdrawing certifications, as well as complaint procedures that are transparent to data subjects and the public (Art. 43(2)). Once accredited, it must give the authority its reasons each time it grants or withdraws a certification (Art. 43(5)). Accreditation isn’t certification, and certification isn’t compliance A body is accredited under Article 43; an organisation’s processing is certified under Article 42. Neither step moves responsibility away from the controller or processor: a certification “does not reduce” their responsibility for compliance (Art. 42(4)), and the body’s responsibility for its assessment is “without prejudice” to it (Art. 43(4)). The Two Accreditation Routes Article 43(1) leaves it to each Member State to choose who accredits. The requirements the accreditor applies must be approved by the competent authority, after an EDPB opinion under Art. 64(1)(c), and published in an easily accessible form (Art. 43(3) and (6)). Route Who accredits On what basis Example Art. 43(1)(a) The competent supervisory authority Accreditation requirements approved by that authority Luxembourg: the CNPD accredits GDPR-CARPA certification bodies itself, under Article 43(1)(a) (GDPR-CARPA scheme) Art. 43(1)(b) The national accreditation body under Regulation (EC) No 765/2008 EN-ISO/IEC 17065/2012, plus additional requirements set by the supervisory authority Greece: the Hellenic DPA adopted additional accreditation requirements under Articles 43(1)(b) and 43(3), after EDPB Opinion 22/2020 (decision 25/2020) Both Either or both, as the Member State provides As above – The EDPB has issued opinions on many national authorities’ draft accreditation requirements under Article 43(3), including France (12/2022), Bulgaria (13/2022), Malta (4/2023), Cyprus (12/2023), Croatia (13/2023), Slovenia (38/2023), Sweden (10/2024) and Finland (13/2026) (EDPB documents on accreditation; EDPB). Article 43 in Practice: The First Accreditations The decisions that show how Article 43 works are accreditation decisions and approvals of certification criteria. Luxembourg led on both: its authority adopted the first GDPR certification mechanism and granted the first accreditation, and it submitted the first European Data Protection Seal to the EDPB. Body or scheme Authority & date Outcome What happened EY PFS Solutions CNPD (Luxembourg), 12 Oct 2022 Accredited for 5 years The first accreditation the CNPD granted to a certification body, which it described as the first in Luxembourg and in Europe. The body can issue GDPR-CARPA certifications while the accreditation is valid Grant Thornton Audit and Assurance CNPD (Luxembourg), 19 May 2023 Accredited One of two further GDPR-CARPA certification bodies the CNPD accredited in 2023 (CNPD) Europrivacy EDPB, Opinion 28/2022, 10 Oct 2022 Approved as European Data Protection Seal Criteria submitted by the Luxembourg authority on 28 September 2022; the first European Data Protection Seal under Art. 42(5) (EDPB). The opinion states it is not a certification for international transfers under Art. 46(2)(f) (para 3) Europrivacy (updated criteria) EDPB, Opinions 14/2026 and 15/2026, 16 Apr 2026 Updated criteria approved Opinion 14/2026 approved an updated version of the Europrivacy criteria as a European Data Protection Seal; Opinion 15/2026 concerns their use as a transfer tool If you want to become a certification body Start from the requirements your authority has approved and published. Find out which route your Member State uses. In Luxembourg the CNPD accredits directly, with requirements based on ISAE 3000, ISQC1 and ISO 17065 (CNPD). Document independence, expertise and the absence of conflicts of interest, plus issuing, review, withdrawal and complaint procedures (Art. 43(2)). Plan for renewal: accreditation lasts at most five years (Art. 43(4)). If a supplier says it’s “GDPR certified” Check what was certified, by whom, and against which criteria. The criteria should be approved under Art. 42(5); the EDPB keeps a public register of certification mechanisms, seals and marks (Art. 42(8)). Certification covers processing operations, not a whole organisation. GDPR-CARPA, for example, certifies specific processing activities only (A&O summary). Check the date: a certification lasts at most three years (Art. 42(7)). Recitals That Explain Article 43 Recital 100 – CertificationEncourages certification mechanisms and data protection seals and marks, so that people can quickly assess the level of data protection of relevant products and services. Recital 77 – Risk Assessment GuidelinesLists approved certifications among the ways controllers and processors can get guidance on implementing appropriate measures and demonstrating compliance. Recital 81 – The Use of ProcessorsSays a processor’s adherence to an approved code of conduct or approved certification mechanism may be used as an element to demonstrate compliance with the controller’s obligations. Checklist: Article 43 Compliance Demonstrate independence and expertise in the subject of the certification, to the authority’s satisfaction (Art. 43(2)(a)) Commit in writing to the certification criteria approved under Art. 42(5) (Art. 43(2)(b)) Have documented procedures for issuing, periodically reviewing and withdrawing certifications, seals and marks (Art. 43(2)(c)) Run a complaint procedure that data subjects and the public can see and use (Art. 43(2)(d)) Show that your tasks and duties don’t create a conflict of interests (Art. 43(2)(e)) Inform the supervisory authority before issuing or renewing a certification, and send it your reasons for every grant or withdrawal (Art. 43(1) and (5)) Track your accreditation’s expiry date: five years at most, renewable only if you still meet the requirements (Art. 43(4)) Related Recitals (77) Guidance on Risk Assessment (81) The Use of Processors (98) Drawing Up Codes of Conduct (99) Consultation of Stakeholders and Data Subjects (100) Certification Mechanisms, Seals and Marks (148) Penalties Frequently Asked Questions about Article 43 + Who accredits GDPR certification bodies? Each Member State decides. Under Article 43(1), certification bodies are accredited by the competent supervisory authority, by the national accreditation body applying EN-ISO/IEC 17065/2012 plus the authority's additional requirements, or by both. +How long does accreditation last? Up to five years, renewable on the same conditions if the body still meets the requirements (Art. 43(4)). The certifications the body issues are valid for up to three years (Art. 42(7)). + Can an accreditation be revoked? Yes. Under Article 43(7) the supervisory authority or the national accreditation body must revoke it where the conditions are not, or are no longer, met, or where the body's actions infringe the GDPR. Separately, the authority can order a certification body to withdraw a certification or not to issue one (Art. 58(2)(h)). + Does a GDPR certificate make an organisation compliant? No. A certification does not reduce the controller's or processor's responsibility for compliance (Art. 42(4)), and the certification body's responsibility for its assessment is without prejudice to that responsibility (Art. 43(4)). + What fines apply to certification bodies? Infringing the obligations of a certification body under Articles 42 and 43 can lead to a fine of up to €10.000.000 or 2% of total worldwide annual turnover, whichever is higher (Art. 83(4)(b)). Preparing processing activities for a certification audit? Certification bodies assess specific processing operations against published criteria. Up-to-date records of those operations, their legal bases and their safeguards make that assessment easier to support. Explore privacy governance tools Related Key Issues GDPR Data Protection Officer GDPR Records of Processing Activities

1Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. 2All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined. Related Recitals (101) General Principles for International Data Transfers (102) International Agreements for an Appropriate Level of Data Protection Frequently Asked Questions about Article 44 + What is the general principle for international data transfers under the GDPR? Article 44 states that personal data may only be transferred outside the EU if the conditions in Chapter 5 are met, so that the protection guaranteed by the GDPR is not undermined. +Can personal data leave the EU under the GDPR? Yes, but only where there is an adequacy decision, appropriate safeguards, or a specific derogation applies. The level of protection must remain essentially equivalent to the GDPR. + What is a restricted transfer under the GDPR? A restricted transfer is a transfer of personal data to a country or organisation outside the EU or EEA, which is only lawful if a Chapter 5 transfer mechanism is in place. Related Key Issues GDPR Privacy Impact Assessment GDPR Records of Processing Activities GDPR Third Countries

1A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. 2Such a transfer shall not require any specific authorisation. When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements: the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. 1The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. 2The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. 3The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. 4The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. 1The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. 2Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). 3On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3). The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5. A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured. Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article. Related Recitals (103) Appropriate Level of Data Protection Based on an Adequacy Decision (104) Criteria for an Adequacy Decision (105) Consideration of International Agreements for an Adequacy Decision (106) Monitoring and Periodic Review of the Level of Data Protection (107) Amendment, Revocation and Suspension of Adequacy Decisions Frequently Asked Questions about Article 45 + What is an adequacy decision under the GDPR? An adequacy decision is a finding by the European Commission that a third country provides an adequate level of data protection, allowing personal data to flow there without additional safeguards. +Which countries have an EU adequacy decision? Several countries hold adequacy decisions, including the UK, Switzerland, Japan, and others. The list is maintained and reviewed by the European Commission and can change over time. + Do you need extra safeguards to transfer data to an adequate country? No. Where an adequacy decision covers the destination, transfers can take place freely without requiring additional safeguards such as standard contractual clauses. Related Key Issues GDPR Data Protection Officer GDPR Records of Processing Activities

In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by: a legally binding and enforceable instrument between public authorities or bodies; binding corporate rules in accordance with Article 47; standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2); standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2); an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights; or an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights. Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by: contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights. The supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to in paragraph 3 of this Article. 1Authorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. 2Decisions adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article. Related Recitals (108) Appropriate Safeguards (109) Standard Data Protection Clauses Frequently Asked Questions about Article 46 + What are appropriate safeguards for international transfers? Article 46 allows transfers where appropriate safeguards are in place, such as standard contractual clauses, binding corporate rules, approved codes of conduct, or certification mechanisms. +What are Standard Contractual Clauses (SCCs)? SCCs are model data protection clauses approved by the European Commission that controllers and processors can use to provide appropriate safeguards for transfers outside the EU. + Do you need a transfer impact assessment with SCCs? In practice, organisations using SCCs are expected to assess whether the destination's laws undermine the safeguards and to add supplementary measures where necessary. Related Key Issues GDPR Records of Processing Activities GDPR Third Countries

The competent supervisory authority shall approve binding corporate rules in accordance with the consistency mechanism set out in Article 63, provided that they: are legally binding and apply to and are enforced by every member concerned of the group of undertakings, or group of enterprises engaged in a joint economic activity, including their employees; expressly confer enforceable rights on data subjects with regard to the processing of their personal data; and fulfil the requirements laid down in paragraph 2. The binding corporate rules referred to in paragraph 1 shall specify at least: the structure and contact details of the group of undertakings, or group of enterprises engaged in a joint economic activity and of each of its members; the data transfers or set of transfers, including the categories of personal data, the type of processing and its purposes, the type of data subjects affected and the identification of the third country or countries in question; their legally binding nature, both internally and externally; the application of the general data protection principles, in particular purpose limitation, data minimisation, limited storage periods, data quality, data protection by design and by default, legal basis for processing, processing of special categories of personal data, measures to ensure data security, and the requirements in respect of onward transfers to bodies not bound by the binding corporate rules; the rights of data subjects in regard to processing and the means to exercise those rights, including the right not to be subject to decisions based solely on automated processing, including profiling in accordance with Article 22, the right to lodge a complaint with the competent supervisory authority and before the competent courts of the Member States in accordance with Article 79, and to obtain redress and, where appropriate, compensation for a breach of the binding corporate rules; the acceptance by the controller or processor established on the territory of a Member State of liability for any breaches of the binding corporate rules by any member concerned not established in the Union; the controller or the processor shall be exempt from that liability, in whole or in part, only if it proves that that member is not responsible for the event giving rise to the damage; how the information on the binding corporate rules, in particular on the provisions referred to in points (d), (e) and (f) of this paragraph is provided to the data subjects in addition to Articles 13 and 14; the tasks of any data protection officer designated in accordance with Article 37 or any other person or entity in charge of the monitoring compliance with the binding corporate rules within the group of undertakings, or group of enterprises engaged in a joint economic activity, as well as monitoring training and complaint-handling; the complaint procedures; the mechanisms within the group of undertakings, or group of enterprises engaged in a joint economic activity for ensuring the verification of compliance with the binding corporate rules. Such mechanisms shall include data protection audits and methods for ensuring corrective actions to protect the rights of the data subject. Results of such verification should be communicated to the person or entity referred to in point (h) and to the board of the controlling undertaking of a group of undertakings, or of the group of enterprises engaged in a joint economic activity, and should be available upon request to the competent supervisory authority; the mechanisms for reporting and recording changes to the rules and reporting those changes to the supervisory authority; the cooperation mechanism with the supervisory authority to ensure compliance by any member of the group of undertakings, or group of enterprises engaged in a joint economic activity, in particular by making available to the supervisory authority the results of verifications of the measures referred to in point (j); the mechanisms for reporting to the competent supervisory authority any legal requirements to which a member of the group of undertakings, or group of enterprises engaged in a joint economic activity is subject in a third country which are likely to have a substantial adverse effect on the guarantees provided by the binding corporate rules; and the appropriate data protection training to personnel having permanent or regular access to personal data. 1The Commission may specify the format and procedures for the exchange of information between controllers, processors and supervisory authorities for binding corporate rules within the meaning of this Article. 2Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2). Related Recitals (110) Binding Corporate Rules Frequently Asked Questions about Article 47 + What are Binding Corporate Rules (BCRs) under the GDPR? Article 47 allows multinational groups to transfer data internally using binding corporate rules, which are internal data protection policies approved by a supervisory authority. +Who can use Binding Corporate Rules? BCRs are used by groups of undertakings or enterprises engaged in a joint economic activity to enable transfers of personal data within the group across borders. + How are Binding Corporate Rules approved? BCRs must be approved by the competent supervisory authority through the consistency mechanism involving the European Data Protection Board. Related Key Issues GDPR Data Protection Officer GDPR Right to be Informed

Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter. Related Recitals (115) Rules in Third Countries Contrary to the Regulation Frequently Asked Questions about Article 48 + What does Article 48 GDPR say about foreign court orders? Article 48 provides that a judgment or decision from a third country authority requiring data transfer is only recognised if based on an international agreement such as a mutual legal assistance treaty. +Can a company hand over EU data to foreign authorities? Not solely on the basis of a foreign court order. Disclosure must be grounded in an international agreement, otherwise the request must be assessed under the GDPR's transfer rules. + Why does Article 48 matter for global businesses? It limits how organisations respond to foreign government and court demands for EU personal data, helping prevent conflicts between local law and GDPR obligations. Related Key Issues GDPR Fines / Penalties GDPR Third Countries

1In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions: the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards; the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request; the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person; the transfer is necessary for important reasons of public interest; the transfer is necessary for the establishment, exercise or defence of legal claims; the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent; the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case. 2Where a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. 3The controller shall inform the supervisory authority of the transfer. 4The controller shall, in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued. 1A transfer pursuant to point (g) of the first subparagraph of paragraph 1 shall not involve the entirety of the personal data or entire categories of the personal data contained in the register. 2Where the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients. Points (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph thereof shall not apply to activities carried out by public authorities in the exercise of their public powers. The public interest referred to in point (d) of the first subparagraph of paragraph 1 shall be recognised in Union law or in the law of the Member State to which the controller is subject. 1In the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of personal data to a third country or an international organisation. 2Member States shall notify such provisions to the Commission. The controller or processor shall document the assessment as well as the suitable safeguards referred to in the second subparagraph of paragraph 1 of this Article in the records referred to in Article 30. Related Recitals (111) Exceptions for Certain Cases of International Transfers (112) Data Transfers due to Important Reasons of Public Interest (113) Transfers Qualified as Not Repetitive and that Only Concern a Limited Number of Data Subjects (114) Safeguarding of Enforceability of Rights and Obligations in the Absence of an Adequacy Decision (115) Rules in Third Countries Contrary to the Regulation Frequently Asked Questions about Article 49 + What are the derogations for international data transfers? Article 49 allows transfers in specific situations without adequacy or safeguards, such as explicit consent, contract performance, important public interest, or legal claims. +Can I transfer data abroad based on consent? Yes. Explicit consent is a derogation under Article 49, provided the individual is informed of the possible risks of the transfer due to the absence of adequacy or safeguards. + Are Article 49 derogations meant for regular transfers? No. Derogations are intended for occasional and non-repetitive transfers, not as a routine basis for ongoing international data flows. Related Key Issues GDPR Consent GDPR Records of Processing Activities

In relation to third countries and international organisations, the Commission and supervisory authorities shall take appropriate steps to: develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data; provide international mutual assistance in the enforcement of legislation for the protection of personal data, including through notification, complaint referral, investigative assistance and information exchange, subject to appropriate safeguards for the protection of personal data and other fundamental rights and freedoms; engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the enforcement of legislation for the protection of personal data; promote the exchange and documentation of personal data protection legislation and practice, including on jurisdictional conflicts with third countries. Related Recitals (116) Cooperation Among Supervisory Authorities Frequently Asked Questions about Article 50 + What does Article 50 GDPR promote? Article 50 encourages the Commission and supervisory authorities to develop international cooperation mechanisms to facilitate effective enforcement of data protection laws. +How does the GDPR support global data protection cooperation? It promotes mutual assistance, international cooperation in enforcement, and the exchange of best practices to help protect personal data across borders. + Does Article 50 create binding obligations? Article 50 is largely aspirational, directing authorities to foster cooperation rather than imposing specific binding duties on organisations. Related Key Issues GDPR Fines / Penalties GDPR Records of Processing Activities

Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’). 1Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. 2For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII. Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them. Related Recitals (117) Establishment of Supervisory Authorities (118) Monitoring of the Supervisory Authorities (119) Organisation of Several Supervisory Authorities of a Member State (120) Features of Supervisory Authorities Frequently Asked Questions about Article 51 + What is a supervisory authority under the GDPR? Article 51 requires each member state to establish one or more independent public authorities responsible for monitoring and enforcing the GDPR within its territory. +What does a data protection authority do? A supervisory authority monitors compliance, handles complaints, conducts investigations, and can impose corrective measures and fines for breaches of the GDPR. + How many supervisory authorities can a country have? A member state may establish more than one supervisory authority, in which case it must designate one to represent the country in the European Data Protection Board. Related Key Issues GDPR Privacy Impact Assessment GDPR Records of Processing Activities

Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation. The member or members of each supervisory authority shall, in the performance of their tasks and exercise of their powers in accordance with this Regulation, remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from anybody. Member or members of each supervisory authority shall refrain from any action incompatible with their duties and shall not, during their term of office, engage in any incompatible occupation, whether gainful or not. Each Member State shall ensure that each supervisory authority is provided with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers, including those to be carried out in the context of mutual assistance, cooperation and participation in the Board. Each Member State shall ensure that each supervisory authority chooses and has its own staff which shall be subject to the exclusive direction of the member or members of the supervisory authority concerned. Each Member State shall ensure that each supervisory authority is subject to financial control which does not affect its independence and that it has separate, public annual budgets, which may be part of the overall state or national budget. Related Recitals (117) Establishment of Supervisory Authorities (118) Monitoring of the Supervisory Authorities (120) Features of Supervisory Authorities (121) Independence of the Supervisory Authorities Frequently Asked Questions about Article 52 + Why must supervisory authorities be independent? Article 52 requires supervisory authorities to act with complete independence, free from external influence, so that data protection can be enforced impartially and effectively. +Who funds data protection supervisory authorities? Member states must provide each authority with the human, technical, and financial resources needed to perform its tasks while preserving its independence. + Can governments instruct a supervisory authority? No. Members of a supervisory authority must remain free from external instructions and act independently in the performance of their duties. Related Key Issues GDPR Data Protection Officer Right to be Forgotten

Member States shall provide for each member of their supervisory authorities to be appointed by means of a transparent procedure by: – their parliament; – their government; – their head of State; or – an independent body entrusted with the appointment under Member State law. Each member shall have the qualifications, experience and skills, in particular in the area of the protection of personal data, required to perform its duties and exercise its powers. The duties of a member shall end in the event of the expiry of the term of office, resignation or compulsory retirement, in accordance with the law of the Member State concerned. A member shall be dismissed only in cases of serious misconduct or if the member no longer fulfils the conditions required for the performance of the duties. Related Recitals (121) Independence of the Supervisory Authorities Frequently Asked Questions about Article 53 + How are members of supervisory authorities appointed? Article 53 requires members to be appointed through a transparent procedure by the parliament, government, head of state, or an independent body under member state law. +What qualifications must supervisory authority members have? Members must have the qualifications, experience, and skills, particularly in data protection, needed to perform their duties and exercise their powers. + Can a supervisory authority member be dismissed? A member can only be dismissed in cases of serious misconduct or where they no longer fulfil the conditions for performing their duties, protecting their independence. Related Key Issues GDPR Fines / Penalties Privacy by Design

Each Member State shall provide by law for all of the following: the establishment of each supervisory authority; the qualifications and eligibility conditions required to be appointed as member of each supervisory authority; the rules and procedures for the appointment of the member or members of each supervisory authority; the duration of the term of the member or members of each supervisory authority of no less than four years, except for the first appointment after 24 May 2016, part of which may take place for a shorter period where that is necessary to protect the independence of the supervisory authority by means of a staggered appointment procedure; whether and, if so, for how many terms the member or members of each supervisory authority is eligible for reappointment; the conditions governing the obligations of the member or members and staff of each supervisory authority, prohibitions on actions, occupations and benefits incompatible therewith during and after the term of office and rules governing the cessation of employment. 1The member or members and the staff of each supervisory authority shall, in accordance with Union or Member State law, be subject to a duty of professional secrecy both during and after their term of office, with regard to any confidential information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers. 2During their term of office, that duty of professional secrecy shall in particular apply to reporting by natural persons of infringements of this Regulation. Related Recitals (117) Establishment of Supervisory Authorities (121) Independence of the Supervisory Authorities Frequently Asked Questions about Article 54 + What rules govern the establishment of a supervisory authority? Article 54 requires member states to set out by law the establishment, members' qualifications, appointment rules, duration of terms, and conditions of service for each authority. +Are supervisory authority members bound by confidentiality? Yes. Members and staff are subject to a duty of professional secrecy regarding confidential information they access while performing their tasks. + How long do supervisory authority members serve? The term of office is set by national law and must be at least four years, with rules to ensure stability and independence. Related Key Issues GDPR Data Protection Officer GDPR Records of Processing Activities

Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State. 1Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. 2In such cases Article 56 does not apply. Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity. Related Recitals (122) Responsibility of the Supervisory Authorities Frequently Asked Questions about Article 55 + What is the competence of a supervisory authority? Article 55 gives each supervisory authority competence to perform its tasks and exercise its powers within the territory of its own member state. +Which authority handles cross-border data processing? Cross-border cases are handled through the lead supervisory authority mechanism, though each authority remains competent for processing in its own territory in many situations. + Are courts supervised by data protection authorities? Supervisory authorities are not competent to oversee processing operations carried out by courts acting in their judicial capacity. Related Key Issues GDPR Records of Processing Activities GDPR Third Countries

Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60. By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State. 1In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. 2Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it. 1Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. 2The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. 3The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3). Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62. The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor. Related Recitals (124) Lead Authority Regarding Processing in Several Member States (127) Information of the Supervisory Authority Regarding Local Processing (128) Responsibility Regarding Processing in the Public Interest Frequently Asked Questions about Article 56 + What is the lead supervisory authority under the GDPR? Article 56 establishes the lead supervisory authority as the main regulator for cross-border processing, usually the authority of the country where the organisation has its main establishment. +How is the lead supervisory authority determined? It is generally the authority of the member state where the controller or processor has its main establishment or single establishment in the EU. + What is the one-stop-shop mechanism? The one-stop-shop lets organisations with cross-border processing deal mainly with a single lead authority, which coordinates with other concerned authorities. Related Key Issues Encryption GDPR Fines / Penalties

Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: monitor and enforce the application of this Regulation; promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention; advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to processing; promote the awareness of controllers and processors of their obligations under this Regulation; upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end; handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary; cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation; conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority; monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices; adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2); establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4); give advice on the processing operations referred to in Article 36(2); encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5); encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5); where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7); draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43; conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43; authorise contractual clauses and provisions referred to in Article 46(3); approve binding corporate rules pursuant to Article 47; contribute to the activities of the Board; keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and fulfil any other tasks related to the protection of personal data. Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication. The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer. 1Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. 2The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. Related Recitals (122) Responsibility of the Supervisory Authorities (123) Cooperation of the Supervisory Authorities with Each Other and with the Commission (132) Awareness-Raising Activities and Specific Measures (133) Mutual Assistance and Provisional Measures (137) Provisional Measures Frequently Asked Questions about Article 57 + What are the tasks of a supervisory authority? Article 57 lists tasks including monitoring and enforcing the GDPR, promoting awareness, handling complaints, conducting investigations, and advising on data protection matters. +Can you complain to a data protection authority for free? Yes. Supervisory authorities must handle complaints from individuals free of charge, except where requests are manifestly unfounded or excessive. + Do supervisory authorities raise public awareness? Yes. Among their tasks is promoting public awareness of the risks, rules, safeguards, and rights relating to data processing, with particular attention to children. Related Key Issues GDPR Data Protection Officer GDPR Right to be Informed

Each supervisory authority shall have all of the following investigative powers: to order the controller and the processor, and, where applicable, the controller’s or the processor’s representative to provide any information it requires for the performance of its tasks; to carry out investigations in the form of data protection audits; to carry out a review on certifications issued pursuant to Article 42(7); to notify the controller or the processor of an alleged infringement of this Regulation; to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks; to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law. Each supervisory authority shall have all of the following corrective powers: to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation; to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation; to order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to this Regulation; to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period; to order the controller to communicate a personal data breach to the data subject; to impose a temporary or definitive limitation including a ban on processing; to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19; to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met; to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case; to order the suspension of data flows to a recipient in a third country or to an international organisation. Each supervisory authority shall have all of the following authorisation and advisory powers: to advise the controller in accordance with the prior consultation procedure referred to in Article 36; to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data; to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation; to issue an opinion and approve draft codes of conduct pursuant to Article 40(5); to accredit certification bodies pursuant to Article 43 to issue certifications and approve criteria of certification in accordance with Article 42(5); to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2); to authorise contractual clauses referred to in point (a) of Article 46(3); to authorise administrative arrangements referred to in point (b) of Article 46(3); to approve binding corporate rules pursuant to Article 47. The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter. Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation. 1Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. 2The exercise of those powers shall not impair the effective operation of Chapter VII. Related Recitals (122) Responsibility of the Supervisory Authorities (129) Tasks and Powers of the Supervisory Authorities (131) Attempt of an Amicable Settlement Frequently Asked Questions about Article 58 + What powers do data protection authorities have under the GDPR? Article 58 grants investigative, corrective, authorisation, and advisory powers, including ordering compliance, issuing warnings, imposing fines, and banning processing. +Can a supervisory authority order a company to stop processing data? Yes. Corrective powers include the ability to impose a temporary or permanent limitation, including a ban, on processing. + Can authorities audit organisations under the GDPR? Yes. Investigative powers allow authorities to carry out data protection audits and obtain access to data and premises as permitted by law. Related Key Issues GDPR Right of Access GDPR Third Countries

1Each supervisory authority shall draw up an annual report on its activities, which may include a list of types of infringement notified and types of measures taken in accordance with Article 58(2). 2Those reports shall be transmitted to the national parliament, the government and other authorities as designated by Member State law. 3They shall be made available to the public, to the Commission and to the Board. Related Recitals (117) Establishment of Supervisory Authorities (118) Monitoring of the Supervisory Authorities Frequently Asked Questions about Article 59 + What are supervisory authority activity reports? Article 59 requires each supervisory authority to produce an annual report on its activities, which may include types of breaches and corrective measures taken. +Are GDPR enforcement reports public? Yes. Activity reports are transmitted to national bodies and made available to the public, the Commission, and the European Data Protection Board. + Why do supervisory authorities publish reports? Reports increase transparency and accountability, helping the public and organisations understand enforcement trends and the authority's priorities. Related Key Issues GDPR Data Protection Officer GDPR Records of Processing Activities

1The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. 2The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other. The lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State. 1The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. 2It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views. Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63. 1Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. 2That revised draft decision shall be subject to the procedure referred to in paragraph 4 within a period of two weeks. Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to be in agreement with that draft decision and shall be bound by it. 1The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. 2The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision. By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof. 1Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. 2The lead supervisory authority shall adopt the decision for the part concerning actions in relation to the controller, shall notify it to the main establishment or single establishment of the controller or processor on the territory of its Member State and shall inform the complainant thereof, while the supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of that complaint, and shall notify it to that complainant and shall inform the controller or processor thereof. 1After being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union. 2The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory authorities concerned. Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply. The lead supervisory authority and the other supervisory authorities concerned shall supply the information required under this Article to each other by electronic means, using a standardised format. Related Recitals (124) Lead Authority Regarding Processing in Several Member States (125) Competences of the Lead Authority (130) Consideration of the Authority with which the Complaint has been Lodged Frequently Asked Questions about Article 60 + How do supervisory authorities cooperate on cross-border cases? Article 60 requires the lead authority to cooperate with other concerned authorities, share information, and seek consensus before adopting decisions in cross-border cases. +What happens if authorities disagree on a cross-border case? If a concerned authority raises a relevant and reasoned objection that the lead authority does not follow, the matter is referred to the consistency mechanism. + What is a draft decision in GDPR cooperation? The lead authority prepares a draft decision and submits it to the other concerned authorities for their views before a final decision is adopted. Related Key Issues GDPR Data Protection Officer GDPR Records of Processing Activities

1Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. 2Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations. 1Each supervisory authority shall take all appropriate measures required to reply to a request of another supervisory authority without undue delay and no later than one month after receiving the request. 2Such measures may include, in particular, the transmission of relevant information on the conduct of an investigation. 1Requests for assistance shall contain all the necessary information, including the purpose of and reasons for the request. 2Information exchanged shall be used only for the purpose for which it was requested. The requested supervisory authority shall not refuse to comply with the request unless: it is not competent for the subject-matter of the request or for the measures it is requested to execute; or compliance with the request would infringe this Regulation or Union or Member State law to which the supervisory authority receiving the request is subject. 1The requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request. 2The requested supervisory authority shall provide reasons for any refusal to comply with a request pursuant to paragraph 4. Requested supervisory authorities shall, as a rule, supply the information requested by other supervisory authorities by electronic means, using a standardised format. 1Requested supervisory authorities shall not charge a fee for any action taken by them pursuant to a request for mutual assistance. 2Supervisory authorities may agree on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances. 1Where a supervisory authority does not provide the information referred to in paragraph 5 of this Article within one month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a provisional measure on the territory of its Member State in accordance with Article 55(1). 2In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an urgent binding decision from the Board pursuant to Article 66(2). 1The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in this Article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in paragraph 6 of this Article. 2Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). Related Recitals (123) Cooperation of the Supervisory Authorities with Each Other and with the Commission (132) Awareness-Raising Activities and Specific Measures (133) Mutual Assistance and Provisional Measures Frequently Asked Questions about Article 61 + What is mutual assistance under the GDPR? Article 61 requires supervisory authorities to provide each other with relevant information and assistance to implement and apply the GDPR consistently across the EU. +Must authorities respond to each other's requests? Yes. Authorities must respond to requests for mutual assistance without undue delay and within one month, and refusal is only allowed in limited circumstances. + How does mutual assistance support GDPR enforcement? It enables authorities to share investigative findings and coordinate actions, helping ensure consistent enforcement across member states. Related Key Issues GDPR Third Countries GDPR Records of Processing Activities

The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved. 1Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. 2The supervisory authority which is competent pursuant to Article 56(1) or (4) shall invite the supervisory authority of each of those Member States to take part in the joint operations and shall respond without delay to the request of a supervisory authority to participate. 1A supervisory authority may, in accordance with Member State law, and with the seconding supervisory authority’s authorisation, confer powers, including investigative powers on the seconding supervisory authority’s members or staff involved in joint operations or, in so far as the law of the Member State of the host supervisory authority permits, allow the seconding supervisory authority’s members or staff to exercise their investigative powers in accordance with the law of the Member State of the seconding supervisory authority. 2Such investigative powers may be exercised only under the guidance and in the presence of members or staff of the host supervisory authority. 3The seconding supervisory authority’s members or staff shall be subject to the Member State law of the host supervisory authority. Where, in accordance with paragraph 1, staff of a seconding supervisory authority operate in another Member State, the Member State of the host supervisory authority shall assume responsibility for their actions, including liability, for any damage caused by them during their operations, in accordance with the law of the Member State in whose territory they are operating. 1The Member State in whose territory the damage was caused shall make good such damage under the conditions applicable to damage caused by its own staff. 2The Member State of the seconding supervisory authority whose staff has caused damage to any person in the territory of another Member State shall reimburse that other Member State in full any sums it has paid to the persons entitled on their behalf. Without prejudice to the exercise of its rights vis-à-vis third parties and with the exception of paragraph 5, each Member State shall refrain, in the case provided for in paragraph 1, from requesting reimbursement from another Member State in relation to damage referred to in paragraph 4. 1Where a joint operation is intended and a supervisory authority does not, within one month, comply with the obligation laid down in the second sentence of paragraph 2 of this Article, the other supervisory authorities may adopt a provisional measure on the territory of its Member State in accordance with Article 55. 2In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an opinion or an urgent binding decision from the Board pursuant to Article 66(2). Related Recitals (126) Joint Decisions (134) Participation in Joint Operations Frequently Asked Questions about Article 62 + What are joint operations under the GDPR? Article 62 allows supervisory authorities to conduct joint operations, including joint investigations and enforcement measures, especially where processing affects individuals in several member states. +Can data protection authorities investigate together? Yes. Authorities may carry out joint investigations and second members or staff to each other's operations under agreed conditions. + Why are joint operations useful? They allow authorities to pool resources and expertise for cases that span multiple member states, improving the effectiveness of enforcement. Related Key Issues GDPR Privacy Impact Assessment GDPR Records of Processing Activities

In this page Key Facts The Four Tools Article 63 Points To Who Is Bound by an EDPB Binding Decision? GDPR Article 63 in Enforcement: Binding Decisions That Rewrote Fines Recitals That Explain Article 63 Checklist: Facing a Cross-Border Consistency Procedure Frequently Asked Questions about Article 63 Related Key Issues and Articles Art. 63 In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section. general principle In short Article 63 is a single sentence, and it is the only provision in Chapter VII that is. It does not regulate processing, and it gives no right to a data subject and no duty to a controller. It is the heading over Section 2 of Chapter VII: a instruction that supervisory authorities must cooperate through a specific set of tools, listed in Article 64, Article 65, Article 66 and Article 67, so that the same processing does not get judged differently depending on which country's authority happens to be looking at it. Almost no fine cites Article 63 as an infringed provision, because it is not one. Its practical weight shows up indirectly: whenever a decision explains that a fine was increased, or a finding was added, "following the EDPB's binding decision" or "pursuant to Article 65", that outcome exists because Article 63 required the mechanism to be used in the first place. Key Facts Chapter Chapter VII – Cooperation and consistency (Art. 60–76), Section 2 – Consistency (Art. 63–67) Applies to Supervisory authorities and the European Data Protection Board. It creates no obligation that a controller or processor can itself breach Maximum fine None directly. Fines are still set under Art. 83 by the lead supervisory authority, but a binding decision reached through this mechanism can direct that authority to add a finding or increase the amount, as happened to WhatsApp, Instagram and TikTok In force since 25 May 2018 Explained by recitals 135, 136, 137, 138 Depends on Art. 60 for the cross-border cooperation duty that most often generates the disputes this mechanism resolves Implemented by Art. 64 (opinions), Art. 65 (dispute resolution), Art. 66 (urgency), Art. 67 (information exchange) Closest UK equivalent Omitted from the UK GDPR. The EU consistency mechanism and the Board's jurisdiction operate within the EU/EEA only; the ICO sits outside it since Brexit The Four Tools Article 63 Points To Article 63 itself names none of these. It simply says the authorities shall cooperate "through the consistency mechanism as set out in this Section" — this table is what that Section actually contains. Tool What it does Governing provision Opinion of the Board A non-binding opinion the Board gives on a matter of general application, or before a supervisory authority approves something with cross-border effect, such as binding corporate rules or a code of conduct Art. 64 Dispute resolution A binding decision resolving a disagreement between the lead authority and one or more concerned authorities over a "relevant and reasoned objection" to a draft decision, adopted by a two-thirds majority of the Board Art. 65 Urgency procedure Lets an authority adopt provisional measures immediately in exceptional circumstances, or ask the Board for an urgent binding decision, when the ordinary timelines cannot accommodate the risk Art. 66 Exchange of information Requires supervisory authorities and the Board to share whatever information is needed to perform their tasks under the Regulation, through a common electronic system Art. 67 Who Is Bound by an EDPB Binding Decision? This is the question that most affects a company caught in a cross-border inquiry. A binding decision under Article 65 is addressed to supervisory authorities, not to the controller — at least, that was the position until a 2026 judgment reopened it. Situation Who Article 65 binds What that means in practice Lead authority and concerned authorities disagree on a draft decision The lead authority and every concerned supervisory authority The lead authority must adopt its final decision on the basis of the binding decision and notify it at the latest one month after receiving it The controller or processor under investigation Not directly — only once the lead authority's national decision, based on the binding decision, is adopted and notified The CJEU's February 2026 ruling in WhatsApp v EDPB held that the binding decision itself can also be challenged directly before the EU courts, alongside the national decision that implements it A concerned authority whose objection the Board rejected That authority, the same as any other authority bound by the decision Losing an objection does not give an authority a veto or a right to depart from the final, EU-wide outcome GDPR Article 63 in Enforcement: Binding Decisions That Rewrote Fines Article 63 never appears as an infringed provision. What appears instead is Article 65, the dispute-resolution tool the consistency mechanism exists to make available. Every case below started as a lead authority's draft decision and ended up materially different once the Board settled an unresolved objection. Controller Lead authority EDPB binding decision Outcome WhatsApp Ireland Ltd DPC (Ireland) Binding Decision 1/2021, 28 Jul 2021 Fine raised from a draft in the €30.000.000–50.000.000 range to €225.000.000; now before the EU courts on its merits TikTok Technology Ltd DPC (Ireland) Binding Decision 2/2023, 2 Aug 2023 New Art. 5(1)(a) fairness finding added; €345.000.000 fine Meta Platforms Ireland (Instagram) DPC (Ireland) Binding Decision 2/2022, 28 Jul 2022 New Art. 6(1) finding added; €405.000.000 fine The Meta Platforms Ireland €390.000.000 decision, already documented on this site under Article 6, followed the same route: Binding Decision 3/2022 directed the DPC to reverse its draft conclusion on legal basis. And the largest GDPR fine to date, the €1.200.000.000 penalty on Meta over EU–US data transfers announced 22 May 2023, followed Binding Decision 1/2023. Both decisions, like WhatsApp's, are the subject of pending annulment actions by Meta before the EU courts. Why an EU court can now look at this at all Until February 2026, a company's only route to challenge an EDPB binding decision was to challenge the national decision that implemented it, in a national court. On 10 February 2026, the Court of Justice ruled in Case C-97/23 P, WhatsApp Ireland v EDPB, that a binding decision is itself an act open to challenge under Article 263 TFEU, because it unconditionally determines the infringement findings and the fine calculation that the lead authority has no discretion to alter. Several similar actions by Meta and WhatsApp against other binding decisions were pending before the General Court at the time. Recitals That Explain Article 63 Recital 135 – Consistency MechanismStates why the mechanism exists: to ensure consistent application of the Regulation across the Union. It says the mechanism should apply in particular where an authority intends to adopt a measure affecting a significant number of data subjects in several Member States, or where any concerned authority or the Commission asks for the matter to be handled that way. Recital 136 – Binding Decisions and Opinions of the BoardExplains the factors the Board should weigh when it acts, including consistency in applying the Regulation and, where relevant, whether a fair balance has been struck between the interests involved. It is the recital most often cited when a binding decision explains how the Board arrived at a fine or a finding. Recital 137 – Provisional MeasuresCovers the situation where a supervisory authority needs to act before the ordinary consistency procedure could conclude, and sets out how a provisional measure adopted in urgency should be treated, including its limited period of validity. Recital 138 – Urgency ProcedureExplains when the Board itself, rather than a single authority, needs to be able to act urgently, and why an urgent binding decision needs a shorter timeline than the ordinary Article 65 procedure. Checklist: Facing a Cross-Border Consistency Procedure Identify your lead supervisory authority correctly, and remember that a favorable draft decision from it is not the end of the process Track the one-month window concerned authorities have to raise a "relevant and reasoned objection" once a draft decision is circulated under Art. 60(4) Understand that a single unresolved objection, even from one authority, is enough to trigger Art. 65 dispute resolution for the whole file Expect the Board's binding decision to be able to add an infringement finding or increase a proposed fine, not only approve or reduce what the lead authority proposed Build extra time into any regulatory timeline estimate: dispute resolution under Art. 65 can add months, and any resulting court challenge can add years Watch for the urgency procedure under Art. 66 if immediate provisional measures are threatened outside the ordinary timeline Know that since the 2026 CJEU ruling, a binding decision may itself be challengeable before the EU courts, in addition to challenging the lead authority's national decision Keep records and evidence in a form that can satisfy several national authorities' expectations, not only the lead authority's, since concerned authorities can and do dispute factual findings None of this is something a consent banner or a policy template can fix on its own. The organisations that come through a consistency procedure best are the ones whose records, per-market notices and audit trail were already built to satisfy more than one regulator's expectations. A consent and preference management platform that logs evidence per jurisdiction from day one is one way to be ready before an objection ever gets filed. Learn more about Secure Privacy Related Recitals (135) Consistency Mechanism Article 63 Enforcement Cases WhatsApp's €225M Fine TikTok's €345M Fine All Article 63 cases Frequently Asked Questions about Article 63 +What does Article 63 GDPR actually require? Only that supervisory authorities cooperate with each other, and where relevant with the Commission, through the consistency mechanism described in Section 2 of Chapter VII. It is a single sentence that points to four operational tools: the opinion procedure (Art. 64), dispute resolution (Art. 65), the urgency procedure (Art. 66) and the exchange of information (Art. 67). It does not itself set out any of their detail. +Does Article 63 apply to companies, or only to regulators? Directly, only to supervisory authorities and the Board. A controller or processor never has an "Article 63 obligation" to comply with. Companies feel its effect only once a dispute resolved through the mechanism changes a decision that names them, as happened to WhatsApp, Instagram and TikTok. + What is the difference between the Article 64 opinion procedure and Article 65 dispute resolution? An Article 64 opinion is advisory. The Board gives it on a matter of general application, or before certain approvals such as binding corporate rules, and the requesting authority is not bound to follow it. Article 65 dispute resolution produces a binding decision that resolves an actual, unresolved objection to a specific draft decision, and every authority involved must implement it. + Can a company challenge an EDPB binding decision directly? Until 10 February 2026, no: a company could only challenge the national decision that implemented it. That day, the CJEU ruled in WhatsApp v EDPB (Case C-97/23 P) that a binding decision is itself a reviewable act of direct concern to the controller it names, and sent WhatsApp's case back to the General Court to decide on the merits. +Why do EDPB binding decisions sometimes increase a fine the lead authority already proposed? Because a concerned authority's objection can argue the draft decision under-assessed the gravity, scale or turnover relevant to the fine, not only that a finding was wrong. If the Board agrees, Article 65 requires it to decide the point on the merits, which can mean instructing the lead authority to reassess and increase the amount, as happened with WhatsApp's fine. +Is the consistency mechanism the same thing as the one-stop-shop? Related but distinct. The one-stop-shop, set out mainly in Article 60, determines which authority leads a cross-border case and how it cooperates with concerned authorities on that one file. The consistency mechanism in Article 63 is the EU-wide layer that resolves disagreement when that cooperation does not reach consensus, among other triggers, and keeps the outcome uniform across all Member States. Related Key Issues GDPR Third Countries GDPR Right to be Forgotten

1The Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures below. 2To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it: aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35(4); concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation; aims to approve the requirements for accreditation of a body pursuant to Article 41(3), of a certification body pursuant to Article 43(3) or the criteria for certification referred to in Article 42(5); aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8); aims to authorise contractual clauses referred to in point (a) of Article 46(3); or aims to approve binding corporate rules within the meaning of Article 47. Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62. 1In the cases referred to in paragraphs 1 and 2, the Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter. 2That opinion shall be adopted within eight weeks by simple majority of the members of the Board. 3That period may be extended by a further six weeks, taking into account the complexity of the subject matter. 4Regarding the draft decision referred to in paragraph 1 circulated to the members of the Board in accordance with paragraph 5, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision. Supervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the Board, using a standardised format any relevant information, including as the case may be a summary of the facts, the draft decision, the grounds which make the enactment of such measure necessary, and the views of other supervisory authorities concerned. The Chair of the Board shall, without undue, delay inform by electronic means: the members of the Board and the Commission of any relevant information which has been communicated to it using a standardised format. The secretariat of the Board shall, where necessary, provide translations of relevant information; and the supervisory authority referred to, as the case may be, in paragraphs 1 and 2, and the Commission of the opinion and make it public. The competent supervisory authority referred to in paragraph 1 shall not adopt its draft decision referred to in paragraph 1 within the period referred to in paragraph 3. The competent supervisory authority referred to in paragraph 1 shall take utmost account of the opinion of the Board and shall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether it will maintain or amend its draft decision and, if any, the amended draft decision, using a standardised format. Where the competent supervisory authority referred to in paragraph 1 informs the Chair of the Board within the period referred to in paragraph 7 of this Article that it does not intend to follow the opinion of the Board, in whole or in part, providing the relevant grounds, Article 65(1) shall apply. Related Recitals (136) Binding Decisions and Opinions of the Board Frequently Asked Questions about Article 64 +When does the European Data Protection Board issue an opinion? Article 64 requires the Board to issue opinions on certain matters, such as codes of conduct, binding corporate rules, and measures with cross-border effect. +Are Board opinions binding on supervisory authorities? Opinions are advisory, but authorities must take utmost account of them, and failure to follow an opinion can trigger the binding dispute resolution procedure. + What is the role of the EDPB opinion? The opinion promotes consistency by giving authorities guidance on how the GDPR should be applied in specific cases or general questions. Related Key Issues GDPR Fines / Penalties GDPR Records of Processing Activities

In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases: where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead supervisory authority and the lead supervisory authority has not followed the objection or has rejected such an objection as being not relevant or reasoned. The binding decision shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement of this Regulation; where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment; where a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board. 1The decision referred to in paragraph 1 shall be adopted within one month from the referral of the subject-matter by a two-thirds majority of the members of the Board. 2That period may be extended by a further month on account of the complexity of the subject-matter. 3The decision referred to in paragraph 1 shall be reasoned and addressed to the lead supervisory authority and all the supervisory authorities concerned and binding on them. 1Where the Board has been unable to adopt a decision within the periods referred to in paragraph 2, it shall adopt its decision within two weeks following the expiration of the second month referred to in paragraph 2 by a simple majority of the members of the Board. 2Where the members of the Board are split, the decision shall by adopted by the vote of its Chair. The supervisory authorities concerned shall not adopt a decision on the subject matter submitted to the Board under paragraph 1 during the periods referred to in paragraphs 2 and 3. 1The Chair of the Board shall notify, without undue delay, the decision referred to in paragraph 1 to the supervisory authorities concerned. 2It shall inform the Commission thereof. 3The decision shall be published on the website of the Board without delay after the supervisory authority has notified the final decision referred to in paragraph 6. 1The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged shall adopt its final decision on the basis of the decision referred to in paragraph 1 of this Article, without undue delay and at the latest by one month after the Board has notified its decision. 2The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged, shall inform the Board of the date when its final decision is notified respectively to the controller or the processor and to the data subject. 3The final decision of the supervisory authorities concerned shall be adopted under the terms of Article 60(7), (8) and (9). 4The final decision shall refer to the decision referred to in paragraph 1 of this Article and shall specify that the decision referred to in that paragraph will be published on the website of the Board in accordance with paragraph 5 of this Article. 5The final decision shall attach the decision referred to in paragraph 1 of this Article. Related Recitals (136) Binding Decisions and Opinions of the Board Frequently Asked Questions about Article 65 +How are disputes between supervisory authorities resolved? Article 65 empowers the European Data Protection Board to adopt binding decisions to resolve disputes between authorities, for example over objections in cross-border cases. +Are EDPB dispute decisions binding? Yes. Decisions under Article 65 are binding on the supervisory authorities concerned, who must adopt their final decisions accordingly. + When does the Board step in to resolve a dispute? The Board intervenes where authorities cannot agree, such as when a lead authority does not follow a relevant and reasoned objection from another authority. Related Key Issues GDPR Right of Access GDPR Right to be Forgotten

1In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65 or the procedure referred to in Article 60, immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. 2The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other supervisory authorities concerned, to the Board and to the Commission. Where a supervisory authority has taken a measure pursuant to paragraph 1 and considers that final measures need urgently be adopted, it may request an urgent opinion or an urgent binding decision from the Board, giving reasons for requesting such opinion or decision. Any supervisory authority may request an urgent opinion or an urgent binding decision, as the case may be, from the Board where a competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act, in order to protect the rights and freedoms of data subjects, giving reasons for requesting such opinion or decision, including for the urgent need to act. By derogation from Article 64(3) and Article 65(2), an urgent opinion or an urgent binding decision referred to in paragraphs 2 and 3 of this Article shall be adopted within two weeks by simple majority of the members of the Board. Related Recitals (137) Provisional Measures (138) Urgency Procedure Frequently Asked Questions about Article 66 +What is the urgency procedure under the GDPR? Article 66 allows a supervisory authority to adopt provisional measures immediately where urgent action is needed to protect individuals, bypassing the usual consistency mechanism. +How long do urgent GDPR measures last? Provisional measures adopted under the urgency procedure are valid for a limited period not exceeding three months. + Can the EDPB act urgently? Yes. The Board can adopt an urgent binding decision where an authority requests it because of the need for urgent action. Related Key Issues GDPR Right to be Informed GDPR Privacy Impact Assessment

The Commission may adopt implementing acts of general scope in order to specify the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in Article 64. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). Related Recitals (123) Cooperation of the Supervisory Authorities (124) Lead Authority Regarding Processing in Several Member States (125) Competences of the Lead Authority Frequently Asked Questions about Article 67 +What does Article 67 GDPR cover? Article 67 allows the Commission to adopt measures specifying how supervisory authorities and the Board exchange information electronically and in a standardised way. +How do authorities share information under the GDPR? Authorities use standardised formats and secure electronic means to exchange information, supporting cooperation and the consistency mechanism. + Why standardise information exchange? Standardisation improves efficiency and reliability when authorities cooperate on investigations, opinions, and decisions across borders. Related Key Issues GDPR Encryption GDPR Records of Processing Activities

The European Data Protection Board (the ‘Board’) is hereby established as a body of the Union and shall have legal personality. The Board shall be represented by its Chair. The Board shall be composed of the head of one supervisory authority of each Member State and of the European Data Protection Supervisor, or their respective representatives. Where in a Member State more than one supervisory authority is responsible for monitoring the application of the provisions pursuant to this Regulation, a joint representative shall be appointed in accordance with that Member State’s law. 1The Commission shall have the right to participate in the activities and meetings of the Board without voting right. 2The Commission shall designate a representative. 3The Chair of the Board shall communicate to the Commission the activities of the Board. In the cases referred to in Article 65, the European Data Protection Supervisor shall have voting rights only on decisions which concern principles and rules applicable to the Union institutions, bodies, offices and agencies which correspond in substance to those of this Regulation. Related Recitals (139) European Data Protection Board Frequently Asked Questions about Article 68 +What is the European Data Protection Board (EDPB)? Article 68 establishes the EDPB as an independent EU body made up of the heads of national supervisory authorities and the European Data Protection Supervisor. +What does the EDPB do? The EDPB ensures consistent application of the GDPR, issues guidelines and opinions, and resolves disputes between national supervisory authorities. + Who sits on the European Data Protection Board? It comprises the head of one supervisory authority per member state and the European Data Protection Supervisor, with the Commission participating without voting rights. Related Key Issues Right to be Informed GDPR Records of Processing Activities

The Board shall act independently when performing its tasks or exercising its powers pursuant to Articles 70 and 71. Without prejudice to requests by the Commission referred to in Article 70(1) and (2), the Board shall, in the performance of its tasks or the exercise of its powers, neither seek nor take instructions from anybody. Related Recitals (139) European Data Protection Board Frequently Asked Questions about Article 69 +Is the European Data Protection Board independent? Yes. Article 69 requires the EDPB to act independently when performing its tasks and exercising its powers, free from external instructions. +Can anyone instruct the EDPB? No. The Board must neither seek nor take instructions from anybody when carrying out its functions under the GDPR. + Why is EDPB independence important? Independence ensures the Board's guidance and decisions are impartial, strengthening trust in consistent EU-wide data protection enforcement. Related Key Issues Privacy by Design GDPR Data Protection Officer

In this page Key Facts What the Board Produces EDPB Guidance by Topic Decisions Where the Board Changed the Outcome The EDPB in Court Recitals That Explain Article 70 Checklist: Organisations Processing Across Borders Frequently Asked Questions about Article 70 Related Articles Art. 70(1) The Board shall ensure the consistent application of this Regulation. To that end, the Board shall, on its own initiative or, where relevant, at the request of the Commission, in particular: monitor and ensure the correct application of this Regulation in the cases provided for in Articles 64 and 65 without prejudice to the tasks of national supervisory authorities; advise the Commission on any issue related to the protection of personal data in the Union, including on any proposed amendment of this Regulation; advise the Commission on the format and procedures for the exchange of information between controllers, processors and supervisory authorities for binding corporate rules; issue guidelines, recommendations, and best practices on procedures for erasing links, copies or replications of personal data from publicly available communication services as referred to in Article 17(2); examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation; issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for decisions based on profiling pursuant to Article 22(2); issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing the personal data breaches and determining the undue delay referred to in Article 33(1) and (2) and for the particular circumstances in which a controller or a processor is required to notify the personal data breach; issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph as to the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of the natural persons referred to in Article 34(1); issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for personal data transfers based on binding corporate rules adhered to by controllers and binding corporate rules adhered to by processors and on further necessary requirements to ensure the protection of personal data of the data subjects concerned referred to in Article 47; issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for the personal data transfers on the basis of Article 49(1); draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 58(1), (2) and (3) and the setting of administrative fines pursuant to Article 83; review the practical application of the guidelines, recommendations and best practices; issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing common procedures for reporting by natural persons of infringements of this Regulation pursuant to Article 54(2); encourage the drawing-up of codes of conduct and the establishment of data protection certification mechanisms and data protection seals and marks pursuant to Articles 40 and 42; approve the criteria of certification pursuant to Article 42(5) and maintain a public register of certification mechanisms and data protection seals and marks pursuant to Article 42(8) and of the certified controllers or processors established in third countries pursuant to Article 42(7); approve the requirements referred to in Article 43(3) with a view to the accreditation of certification bodies referred to in Article 43; provide the Commission with an opinion on the certification requirements referred to in Article 43(8); provide the Commission with an opinion on the icons referred to in Article 12(7); provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third country or international organisation, including for the assessment whether a third country, a territory or one or more specified sectors within that third country, or an international organisation no longer ensures an adequate level of protection. To that end, the Commission shall provide the Board with all necessary documentation, including correspondence with the government of the third country, with regard to that third country, territory or specified sector, or with the international organisation; issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in Article 64(1), on matters submitted pursuant to Article 64(2) and to issue binding decisions pursuant to Article 65, including in cases referred to in Article 66; promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between the supervisory authorities; promote common training programmes and facilitate personnel exchanges between the supervisory authorities and, where appropriate, with the supervisory authorities of third countries or with international organisations; promote the exchange of knowledge and documentation on data protection legislation and practice with data protection supervisory authorities worldwide; issue opinions on codes of conduct drawn up at Union level pursuant to Article 40(9); and maintain a publicly accessible electronic register of decisions taken by supervisory authorities and courts on issues handled in the consistency mechanism. 25 listed tasks Art. 70(2) Where the Commission requests advice from the Board, it may indicate a time limit, taking into account the urgency of the matter. Commission deadlines Art. 70(3) The Board shall forward its opinions, guidelines, recommendations, and best practices to the Commission and to the committee referred to in Article 93 and make them public. publication Art. 70(4) The Board shall, where appropriate, consult interested parties and give them the opportunity to comment within a reasonable period. The Board shall, without prejudice to Article 76, make the results of the consultation procedure publicly available. public consultation In short Article 70 is the job description of the European Data Protection Board (EDPB). Its central task is to make sure the GDPR is applied the same way everywhere. It does that by issuing guidelines, giving opinions, and settling disputes between national authorities with binding decisions. It must publish what it produces and, where appropriate, consult the public first. The Board doesn't fine companies, and no one can breach Article 70. But its decisions have repeatedly changed enforcement outcomes. It pushed WhatsApp's fine from a proposed €30–50 million to €225.000.000, raised Accor's from €100.000 to €600.000, and made the Irish DPC fine Meta €1.200.000.000 in a case where it had proposed no fine at all. Since February 2026, companies can challenge those decisions directly before the EU courts. Key Facts Chapter Chapter VII – Cooperation and consistency, Section 3: European Data Protection Board (Art. 68–76) Addressed to The European Data Protection Board, not to controllers or processors Who sits on the Board The head of one supervisory authority of each Member State and the European Data Protection Supervisor (Art. 68(3)) Maximum fine Not applicable. Article 70 sets tasks for the Board; fines are imposed by national supervisory authorities under Art. 83 Most important task in practice Art. 70(1)(t): opinions under Art. 64 and binding decisions under Art. 65, which bind all supervisory authorities concerned Court review Binding decisions can be challenged directly by the companies they concern (CJEU, C-97/23 P, 10 Feb 2026) Public record The Board keeps a public register of decisions handled in the consistency mechanism (Art. 70(1)(y)) In force since 25 May 2018 Explained by recitals Recitals 136 and 139 Works with Art. 60 (one-stop-shop cooperation), Art. 63 to 67 (consistency mechanism), Art. 68 (the Board) What the Board Produces Most of the 25 tasks lead to one of four kinds of output. They differ in who they bind and how they reach organisations: Output Art. 70 task Effect Example Binding decision (1)(t), under Art. 65 Settles a dispute between authorities. Binding on all authorities concerned; the lead authority must adopt its final decision on that basis Binding Decision 1/2023, Meta transfers Opinion on a general question (1)(t), under Art. 64(2) Requested by an authority, the Chair or the Commission on a matter affecting several Member States. DataGuidance describes such an opinion as not legally binding but a guide to interpretation Opinion 08/2024, "consent or pay" Guidelines (1)(d) to (k), (m) Explain how GDPR provisions should be applied; published and, where appropriate, consulted on (Art. 70(3)–(4)) Guidelines 9/2022, breach notification Advice to the Commission (1)(b), (c), (q), (r), (s) Opinions on proposed laws, adequacy decisions and certification The EDPB–EDPS Joint Opinion of February 2026 on the Digital Omnibus proposal EDPB Guidance by Topic A starting point for the Board outputs organisations ask about most. Each is linked to its source: Topic EDPB output Key point Consent and cookie banners Guidelines 05/2020 on consent (adopted 4 May 2020) Cookie walls that make access depend on consent don't produce valid consent, and scrolling or swiping can't count as consent "Consent or pay" models Opinion 08/2024 (17 Apr 2024) For large online platforms, a straight choice between consenting to behavioural advertising and paying will in most cases not give valid consent Personal data breaches Guidelines 9/2022 (v2.0, 28 Mar 2023) When the 72-hour clock starts and where non-EU controllers notify; covered on our Art. 33 page How fines are calculated Guidelines 04/2022 on the calculation of fines (v1.0 adopted 12 May 2022, as cited in Binding Decision 1/2023) The method authorities use to set fines, relied on in objections such as the Austrian authority's in the Meta transfers case Decisions Where the Board Changed the Outcome Each of these cases reached the Board because the lead authority and at least one other authority couldn't agree. Selected binding decisions under Art. 65: Case Lead authority Objected What the Board changed Final fine Twitter International (BD 1/2020) DPC (Ireland) Including Austria, Italy and Germany Directed a higher fine than the proposed €135.000–275.000 €450.000 WhatsApp Ireland (BD 1/2021) DPC (Ireland) Eight authorities Added findings, counted group turnover, directed a higher fine than the proposed €30–50 million €225.000.000 Accor (BD 1/2022) CNIL (France) Poland Found the proposed €100.000 not dissuasive and rejected a Covid-19 reduction €600.000 Meta (Instagram, children's data) (BD 2/2022) DPC (Ireland) Six authorities Added an Art. 6(1) infringement and required the fine to be reassessed €405.000.000 Meta (Facebook transfers) (BD 1/2023) DPC (Ireland) Four of 47 authorities Required a fine where none was proposed, plus an order on data already transferred €1.200.000.000 TikTok (BD 2/2023) DPC (Ireland) Italy and Berlin Added a fairness (dark patterns) infringement €345.000.000 All Article 70 cases: where the Board changed the outcome The EDPB in Court Companies have increasingly taken the Board itself to the EU courts, not just the national authority that fined them: Case What was challenged Status Source WhatsApp Ireland v EDPB (C-97/23 P) Binding Decision 1/2021 The General Court dismissed the action as inadmissible on 7 Dec 2022. On 10 Feb 2026 the Court of Justice held it admissible and sent it back to be decided on the merits CJEU press release Meta Platforms Ireland v EDPB (T-319/24) Opinion 08/2024 on "consent or pay" Dismissed by the General Court on 29 Apr 2025 Digital Policy Alert TikTok Technology v EDPB (T-1030/23) Binding Decision 2/2023 Action brought on 10 Oct 2023 Digital Policy Alert WhatsApp Ireland v EDPB (T-153/23) Binding Decision 5/2022 Seeks annulment, arguing among other things that the Board wasn't impartial DAC Beachcroft Recitals That Explain Article 70 Recital 136 – Binding decisions of the BoardIn applying the consistency mechanism, the Board should issue an opinion within a set period where a majority of its members so decides, or where an authority concerned or the Commission requests it. It should also be empowered to adopt legally binding decisions where there are disputes between supervisory authorities. Recital 139 – European Data Protection BoardThe Board is established as an independent body of the Union with legal personality, replacing the Article 29 Working Party. It brings together the heads of each Member State's supervisory authority and the European Data Protection Supervisor, and contributes to consistent application of the Regulation, including by advising the Commission and promoting cooperation between authorities. Checklist: Organisations Processing Across Borders Don't treat the lead authority's draft decision as final: other authorities can object, and the Board can change findings, fines and orders (Meta transfers) Make your full case to the lead authority. The Board can hear the company before deciding, but in Accor it chose not to (Accor) Expect fines to be calculated on the turnover of the year before the final decision, and on group turnover where relevant (Accor, WhatsApp) Don't count on a reduction for a hard year: the Board held a mitigating adjustment is only appropriate where the company can't pay (Accor) Follow Board guidance and opinions on your topics, such as consent and cookie banners, and check against them when you change your processing If a binding decision affects you, note that it can now be challenged directly before the EU General Court (WhatsApp) Much of what authorities check on websites comes from the Board: no cookie walls, no consent by scrolling, a real choice in "consent or pay." Consent management that follows EDPB guidance as it develops keeps banners aligned with the standard regulators use. Learn more about Secure Privacy Related Recitals (136) Binding Decisions and Opinions of the Board (139) European Data Protection Board Article 70 nforcement Cases Meta's €1.200.000.000 Transfers Fine: The Fine the DPC Didn't Propose WhatsApp's Fine Raised from €30–50 Million to €225.000.000 Accor's Fine Raised from €100.000 to €600.000 Twitter International: The First Article 65 Decision TikTok: The Fairness Finding Added by the Board Frequently Asked Questions about Article 70 +Can the EDPB fine a company? No. Fines are imposed by national supervisory authorities. But in a dispute, the Board's binding decision can instruct the lead authority to impose one, as it did with Meta's data transfers in 2023. +How does a case end up before the Board? When the lead authority circulates a draft decision, other concerned authorities can raise relevant and reasoned objections. If the lead authority won't follow them, it must refer the dispute to the Board under Article 65, and then adopt its final decision on the basis of the Board's ruling. +Can companies challenge EDPB decisions? Yes. On 10 February 2026 the Court of Justice held that WhatsApp's action against Binding Decision 1/2021 was admissible, because the decision directly concerned the company. The General Court had earlier dismissed the action, finding the decision didn't directly concern WhatsApp. +Are EDPB opinions binding on companies? Opinions such as Opinion 08/2024 on "consent or pay" have been described as not legally binding, but as guidance on how to interpret the GDPR. Binding decisions under Article 65 are different: they bind the supervisory authorities concerned. +Who sits on the EDPB? The head of one supervisory authority from each Member State and the European Data Protection Supervisor (Article 68(3)). +Where can I find EDPB decisions? Article 70(1)(y) requires the Board to keep a public register of decisions taken by authorities and courts on issues handled in the consistency mechanism, and Article 70(3) requires it to publish its opinions and guidelines. Related Key Issues GDPR Data Protection Officer GDPR Privacy Impact Assessment

1The Board shall draw up an annual report regarding the protection of natural persons with regard to processing in the Union and, where relevant, in third countries and international organisations. 2The report shall be made public and be transmitted to the European Parliament, to the Council and to the Commission. The annual report shall include a review of the practical application of the guidelines, recommendations and best practices referred to in point (l) of Article 70(1) as well as of the binding decisions referred to in Article 65. Related Recitals (135) Consistency Mechanism (136) Binding Decisions and Opinions of the Board Frequently Asked Questions about Article 71 +Does the European Data Protection Board publish reports? Yes. Article 71 requires the EDPB to draw up an annual report on the protection of individuals regarding processing in the EU and, where relevant, third countries. +Are EDPB reports public? Yes. The annual report is made public and transmitted to the European Parliament, the Council, and the Commission. + What do EDPB reports cover? Reports may include guidance on best practices and an overview of the state of data protection across the EU. Related Key Issues GDPR Processing GDPR Third Countriesa

The Board shall take decisions by a simple majority of its members, unless otherwise provided for in this Regulation. The Board shall adopt its own rules of procedure by a two-thirds majority of its members and organise its own operational arrangements. Related Recitals (10) Harmonised Level of Data Protection Despite National Scope (11) Harmonisation of the Powers and Sanctions (117) Establishment of Supervisory Authorities Frequently Asked Questions about Article 72 +How does the European Data Protection Board make decisions? Article 72 provides that the EDPB takes decisions by a simple majority of its members, unless its rules of procedure state otherwise. +Does the EDPB have rules of procedure? Yes. The Board adopts its own rules of procedure by a two-thirds majority and organises its own operational arrangements. + How are EDPB votes counted? Decisions are generally made by simple majority, with specific majorities required for certain matters such as adopting rules of procedure. Related Key Issues GDPR Email Marketing GDPR Right to be Forgotten

The Board shall elect a chair and two deputy chairs from amongst its members by simple majority. The term of office of the Chair and of the deputy chairs shall be five years and be renewable once. Related Recitals (117) Establishment of Supervisory Authorities (123) Cooperation of the Supervisory Authorities Frequently Asked Questions about Article 73 +Who chairs the European Data Protection Board? Article 73 provides that the EDPB elects a chair and two deputy chairs from among its members by simple majority. +How long is the EDPB chair's term? The chair and deputy chairs serve a term of five years and may be reappointed once. + What is the role of the EDPB chair? The chair leads the Board's work, convenes meetings, and represents the Board, supported by the deputy chairs. Related Key Issues GDPR Processing GDPR Privacy by Design

The Chair shall have the following tasks: to convene the meetings of the Board and prepare its agenda; to notify decisions adopted by the Board pursuant to Article 65 to the lead supervisory authority and the supervisory authorities concerned; to ensure the timely performance of the tasks of the Board, in particular in relation to the consistency mechanism referred to in Article 63. The Board shall lay down the allocation of tasks between the Chair and the deputy chairs in its rules of procedure. Related Recitals (13) Taking Account of Micro, Small and Medium-sized Enterprises (22) Processing by an Establishment (80) Designation of a Representative Frequently Asked Questions about Article 74 +What are the tasks of the EDPB chair? Article 74 tasks the chair with convening Board meetings, preparing their agenda, and notifying decisions to supervisory authorities, among other duties. +Does the EDPB chair set meeting agendas? Yes. The chair prepares and communicates the agenda and ensures the timely performance of the Board's tasks. + Who handles EDPB communications with authorities? The chair is responsible for notifying decisions of the Board to the lead and concerned supervisory authorities. Related Key Issues GDPR Personal Data GDPR Fines / Penalties

The Board shall have a secretariat, which shall be provided by the European Data Protection Supervisor. The secretariat shall perform its tasks exclusively under the instructions of the Chair of the Board. The staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by this Regulation shall be subject to separate reporting lines from the staff involved in carrying out tasks conferred on the European Data Protection Supervisor. Where appropriate, the Board and the European Data Protection Supervisor shall establish and publish a Memorandum of Understanding implementing this Article, determining the terms of their cooperation, and applicable to the staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by this Regulation. The secretariat shall provide analytical, administrative and logistical support to the Board. The secretariat shall be responsible in particular for: the day-to-day business of the Board; communication between the members of the Board, its Chair and the Commission; communication with other institutions and the public; the use of electronic means for the internal and external communication; the translation of relevant information; the preparation and follow-up of the meetings of the Board; the preparation, drafting and publication of opinions, decisions on the settlement of disputes between supervisory authorities and other texts adopted by the Board. Related Recitals (140) Secretariat and Staff of the Board Frequently Asked Questions about Article 75 +Who provides the secretariat for the European Data Protection Board? Article 75 provides that the European Data Protection Supervisor provides the secretariat for the EDPB, acting only on the instructions of the chair. +What does the EDPB secretariat do? The secretariat provides analytical, administrative, and logistical support, prepares documents, and supports the Board's communication and cooperation tasks. + Is the EDPB secretariat independent? The secretariat performs its tasks exclusively under the instructions of the chair of the Board, supporting its independent functioning. Related Key Issues GDPR Right of Access GDPR Data Protection Officer

In this page Key Facts What Confidentiality Actually Covers Confidentiality vs. the Right of Public Access Article 76 in Practice: The Ombudsman Case Recitals That Touch on Article 76 Checklist: Requesting or Submitting Board Documents Frequently Asked Questions about Article 76 Related Articles Art. 76(1) The discussions of the Board shall be confidential where the Board deems it necessary, as provided for in its rules of procedure. Board governance Art. 76(2) Access to documents submitted to members of the Board, experts and representatives of third parties shall be governed by Regulation (EC) No 1049/2001 of the European Parliament and of the Council. document access In short Article 76 is two sentences, and it does two narrow things. It lets the EDPB's own rules of procedure treat its discussions — the deliberative back-and-forth, not its final outputs — as confidential where the Board decides that's necessary. And it says that access to documents submitted to the Board is governed by the EU's general transparency law, Regulation (EC) No 1049/2001, rather than by any data-protection-specific access rule. Like Article 63, no fine has ever cited Article 76 as an infringed provision, because it can't be — it binds the Board's own procedure, not controllers or processors. Its only real test so far came from the opposite direction: in 2023 the European Ombudsman found that the EDPB itself had leaned on Article 76 and its own confidentiality rules too heavily when refusing a public access request, and that doing so was maladministration. Key Facts Chapter Chapter VII – Cooperation and consistency (Art. 60–76), Section 3 – European Data Protection Board (Art. 68–76) Applies to The European Data Protection Board itself, and anyone requesting access to documents it holds. It creates no obligation that a controller or processor can itself breach Maximum fine None. Article 76 is a governance rule about the Board's own deliberations and document access, not a processing obligation subject to Art. 83 In force since 25 May 2018 Explained by recitals None specifically. Recitals 135–138 explain the wider consistency mechanism and Board functioning; Article 76's own standard draws mainly on Regulation (EC) No 1049/2001 rather than a dedicated GDPR recital Depends on Art. 72 for the rules of procedure that Art. 76(1) points to Implemented by The Board's own Rules of Procedure (confidentiality of discussions) and Regulation (EC) No 1049/2001 (document access) Closest UK equivalent Omitted from the UK GDPR. The Board, and the EU access-to-documents regime Art. 76(2) points to, operate within the EU/EEA only; the ICO sits outside both since Brexit What Confidentiality Actually Covers Article 76(1) only reaches the Board's "discussions" — the deliberation itself, not what comes out of it. The Board still publishes its adopted opinions, guidelines and binding decisions in full under its Article 70 and Article 71 obligations. What Article 76(1) allows to stay confidential is the back-and-forth that precedes a final position: draft text, internal comments, and the positions individual members took before the Board settled on one voice — and even that is confidential only "where the Board deems it necessary," under criteria set out in its own rules of procedure, not as an automatic default. Article 76(2) covers a separate question — access to documents, as opposed to discussions — and answers it by pointing entirely outside the GDPR: to Regulation (EC) No 1049/2001, the general EU law on public access to European Parliament, Council and Commission documents, which by extension applies to bodies like the Board. This matters in practice: it means a request for EDPB documents is a transparency-law request, not a data-protection request, and is decided under transparency law's own exceptions, not a bespoke GDPR standard. Confidentiality vs. the Right of Public Access Regulation 1049/2001 starts from a presumption in the opposite direction to what Article 76 might suggest: the widest possible public access to EU institutions' documents, restricted only by a limited, exhaustively listed set of exceptions in its Article 4. The EDPB, like any EU body the Regulation applies to, can refuse access only by showing one of those exceptions genuinely applies, not by pointing to its own rules of procedure as if they created an additional, data-protection-specific ground for secrecy. Exception invoked What it requires to succeed Protection of the decision-making process A specific and actual risk to the Board's ability to deliberate freely — general or vague concerns about "external pressure" are not enough on their own Protection of personal data Genuine personal data within the specific document, such as the identity of an individual commenter, not a basis for withholding the substantive content around it Protection of international relations A concrete explanation of how disclosure would harm the EU's relations with a specific third country or process, not simply that the underlying document touches an international topic The case below is where a European institution tested exactly this: whether the Board's own rules of procedure could function as a fourth, GDPR-specific exception layered on top of Regulation 1049/2001's list. The answer was no. Article 76 in Practice: The Ombudsman Case Article 76 has never featured in a fine against a company — it can't, since it regulates the Board's own procedure rather than anyone the Board regulates. The one substantial dispute it has produced to date is between a member of the public and the Board itself, decided not by a court but by the European Ombudsman. Case Body Outcome EDPB document access refusal European Ombudsman, Case 201/2022/JK Maladministration found (Oct 2023); EDPB agreed to disclose the great majority of the withheld draft documents Recitals That Touch on Article 76 Article 76 has no recital dedicated to it. The closest context comes from the recitals explaining Chapter VII's cooperation and consistency framework generally, already covered in full on the Article 63 page. Recital 135 – Consistency MechanismExplains why supervisory authorities and the Board need to cooperate at all, the same institutional framework whose internal deliberations Article 76 lets stay confidential. Recital 139 – Composition of the BoardDescribes the Board as composed of the head of one supervisory authority per Member State plus the European Data Protection Supervisor, the body whose internal discussions Article 76(1) addresses. Checklist: Requesting or Submitting Board Documents If requesting EDPB documents, frame the request under Regulation (EC) No 1049/2001 directly, since that, not the GDPR, is the operative law under Art. 76(2) Expect final guidelines, opinions and binding decisions to be public in full; only the preparatory deliberation behind them can be withheld, and only where genuinely necessary If access is refused, ask the EDPB to identify which specific Regulation 1049/2001 exception applies and what concrete risk disclosure would create — a general reference to confidential Board discussions is not, on its own, sufficient Use the confirmatory-application stage to challenge an initial refusal before escalating further If a confirmatory refusal still seems unjustified, a complaint to the European Ombudsman is a faster, free route than EU court litigation, and has already produced a recommendation the EDPB accepted in a similar case If submitting comments or materials to a Board consultation, don't assume they're permanently shielded from disclosure — the Board's own rules of procedure, not an individual expectation, decide that Article 76 is a reminder that "confidential" and "GDPR-protected" aren't the same category, even inside the Regulation's own institutions. When you're mapping which of your own documents and communications actually need special handling under GDPR — versus which fall under ordinary business confidentiality — a platform that tracks that distinction per record, rather than by blanket policy, is what keeps the two from getting conflated. Learn more about Secure Privacy Related Recitals (58) The Principle of Transparency (63) Right of Access (74) Responsibility and Liability of the Controller (83) Security of Processing Frequently Asked Questions about Article 76 +Does Article 76 let the EDPB keep everything confidential? No. It only lets the Board's discussions be confidential, and only where the Board decides that's necessary under its own rules of procedure — it is not a blanket secrecy rule, and it doesn't cover the Board's final, published outputs. +Can a company be fined for breaching Article 76? No. Article 76 regulates the Board's own internal procedure and document access, not the processing activities of controllers or processors, so it isn't a provision a company could infringe under Article 83. + What law actually governs access to EDPB documents? Regulation (EC) No 1049/2001, the EU's general law on public access to institutional documents, which Article 76(2) expressly points to, rather than any GDPR-specific access regime. +Has the EDPB's use of confidentiality ever been legally challenged? Yes. In European Ombudsman Case 201/2022/JK, decided in October 2023, the Ombudsman found the EDPB had applied Regulation 1049/2001's exceptions, and its own confidentiality rules, too broadly when refusing access to draft preparatory documents, and recommended it grant much wider access, a recommendation the EDPB accepted. +Are the EDPB's final guidelines and decisions confidential? No. Article 76 only reaches the deliberative process that precedes a final position. Adopted guidelines, opinions and binding decisions are published in full under the Board's Article 70 and Article 71 obligations. +What's the difference between Article 76 and the Board's Rules of Procedure? Article 76 is the one-sentence authorisation; the Rules of Procedure, adopted by the Board itself under Article 72, supply the actual detail of when discussions are treated as confidential. The Ombudsman confirmed those internal rules cannot override Regulation 1049/2001 where the two would conflict. Related Key Issues GDPR Privacy Impact Assessment GDPR Records of Processing Activities

In this page Key Facts Where You Can Complain, and Who Actually Handles It Petition or Decision? What the Authority Owes You Article 77 in Practice: The CJEU Cases Recitals That Explain Article 77 Checklist: Complainants and the Controllers They Complain About Frequently Asked Questions about Article 77 Related Articles Art. 77(1) Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. data subject right Art. 77(2) The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78. authority obligation In short Article 77 lets any data subject who thinks their personal data is processed unlawfully complain to a supervisory authority, in particular in the Member State where they live, work or where the alleged infringement took place. Handling the complaint is free of charge for the data subject (Art. 57(3)). The authority must inform the complainant of the progress and outcome, including the possibility of going to court. In the SCHUFA case, Hesse's data protection authority argued that a complaint is only a petition, so courts could check only whether it was handled. In December 2023 the Court of Justice rejected that: a decision on a complaint is subject to full judicial review. In September 2024, in Land Hessen (C-768/21), the Court drew the other boundary: the authority must react appropriately to a breach it finds, but it isn't obliged to impose a fine every time. Key Facts Chapter Chapter VIII – Remedies, liability and penalties (Art. 77–84) Applies to Every data subject (the right) and every supervisory authority that receives a complaint (the duty to inform). Article 77 imposes no obligation on controllers or processors Maximum fine Not applicable. Article 77 creates a right, not a processing obligation. Any fine following a complaint is set under Art. 83 for the provision actually infringed In force since 25 May 2018 Explained by recitals Recital 141, with Recitals 142 and 143 Depends on Art. 57(1)(f) (duty to handle and investigate complaints), Art. 78 (court action against the authority), Art. 60(7)–(9) (cross-border decisions) and Art. 80 (complaints by representative bodies) Implemented by Directly applicable. For cross-border complaints lodged after 2 April 2027, Regulation (EU) 2025/2518 adds harmonised admissibility criteria, rights to be heard and investigation deadlines Closest UK equivalent Complaints go to the ICO. Since 19 June 2026, section 103 of the Data (Use and Access) Act 2025 (new s. 164A DPA 2018) also gives individuals a right to complain to the controller, which must acknowledge within 30 days and report the outcome without undue delay Where You Can Complain, and Who Actually Handles It Article 77(1) names three places: the Member State of habitual residence, of place of work, or of the alleged infringement. The words "in particular" mean the list is not closed. If the company processes data across borders, the investigation is led by the lead supervisory authority where it has its main EU establishment (Art. 56). The authority that received the complaint still deals with the complainant: Situation Who adopts / notifies Source Decision against the controller Lead authority adopts it; the authority that received the complaint informs the complainant Art. 60(7) Complaint dismissed or rejected The authority that received the complaint adopts the decision and notifies the complainant Art. 60(8) Partly acted on, partly rejected Separate decisions: lead authority for the action, complainant's authority for the rejection Art. 60(9) A body, organisation or association can also lodge a complaint under Article 80 (Art. 57(1)(f)). Petition or Decision? What the Authority Owes You Article 77(2) only requires the authority to inform the complainant of progress and outcome, including the possibility of a judicial remedy. Other provisions and case law add to that: Stage What the authority must do Where it comes from Receipt Handle the complaint with all due diligence and investigate it to the extent appropriate Art. 57(1)(f), Schrems II (C-311/18) During the investigation Inform the complainant of progress. If the competent authority doesn't handle the complaint or inform within three months, the complainant can go to court Art. 77(2), Art. 78(2) Outcome Inform the complainant of the outcome, including the possibility of a judicial remedy Art. 77(2) Court review The decision is legally binding and subject to full judicial review Art. 78(1), SCHUFA (C-26/22) Remedy React appropriately to a breach found; discretion over the measure; no obligation to fine where not needed to remedy the breach Art. 58(2), Land Hessen (C-768/21) Article 77 in Practice: The CJEU Cases Both cases were complaints to Hesse's data protection authority (HBDI), referred to the CJEU by the Administrative Court of Wiesbaden. Case Body Outcome SCHUFA: complaint rejected over credit data retention CJEU, Joined Cases C-26/22 and C-64/22 Complaint decisions subject to full judicial review; keeping debt-discharge data longer than the public register (six months) precluded (7 Dec 2023) Land Hessen: savings bank employee access breach CJEU, Case C-768/21 Authority not obliged to use a corrective power, such as a fine, in every case of breach; it may refrain where the controller already took the necessary measures (26 Sep 2024) Recitals That Explain Article 77 Recital 141 – Right to lodge a complaintComplaint to a single supervisory authority; investigation to the extent appropriate, subject to judicial review; updates within a reasonable period; a complaint form that can also be completed electronically. Recital 142 – The right of data subjects to mandate a not-for-profit body, organisation or associationThe data subject's right to have a not-for-profit body act on their behalf. Recital 143 – Judicial remediesDismissal or rejection of a complaint is a decision with legal effects; courts should have full jurisdiction over facts and law. The CJEU relied on it in SCHUFA. Checklist: Complainants and the Controllers They Complain About Complainant: file where it's practical, in particular your country of residence, work or the alleged infringement (Art. 77(1)) Complainant: no update within three months? You can go to court against the authority (Art. 78(2)) Complainant: a rejection is a binding decision you can challenge in court, with full review of facts and law (SCHUFA) Controller: fix a confirmed breach promptly and document it; in Land Hessen this was why no corrective measure was required Controller: don't rely on an approved code of conduct to justify retention; a code can't change the Art. 6(1)(f) balancing (SCHUFA) Controller with UK users: run a complaints process under s. 164A DPA 2018 (in force 19 June 2026) When a complaint reaches an authority, the controller will be asked what the person consented to, when, and what happened to their request. Keeping that record per person makes the answer quick to give. Learn more about Secure Privacy Related Recitals (141) Right to Lodge a Complaint Frequently Asked Questions about Article 77 +Does it cost anything to lodge a GDPR complaint? No. Under Article 57(3) it is free for the data subject. Under Article 57(4) the authority may charge a reasonable fee or refuse to act only where a request is manifestly unfounded or excessive, and it must prove that. +Can I complain in my own country about a company based in another EU country? Yes. Article 77(1) lets you complain in your Member State of residence. In cross-border cases the lead authority adopts decisions against the company, and your authority informs you of them; if your complaint is rejected, your authority adopts that decision (Art. 60(7)–(8)). + Can a company be fined for breaching Article 77? No. Article 77 imposes no obligation on controllers or processors. A complaint can lead to a fine under Article 83 for the provision actually infringed. + Can I force the authority to fine the company I complained about? No. In Land Hessen (C-768/21) the CJEU held the authority isn't obliged to use a corrective power, in particular a fine, where that isn't necessary to remedy the breach. In SCHUFA it held a court checks whether the authority stayed within its discretion, but doesn't substitute its own choice of measure. + Do I have to complain to an authority before going to court? No. Article 77 applies without prejudice to other remedies. You can sue the controller under Article 79; the CJEU held in C-132/21 that both routes can be used concurrently and independently. +What changes when the GDPR Procedural Regulation applies? For cross-border complaints lodged after 2 April 2027, Regulation (EU) 2025/2518 harmonises admissibility criteria, gives complainants and investigated companies the right to be heard, and sets deadlines (15 months for regular investigations, 12 for simplified ones). It doesn't change the GDPR's substantive rights. Related Key Issues GDPR Encryption GDPR Third Countries

Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court. Related Recitals (141) Right to Lodge a Complaint (143) Judicial Remedies Frequently Asked Questions about Article 78 +Can I take a supervisory authority to court under the GDPR? Yes. Article 78 gives individuals and organisations the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. +What if a supervisory authority does not handle my complaint? If an authority fails to handle a complaint or does not inform you of progress within three months, you have the right to a judicial remedy. + Which court hears actions against a supervisory authority? Proceedings are brought before the courts of the member state where the supervisory authority is established. Related Key Issues GDPR Third Countries GDPR Right to be Informed

Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation. 1Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. 2Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers. Related Recitals (141) Right to Lodge a Complaint (145) Choice of Venue Frequently Asked Questions about Article 79 +Can I sue a company for a GDPR breach? Yes. Article 79 gives individuals the right to an effective judicial remedy against a controller or processor where they consider their GDPR rights have been infringed. +Where can I bring a GDPR claim against a company? Proceedings can be brought in the courts where the controller or processor has an establishment, or where the individual resides, unless the defendant is a public authority acting in its powers. + Is a court remedy separate from a complaint to the authority? Yes. The judicial remedy is in addition to the right to lodge a complaint with a supervisory authority and other administrative remedies. Related Key Issues GDPR Privacy by Design GDPR Records of Processing Activities

The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject’s mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing. Related Recitals (142) The Right of Data Subjects to Mandate a Not-For-Profit Body, Organisation or Association Frequently Asked Questions about Article 80 +Can a body represent me in a GDPR complaint? Yes. Article 80 lets individuals mandate a not-for-profit body active in data protection to lodge complaints and exercise certain rights on their behalf. +Are class actions allowed under the GDPR? Member states may allow qualified bodies to bring representative actions, and in some cases without a specific mandate from individuals, depending on national law. + What kind of organisation can represent data subjects? It must be a properly constituted not-for-profit body with statutory objectives in the public interest and active in the protection of personal data rights. Related Key Issues GDPR Right of Access GDPR Right to be Forgotten

Where a competent court of a Member State has information on proceedings, concerning the same subject matter as regards processing by the same controller or processor, that are pending in a court in another Member State, it shall contact that court in the other Member State to confirm the existence of such proceedings. Where proceedings concerning the same subject matter as regards processing of the same controller or processor are pending in a court in another Member State, any competent court other than the court first seized may suspend its proceedings. Where those proceedings are pending at first instance, any court other than the court first seized may also, on the application of one of the parties, decline jurisdiction if the court first seized has jurisdiction over the actions in question and its law permits the consolidation thereof. Related Recitals (144) Related Proceedings Frequently Asked Questions about Article 81 +What is suspension of proceedings under the GDPR? Article 81 allows a court to suspend its proceedings where parallel proceedings on the same processing are pending in a court of another member state. +Why does the GDPR allow suspension of proceedings? It avoids contradictory judgments and duplicate litigation when the same subject matter involving the same controller or processor is being heard elsewhere in the EU. + Can courts coordinate related GDPR cases? Yes. Where related actions are pending at first instance, a competent court may also decline jurisdiction to allow consolidation, subject to the rules involved. Related Key Issues GDPR Third Countries GDPR Right to be Forgotten

Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. 1Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. 2A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller. A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage. Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject. Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2. Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2). Related Recitals (146) Indemnity (147) Jurisdiction Frequently Asked Questions about Article 82 +Can I claim compensation for a GDPR breach? Yes. Article 82 gives anyone who suffers material or non-material damage from a GDPR infringement the right to receive compensation from the controller or processor. +Does GDPR compensation cover emotional distress? Yes. Compensation covers non-material damage, which can include distress, as well as material financial loss resulting from the infringement. + Who is liable to pay GDPR compensation? The controller is liable for damage caused by non-compliant processing, and a processor is liable where it breaches obligations specific to processors or acts outside instructions. Related Key Issues GDPR Encryption GDPR Email Marketing

In this page Key Facts The Two Fine Tiers The Eleven Factors Under Article 83(2) How Fines Are Actually Calculated: The EDPB's Five-Step Methodology The Largest GDPR Fines to Date How the Conditions for Fines Have Been Tested Recitals That Explain Article 83 Article 83 Compliance Checklist Related Recitals Article 83 Enforcement Cases Frequently Asked Questions about Article 83 Related Key Issues Related Articles Art. 83(1) Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive. proportionality principle Art. 83(2) Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on its amount, due regard shall be given to: the nature, gravity and duration of the infringement, taking into account the nature, scope or purpose of the processing and the number of data subjects affected and the level of damage they suffered; the intentional or negligent character of the infringement; any action taken by the controller or processor to mitigate the damage suffered by data subjects; the degree of responsibility of the controller or processor, taking into account technical and organisational measures implemented under Articles 25 and 32; any relevant previous infringements by the controller or processor; the degree of cooperation with the supervisory authority to remedy the infringement and mitigate its adverse effects; the categories of personal data affected; the manner in which the infringement became known to the supervisory authority, including whether the controller or processor notified it; compliance with previous measures ordered under Article 58(2) against the same controller or processor on the same subject-matter; adherence to approved codes of conduct under Article 40 or approved certification mechanisms under Article 42; and any other aggravating or mitigating factor, such as financial benefits gained or losses avoided, directly or indirectly, from the infringement. eleven factors Art. 83(3) If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total fine shall not exceed the amount specified for the gravest infringement. single gravest infringement Art. 83(4) Infringements of the following shall be subject to fines of up to €10.000.000, or up to 2% of total worldwide annual turnover of the preceding financial year for an undertaking, whichever is higher: the obligations of the controller and processor under Articles 8, 11, 25 to 39, 42 and 43; the obligations of the certification body under Articles 42 and 43; the obligations of the monitoring body under Article 41(4). lower tier ceiling Art. 83(5) Infringements of the following shall be subject to fines of up to €20.000.000, or up to 4% of total worldwide annual turnover of the preceding financial year for an undertaking, whichever is higher: the basic principles for processing, including the conditions for consent, under Articles 5, 6, 7 and 9; the data subjects' rights under Articles 12 to 22; the transfer of personal data to a recipient in a third country or an international organisation under Articles 44 to 49; any obligations under Member State law adopted under Chapter IX; non-compliance with a supervisory authority order or limitation under Article 58(2), or failure to provide access in violation of Article 58(1). higher tier ceiling Art. 83(6) Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to fines of up to €20.000.000, or up to 4% of total worldwide annual turnover, whichever is higher. non-compliance ceiling Art. 83(7) Without prejudice to the corrective powers of supervisory authorities under Article 58(2), each Member State may lay down rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State. public authority carve-out Art. 83(8) The exercise by a supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards under Union and Member State law, including effective judicial remedy and due process. procedural safeguards Art. 83(9) Where the legal system of the Member State does not provide for administrative fines, this Article may be applied so that the fine is initiated by the competent supervisory authority and imposed by competent national courts, provided those remedies are effective and equivalent to administrative fines. In any event, the fines imposed shall be effective, proportionate and dissuasive. Those Member States notified the Commission of the relevant provisions of their laws by 25 May 2018 and must notify any subsequent amendment without delay. non-administrative-fine states In short Article 83 is not an obligation to comply with. It is the rulebook a supervisory authority must follow once an infringement of another article is already established, deciding whether to fine a controller or processor and how much. It sets two fine ceilings depending on which provisions were breached, lists eleven factors authorities must weigh in every case, and requires every fine to be effective, proportionate and dissuasive. Two CJEU rulings since 2023, Deutsche Wohnen and ILVA, have clarified how far it reaches: a company can be fined without a named, culpable employee being identified, and the fine ceiling is set by the turnover of the whole corporate group the controller belongs to, not just the entity under investigation. Key Facts Chapter Chapter 8 – Remedies, liability and penalties (Art. 77–84) Applies to Every supervisory authority deciding whether, and how much, to fine a controller or processor for an infringement established under another GDPR article Maximum fine Article 83 sets the ceiling itself: up to €20.000.000 or 4% of worldwide annual turnover, whichever is higher, for the most serious categories (Art. 83(5)–(6)) In force since 25 May 2018 Explained by recitals 148, 149, 150, 151, 152 Closest UK equivalent UK GDPR Art. 83, near-identical wording, ceiling expressed in GBP: up to £17.5 million or 4% of global turnover The Two Fine Tiers Which tier applies depends on which underlying article was infringed, not on the size of the company or the number of people affected. Tier Ceiling Covers infringements of Lower tier €10.000.000 or 2% of global turnover Child's-consent verification (Art. 8), processing not requiring identification (Art. 11), Art. 25–39 controller/processor obligations, certification (Art. 42–43) Higher tier €20.000.000 or 4% of global turnover Core principles and lawful-basis conditions (Art. 5, 6, 7, 9), data subject rights (Art. 12–22), international transfer rules (Art. 44–49), non-compliance with a supervisory authority order (Art. 58(2)) The Eleven Factors Under Article 83(2) Before setting a fine, an authority must weigh each of the following, in addition to the two-tier ceiling above. Nature, gravity and duration of the infringement Intentional or negligent character of the infringement Mitigating action taken by the controller or processor Degree of responsibility, given the technical and organisational measures in place Any relevant previous infringements Degree of cooperation with the supervisory authority Categories of personal data affected How the infringement came to the authority's attention Compliance with any earlier order on the same matter Adherence to approved codes of conduct or certifications Any other aggravating or mitigating circumstance, including financial benefit gained or loss avoided Art. 83(3) in plain language If one course of conduct breaks several GDPR provisions at once, the authority doesn't add the fines together. It works out what each infringement would draw on its own, then imposes the amount for the single worst one. The cap in Recital 148's phrase "total amount of the fine" is the number for the gravest violation, not a sum of all of them. The EDPB's guidance below narrows this further: it only applies where the infringements concern the "same or linked processing operations" — an authority can still fine separately for genuinely distinct conduct within the same investigation. How Fines Are Actually Calculated: The EDPB's Five-Step Methodology Article 83 sets the ceilings and the factors; it doesn't say how to turn those factors into a number. The EDPB's Guidelines 04/2022 on the calculation of administrative fines (finalised 24 May 2023) fill that gap with a common five-step method every EU supervisory authority is expected to apply. Identify the processing operations at issue and decide whether Art. 83(3)'s single-gravest-infringement rule applies Find the starting point: classify the infringement into the lower or higher tier, assess its seriousness on the facts, and establish the undertaking's turnover Adjust for aggravating or mitigating circumstances tied to the controller's past or present conduct Check the adjusted figure against the legal maximum for that tier Confirm the final amount is effective, proportionate and dissuasive, adjusting once more if it is not The EDPB is explicit that this is not an arithmetic formula a controller can run in reverse to predict its own exposure; the amount stays at each authority's discretion within this shared structure. The Largest GDPR Fines to Date All of the fines below were calculated within the ceilings Article 83 sets. Figures reflect the original decision; some remain under appeal. Organisation Authority Date Fine Grounds Meta Platforms Ireland Irish DPC 22 May 2023 €1.200.000.000 Unlawful transfers of EU user data to the US (Art. 44) Amazon Europe Core Luxembourg CNPD Jul 2021 €746.000.000 Ad targeting without valid consent. Annulled on procedural grounds by the Luxembourg Administrative Court of Appeal in March 2026 and remanded; the underlying violations were not overturned TikTok (ByteDance) Irish DPC 2 May 2025 €530.000.000 Unlawful transfers of EU user data to China (Art. 44) Google LLC CNIL (France) Sep 2025 €325.000.000 Cookie-consent and advertising-related breaches; Google's third and largest CNIL fine after €100M (2020) and €150M (2021) Meta Platforms Ireland (Facebook) Irish DPC 2022 €265.000.000 Insufficient technical measures allowing a large-scale data scraping incident Shein (Infinite Styles Services) CNIL (France) Sep 2025 €150.000.000 Cookie-consent and advertising-related breaches Ireland has issued the largest cumulative total of any supervisory authority to date; Spain has issued the highest number of individual fines. Figures compiled from public regulatory decisions and the CMS GDPR Enforcement Tracker as of September 2026. GDPR Article 83 Cases: How the Conditions for Fines Have Been Tested Article 83 does not get "infringed" the way a substantive obligation does. It is the mechanism authorities use once an infringement is already established elsewhere. The two cases below are not about a company breaking Article 83. They are the CJEU rulings that fixed how far Article 83's fining conditions actually reach. Organisation Court / Authority Date What Article 83 clarified Deutsche Wohnen SE CJEU (referred by Kammergericht Berlin) 5 Dec 2023 A company can be fined without identifying a culpable named employee; fault, intent or negligence, is still required ILVA A/S CJEU (referred by Vestre Landsret, Denmark) 13 Feb 2025 The fine ceiling is calculated on the turnover of the whole corporate "undertaking," not just the fined subsidiary All Article 83 conditions-for-fines cases → Recitals That Explain Article 83 Recital 148 – PenaltiesConfirms Member States may impose criminal penalties for GDPR infringements in addition to, or instead of, administrative fines. Recital 149 – Penalties for Infringements of National RulesAllows Member States to set rules on further penalties for breaches of national provisions adopted under the GDPR. Recital 150 – Administrative FinesSets out the two-tier fine structure and the case-by-case factors authorities must weigh, mirroring Article 83(2). Recital 151 – Administrative Fines in Denmark and EstoniaRecognises that Denmark and Estonia's legal systems do not provide for administrative fines, so equivalent sanctions run through their national courts instead. Recital 152 – Power of Sanction of the Member StatesLeaves Member States free to set their own sanctioning rules for infringements not covered by Article 83's administrative fines. Article 83 Compliance Checklist Document and be ready to justify each of the eleven Art. 83(2) factors before an investigation starts, not only after one begins Track whether your organisation forms part of a wider corporate group. The fine ceiling is calculated on group-wide turnover, not just the entity under investigation Do not assume a compliance failure needs a named, culpable employee before it can result in a corporate fine. It does not Keep records that demonstrate cooperation with supervisory authorities, since cooperation is itself a mitigating factor Where a Member State has no administrative-fines regime, such as Denmark or Estonia, expect the equivalent sanction to be pursued through the criminal courts instead Several of the eleven Art. 83(2) factors turn on records an organisation either kept or didn't: cooperation, mitigating action, prior infringements, certification adherence. Having that evidence ready before it's ever asked for is the difference between a quick answer and a scramble. Secure Privacy's platform is one way to keep that trail. Learn more about Secure Privacy Related Recitals (148) Penalties (149) Penalties for Infringements of National Rules (150) Administrative Fines (151) Administrative Fines in Denmark and Estonia (152) Power of Sanction of the Member States Article 83 Enforcement Cases Deutsche Wohnen's €14.5M Fine ILVA's DKK 100.000 Fine All Article 83 cases Frequently Asked Questions about Article 83 + What are the maximum GDPR fines? Article 83 sets two tiers: up to €10.000.000 or 2% of global annual turnover for some breaches, and up to €20.000.000 or 4% for more serious infringements, whichever is higher. + How are GDPR fines calculated? Fines must be effective, proportionate and dissuasive. Authorities weigh factors such as the nature and gravity of the breach, intent, mitigation, and cooperation with the authority. +What is the difference between the two GDPR fine tiers? The lower tier applies to obligations like records and security. The higher tier applies to breaches of core principles, individual rights and international transfer rules. +Does a company need a named, at-fault employee to be fined under Article 83? No. The CJEU's 2023 Deutsche Wohnen ruling confirmed that a controller can be fined directly once it has acted intentionally or negligently as an organisation. Authorities do not need to pin the breach on a specific identified individual first. +If my company is part of a larger group, whose turnover sets the fine ceiling? The group's. Where the fined entity is or forms part of an "undertaking" in the competition-law sense, the CJEU's 2023 Deutsche Wohnen and 2025 ILVA rulings confirm the maximum fine is calculated on the total worldwide turnover of the whole undertaking, not just the fined subsidiary. Related Key Issues GDPR Fines / Penalties GDPR Privacy by Design

1Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. 2Such penalties shall be effective, proportionate and dissuasive. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. Related Recitals (149) Penalties for Infringements of National Rules (150) Administrative Fines (151) Administrative Fines in Denmark and Estonia (152) Power of Sanction of the Member States Frequently Asked Questions about Article 84 +What penalties exist beyond GDPR fines? Article 84 requires member states to set additional penalties for infringements not covered by administrative fines, ensuring they are effective, proportionate, and dissuasive. +Can GDPR breaches lead to criminal penalties? Member states may provide for criminal or other penalties under national law for certain infringements, in addition to the administrative fines in the GDPR. + Do penalties vary between EU countries? Yes. Because Article 84 leaves additional penalties to national law, the specific sanctions can differ from one member state to another. Related Key Issues GDPR Right of Access GDPR Privacy Impact Assessment

Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression. For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information. Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them. Related Recitals (153) Processing of Personal Data Solely for Journalistic Purposes or for the Purposes of Academic, Artistic or Literary Expression Frequently Asked Questions about Article 85 +How does the GDPR balance privacy and freedom of expression? Article 85 requires member states to reconcile the right to data protection with freedom of expression and information, including processing for journalistic, academic, artistic, or literary purposes. +Are journalists exempt from the GDPR? Not entirely. Member states must provide exemptions or derogations for journalistic purposes where needed to balance data protection with freedom of expression. + Does the GDPR apply to news reporting? Yes, but with derogations. National laws adjust how the GDPR applies to journalism to protect press freedom while still safeguarding personal data. Related Key Issues GDPR Consent GDPR Encryption

In this page Key Facts What Article 86 Allows, and What It Doesn't The Test the Court Applies Before Disclosure Article 86 in Practice: The CJEU Cases Recitals That Explain Article 86 Checklist: Public Bodies and Requesters Frequently Asked Questions about Article 86 Related Articles Art. 86 Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member State law to which the public authority or body is subject in order to reconcile public access to official documents with the right to the protection of personal data pursuant to this Regulation. disclosure under access law In short Article 86 lets a public authority, a public body, or a private body carrying out a task in the public interest disclose personal data contained in official documents it holds, as long as it does so under the EU or national access law it is subject to. Recital 154 adds that public access to official documents may be considered to be in the public interest, and that the access law should do the balancing with data protection. The Court of Justice has twice held that this balancing has limits. In Latvijas Republikas Saeima (C-439/19) in June 2021, it ruled that the GDPR precludes making drivers' penalty points available to anyone who asks. In the Endemol Shine Finland case in March 2024, it applied the same reasoning to criminal-conviction data held by a court, even when the answer is given orally: the requester has to establish a specific interest. Key Facts Chapter Chapter IX – Provisions relating to specific processing situations (Art. 85–91) Applies to Public authorities, public bodies, and private bodies that hold official documents for the performance of a task carried out in the public interest. Under Recital 154, this includes all authorities or other bodies covered by Member State law on public access to documents Maximum fine Article 86 sets no obligation of its own. Breaching obligations under Member State law adopted under Chapter IX falls under Art. 83(5)(d): up to €20.000.000 or 4% of total worldwide annual turnover, whichever is higher. A disclosure that breaches Art. 5 or 6 falls under Art. 83(5)(a), with the same ceiling In force since 25 May 2018 Explained by recitals Recital 154 Depends on Art. 6(1)(e) and 6(3) (public-interest task laid down by law), Art. 10 (criminal convictions and offences) and Art. 85 (freedom of expression and information) Implemented by National access-to-documents laws. In Finland, for example, the Act on the Openness of Government Activities (621/1999) and section 28 of the Data Protection Act (1050/2018), both examined in Endemol Shine Finland EU institutions Not covered. Their processing falls under Regulation (EU) 2018/1725 rather than the GDPR (Art. 2(3)), and access to their documents under Regulation (EC) No 1049/2001 Closest UK equivalent Freedom of Information Act 2000, section 40 (personal information) What Article 86 Allows, and What It Doesn't Article 86 doesn't authorise any disclosure by itself. It points to the access law the body is subject to, and that law has to meet the GDPR's own requirements. The CJEU has answered the practical questions in two judgments: Question Answer Source Which legal basis covers disclosure to the public? It may fall under Art. 6(1)(e): processing necessary for a task carried out in the public interest C-439/19, para. 99; C-740/22, para. 46 Is public access a public interest? Yes, capable of justifying disclosure, but it must be reconciled with the rights to private life and data protection (Charter, Art. 7 and 8), as Art. 86 expressly requires C-439/19, para. 120; C-740/22, para. 55 Does the GDPR ban disclosure to people who ask? No. There is no general and absolute prohibition on a public authority disclosing personal data on request C-439/19, para. 103; C-740/22, para. 48 What about criminal-offence data? Art. 10 applies. The law authorising disclosure must provide appropriate safeguards, and data subjects' rights prevail over the public's interest in access. Disclosure to any person without a specific interest is precluded C-740/22, paras. 49, 55, 58 Does it matter if the answer is given orally? No. Oral disclosure of data from a filing system is processing, and the result is the same whether disclosure is oral or written C-740/22, paras. 32, 39, 57 Does it matter who is asking? No. It is irrelevant whether the requester is a commercial company or a private individual C-740/22, para. 57 Can the register be passed to commercial re-users? Not for penalty-point data: the GDPR precludes disclosure to economic operators for re-use. EU re-use rules leave GDPR protection intact C-439/19, paras. 128–129; Recital 154 The Test the Court Applies Before Disclosure In both cases, the Court checked whether disclosure was necessary for the public-interest task and whether the law provided appropriate safeguards, having regard to how serious the interference is (C-439/19, para. 106; C-740/22, para. 53). Limits on the rights to private life and data protection have to meet the conditions of Article 52(1) of the Charter: Condition What the Court looks for Source Provided for by law The law must lay down clear and precise rules on the scope and application of the measure C-439/19, para. 105 Respects the essence of the rights The limitation can't empty the rights of their content C-439/19, para. 105 Strictly necessary Not met where the objective can reasonably be achieved just as effectively by less restrictive means C-439/19, para. 110; Recital 39 Proportionate to the seriousness Data about offences can stigmatise the data subject, which makes disclosure a particularly serious interference C-439/19, paras. 74–75; C-740/22, para. 54 Article 86 in Practice: The CJEU Cases Both judgments involved national rules that made offence-related data available on request, and both reached the same conclusion on Article 86. Case Body Outcome Latvijas Republikas Saeima: public access to drivers' penalty points CJEU (Grand Chamber), Case C-439/19 Penalty-point data are covered by Art. 10. Latvian law giving anyone access without a specific interest, and passing data to re-users, was precluded; the right of access didn't change that (22 Jun 2021) Endemol Shine Finland: oral request for a contestant's criminal record CJEU (Sixth Chamber), Case C-740/22 Oral disclosure from a court's register is processing under the GDPR; conviction data can't be disclosed to any person for public-access purposes unless they establish a specific interest (7 Mar 2024) Recitals That Explain Article 86 Recital 154 – Principle of public access to official documentsPublic access may be considered to be in the public interest; disclosure should be provided for by Union or Member State law, which should reconcile access and re-use with data protection; the re-use directive (2003/98/EC) leaves GDPR protection intact. The CJEU relied on it in both cases above. Recital 4 – Data protection is not an absolute rightThe right must be considered in relation to its function in society and balanced against other fundamental rights under the principle of proportionality. The Court cited it in Endemol Shine Finland (para. 52). Checklist: Public Bodies and Requesters Public body: identify the Union or national law that provides for the disclosure before releasing personal data from an official document (Art. 86, Recital 154) Public body: for data on criminal convictions or offences, require the requester to establish a specific interest (C-740/22) Public body: apply the same rules to phone and counter requests as to written ones; oral answers from a register are processing (C-740/22) Public body: don't pass offence-related register data to commercial re-users when the public itself couldn't obtain it without a specific interest (C-439/19) Requester, company or individual: state and document your specific interest; being a company neither helps nor hurts (C-740/22, para. 57) Legislator: check whether a less intrusive measure would achieve the objective just as effectively (C-439/19, paras. 110–113) When personal data leaves your organisation, someone will ask which legal basis and which safeguard covered it. Keeping each processing activity mapped to both makes that answer quick to give. Learn more about Secure Privacy Related Recitals (154) Principle of Public Access to Official Documents Frequently Asked Questions about Article 86 +Does Article 86 let national freedom-of-information laws override the GDPR? No. Disclosure happens under the national access law, but that law must reconcile access with data protection, and the GDPR still applies in full. The CJEU held that a national court must apply the GDPR's requirements even where national law has no specific provision on the data subject's interests (C-740/22, para. 43). +Can anyone ask a court about someone's criminal record? Not without establishing a specific interest. In Endemol Shine Finland the CJEU held that the GDPR precludes disclosing conviction data from a court's filing system to any person for public-access purposes without that, whether the requester is a company or an individual. +Does Article 86 apply to private companies? Only to private bodies that hold official documents for the performance of a task carried out in the public interest. A company asking for documents is a requester, not a body disclosing under Article 86. +Is answering over the phone outside the GDPR? No. The CJEU held that oral disclosure is processing, and that it falls within the GDPR where the information forms part of, or is intended to form part of, a filing system, such as a court's register of persons (C-740/22). +Can a public body license register data to commercial re-users? For penalty-point data, the CJEU held that the GDPR precludes it (C-439/19). More generally, Recital 154 states that the EU re-use directive leaves the GDPR's protection intact, so re-use has to pass the same test as disclosure. +Does Article 86 cover documents held by EU institutions? No. Under Article 2(3), processing by EU institutions, bodies, offices and agencies is governed by a separate regulation, now Regulation (EU) 2018/1725. Access to their documents is governed by Regulation (EC) No 1049/2001. Related Key Issues GDPR Third Countries GDPR Data Protection Officer

1Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general application. 2In that case the national identification number or any other identifier of general application shall be used only under appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. Related Recitals (41) Legal Basis or Legislative Measures (51) Protecting Sensitive Personal Data (75) Risks to the Rights and Freedoms of Natural Persons (78) Appropriate Technical and Organisational Measures Frequently Asked Questions about Article 87 +Does the GDPR regulate national ID numbers? Article 87 lets member states set specific conditions for processing national identification numbers, which may only be used with appropriate safeguards for individuals' rights. +Can companies use national identification numbers freely? No. The use of national ID numbers is subject to national rules and safeguards, so organisations must check the specific conditions in each member state. + Why are national ID numbers treated specially? Because they can uniquely identify individuals across many systems, they carry higher risks and warrant additional safeguards under national law. Related Key Issues GDPR Third Countries GDPR Right to be Informed

Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees’ personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer’s or customer’s property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. Those rules shall include suitable and specific measures to safeguard the data subject’s human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. Related Recitals (155) Processing in the Employment Context Frequently Asked Questions about Article 88 +Does the GDPR apply to employee data? Yes. Article 88 allows member states to set more specific rules for processing employee data in the employment context, with safeguards for workers' dignity and interests. +Can employers monitor employees under the GDPR? Monitoring is subject to national employment rules and GDPR safeguards, requiring transparency, necessity, and proportionality to protect employees' rights. + What safeguards apply to workplace data processing? National rules must include measures to protect human dignity, legitimate interests, and fundamental rights, particularly for transparency, monitoring, and data transfers within groups. Related Key Issues GDPR Processing GDPR Right of Access

1Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. 2Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. 3Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. 4Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs. Related Recitals (156) Processing for Archiving, Scientific or Historical Research or Statistical Purposes (157) Information from Registries and Scientific Research (158) Processing for Archiving Purposes (159) Processing for Scientific Research Purposes (160) Processing for Historical Research Purposes (161) Consenting to the Participation in Clinical Trials (162) Processing for Statistical Purposes (163) Production of European and National Statistics Frequently Asked Questions about Article 89 +What safeguards apply to research data under the GDPR? Article 89 requires appropriate safeguards, such as data minimisation and pseudonymisation, for processing for archiving, scientific or historical research, or statistical purposes. +Are there GDPR exemptions for scientific research? Yes. Member states may provide derogations from certain data subject rights where needed for research or statistical purposes, provided safeguards are in place. + What is pseudonymisation in research? Pseudonymisation replaces identifying details with pseudonyms so individuals cannot be identified without additional information, helping protect data used for research. Related Key Issues GDPR Privacy by Design GDPR Records of Processing Activities

1Member States may adopt specific rules to set out the powers of the supervisory authorities laid down in points (e) and (f) of Article 58(1) in relation to controllers or processors that are subject, under Union or Member State law or rules established by national competent bodies, to an obligation of professional secrecy or other equivalent obligations of secrecy where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy. 2Those rules shall apply only with regard to personal data which the controller or processor has received as a result of or has obtained in an activity covered by that obligation of secrecy. Each Member State shall notify to the Commission the rules adopted pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. Related Recitals (164) Professional or Other Equivalent Secrecy Obligations Frequently Asked Questions about Article 90 +What does Article 90 GDPR say about professional secrecy? Article 90 lets member states set rules governing the powers of supervisory authorities over controllers and processors who are subject to professional secrecy obligations. +How does the GDPR treat confidential professions? It allows specific national rules to reconcile data protection supervision with duties of secrecy in professions such as law, medicine, or other regulated fields. + Can authorities access data held under professional secrecy? Access may be limited by national rules that protect professional secrecy, balancing supervision with confidentiality obligations. Related Key Issues GDPR Encryption GDPR Email Marketing

Where in a Member State, churches and religious associations or communities apply, at the time of entry into force of this Regulation, comprehensive rules relating to the protection of natural persons with regard to processing, such rules may continue to apply, provided that they are brought into line with this Regulation. Churches and religious associations which apply comprehensive rules in accordance with paragraph 1 of this Article shall be subject to the supervision of an independent supervisory authority, which may be specific, provided that it fulfils the conditions laid down in Chapter VI of this Regulation. Related Recitals (165) No Prejudice of the Status of Churches and Religious Associations Frequently Asked Questions about Article 91 +Do churches have their own data protection rules under the GDPR? Article 91 allows churches and religious associations that applied comprehensive data protection rules before the GDPR to continue them, provided they are brought into line with the GDPR. +Are religious organisations exempt from the GDPR? No. They are not exempt, but those with pre-existing comprehensive rules may keep them under supervision by an independent body, if aligned with the GDPR. + Who supervises church data protection rules? Such rules may be subject to the supervision of an independent supervisory body, which may be specific to the religious organisation, in line with GDPR standards. Related Key Issues GDPR Personal Data GDPR Right to be Informed

In this page Key Facts What the Commission Can Add, and on What Terms Delegated Acts and Implementing Acts in the GDPR Article 92 in Practice: Icons and Certification Recitals That Explain Article 92 Checklist: What Article 92 Means for Your Compliance Work Related Recitals Frequently Asked Questions about Article 92 Related Articles Article 92 paragraph by paragraph Paragraph What it says Covers Art. 92(1) The Commission’s power to adopt delegated acts is subject to the conditions in this Article. Scope of the power Art. 92(2) The delegations in Article 12(8) and Article 43(8) run for an indeterminate period from 24 May 2016. Duration Art. 92(3) The European Parliament or the Council may revoke either delegation at any time, from the day after publication in the Official Journal or a later date. Delegated acts already in force stay valid. Revocation Art. 92(4) The Commission notifies each delegated act to the Parliament and the Council simultaneously. Notification Art. 92(5) A delegated act enters into force only if neither institution objects within three months, or both say earlier that they will not object. Either can extend the period by three months. Objection Full text of Article 92 The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. The delegation of power referred to in Article 12(8) and Article 43(8) shall be conferred on the Commission for an indeterminate period of time from 24 May 2016. 1The delegation of power referred to in Article 12(8) and Article 43(8) may be revoked at any time by the European Parliament or by the Council. 2A decision of revocation shall put an end to the delegation of power specified in that decision. 3It shall take effect the day following that of its publication in the Official Journal of the European Union or at a later date specified therein. 4It shall not affect the validity of any delegated acts already in force. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 1A delegated act adopted pursuant to Article 12(8) and Article 43(8) shall enter into force only if no objection has been expressed by either the European Parliament or the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. 2That period shall be extended by three months at the initiative of the European Parliament or of the Council. In short Article 92 is about the Commission, not about controllers. Two GDPR provisions let the European Commission fill in detail by delegated act: the content and procedures for standardised icons (Art. 12(8)) and the requirements for certification mechanisms (Art. 43(8)). Article 92 sets the terms. The power has no end date, but the European Parliament or the Council can revoke it at any time, and either can stop an individual act by objecting within three months. It places no duties on controllers or processors. Key Facts Chapter Chapter X – Delegated acts and implementing acts (Art. 92–93) Applies to The European Commission, the European Parliament and the Council Maximum fine None. Article 92 imposes no obligations on controllers or processors, and it is not among the provisions listed in Art. 83(4)–(6) Delegations covered Standardised icons (Art. 12(8)); certification requirements (Art. 43(8)) Duration Indeterminate, from 24 May 2016, the day the GDPR entered into force (Art. 92(2); Art. 99(1)) Objection period Three months from notification, extendable once by three months (Art. 92(5)) Treaty basis Article 290 TFEU, as Recital 166 states Explained by recitals 166; see also 58 and 60 (icons) and 100 (certification) What the Commission Can Add, and on What Terms Article 290 of the Treaty on the Functioning of the EU lets the legislator delegate to the Commission the power to adopt non-legislative acts of general application that supplement or amend non-essential elements of a legislative act. The legislative act has to set the objectives, content, scope and duration of the delegation, and it may let the Parliament or the Council revoke it or object to individual acts (Art. 290 TFEU). Article 92 is where the GDPR does that. The GDPR uses the power twice. Under Article 12(8), the Commission can determine the information standardised icons should present and the procedures for providing them. Under Article 43(8), it can specify the requirements for data protection certification mechanisms. Recital 166 names both and adds that the Commission should carry out appropriate consultations, including at expert level, and send the relevant documents to the Parliament and the Council in good time. No deadline, but a standing veto The delegation has no expiry date and no obligation to use it: Articles 12(8) and 43(8) say the Commission “shall be empowered”, not that it must act. The control sits with the co-legislators instead. Either can revoke the delegation outright (Art. 92(3)), and no individual act enters into force while either can still object (Art. 92(5)). Delegated Acts and Implementing Acts in the GDPR Chapter X gives the Commission two different tools. Article 92 governs delegated acts; Article 93 governs implementing acts, adopted with a committee of Member State representatives. The GDPR says which tool applies each time. Tool Procedure Used for Adopted so far Delegated act Art. 92: Parliament and Council can revoke or object Standardised icons (Art. 12(8)); certification requirements (Art. 43(8)) The Commission’s 2024 report on the GDPR does not mention any (COM(2024) 357) Implementing act Art. 93: committee of Member States Including technical standards for certification (Art. 43(9)), standard contractual clauses (Art. 28(7) and 46(2)(c)) and adequacy decisions (Art. 45(3)) Standard contractual clauses in 2021 and adequacy decisions such as the EU-US Data Privacy Framework in 2023, as the 2024 report records Article 92 in Practice: Icons and Certification Article 92 sets the conditions under which the Commission can use its two delegations. The table below records the documented steps in both areas, from the drafting of the GDPR to the Commission’s latest report. Date Who What happened Why it matters for Article 92 12 Mar 2014 European Parliament Its first-reading position included a set of icons in an annex to a proposed Article 13 a; in a small test reported by researchers, participants did not understand the icons’ graphic scheme or pictograms (Springer, 2015) The adopted GDPR has no icon annex; icons were left to a Commission delegated act under Art. 12(8) 24 May 2016 GDPR The Regulation enters into force (Art. 99(1)) Both delegations start, for an indeterminate period (Art. 92(2)) 11 Apr 2018 Article 29 Working Party Adopts revised transparency guidelines, WP260 rev.01 (ec.europa.eu) Says the GDPR gives the Commission responsibility for a code of icons, which should be evidence-based and preceded by extensive research 25 May 2018 EDPB Endorses WP260 rev.01 at its first plenary (Endorsement 1/2018) The icons guidance becomes the Board’s position 10 Oct 2022 EDPB Approves Europrivacy as the first European Data Protection Seal (Opinion 28/2022) Certification works through criteria approved under Art. 42(5), without an Art. 43(8) delegated act 25 Jul 2024 European Commission Second report on the application of the GDPR (COM(2024) 357) Lists the tools the Commission adopted, such as the 2021 standard contractual clauses, and mentions no delegated act; reports that businesses find certification slow and complex to develop The list covers the steps documented in the sources linked. It is not a register of all Commission work on icons or certification. Standardised icons (Art. 12(8)) The legal basis exists; a common code of icons would come from the Commission. Article 12(7) lets Article 13 and 14 information be given in combination with standardised icons, which must be machine-readable where presented electronically. The Article 29 Working Party said icons only work if the symbols are standardised and recognised across the EU, and that the GDPR gives the Commission responsibility for a code of icons, with the Board able to give an opinion (WP260 rev.01; Art. 70(1)(r)). It added that any standardisation should rest on evidence, after extensive research with industry and the public on how well icons work. Certification requirements (Art. 43(8)) Certification works through criteria approved under Article 42(5), without a delegated act. Supervisory authorities and the Board approve certification criteria, and authorities approve accreditation requirements, as covered under Article 43. The Board approved Europrivacy as the first European Data Protection Seal in Opinion 28/2022. The Commission reported in 2024 that businesses find certification slow and complex to develop, and asked authorities to give clearer approval timelines (COM(2024) 357, section 5.1). Recitals That Explain Article 92 Recital 166 – Delegated Acts of the CommissionDelegates the Article 290 TFEU power to the Commission, names certification and standardised icons, and calls for consultations, including at expert level, and timely transmission of documents to the Parliament and the Council. Recital 58 – The Principle of TransparencyCalls for concise, easily accessible information in clear and plain language and, where appropriate, visualisation: the idea behind standardised icons. Recital 60 – Information ObligationSays the information owed to data subjects may be given in combination with standardised icons, machine-readable where presented electronically: the subject of the Article 12(8) delegation. Recital 100 – CertificationEncourages certification mechanisms and data protection seals and marks: the subject of the Article 43(8) delegation. Checklist: What Article 92 Means for Your Compliance Work Give the full Article 13 and 14 information; icons, if you use them, can only accompany it (Art. 12(7); WP260 rev.01) If you present icons electronically, make them machine-readable (Art. 12(7)) For certification, work from criteria approved under Art. 42(5) by your authority or the Board, not from a delegated act Watch the Official Journal: a delegated act on icons or certification would apply only after the objection period in Art. 92(5) has run If a delegation is ever revoked, check whether any act adopted under it was already in force, since those stay valid (Art. 92(3)) Related Recitals (166) Delegated Acts of the Commission (167) Implementing Powers of the Commission (168) Implementing Acts on Standard Contractual Clauses (169) Immediately Applicable Implementing Acts (170) Principle of Subsidiarity and Principle of Proportionality Frequently Asked Questions about Article 92 +What is a delegated act under the GDPR? A non-legislative act the Commission adopts under Article 290 TFEU to supplement the GDPR where the Regulation empowers it. Article 92 sets the conditions: an open-ended delegation, revocable by the European Parliament or the Council, and a three-month window in which either can object. +Which parts of the GDPR can the Commission supplement by delegated act? Two. Article 12(8) covers the information standardised icons should present and the procedures for providing them. Article 43(8) covers the requirements for data protection certification mechanisms under Article 42(1). +How long does the Commission's delegated power last? For an indeterminate period from 24 May 2016 (Art. 92(2)). It ends only if the European Parliament or the Council revokes it, and a revocation does not affect delegated acts already in force (Art. 92(3)). +Can the European Parliament or the Council block a delegated act? Yes. A delegated act enters into force only if neither objects within three months of notification, a period either can extend by three months, or if both say earlier that they will not object (Art. 92(5)). +Are there official GDPR privacy icons? The GDPR allows information to be given in combination with standardised icons and lets the Commission set them by delegated act (Art. 12(7)-(8)). The Commission's 2024 report on the application of the GDPR does not mention such an act, and icons can only accompany, not replace, the Article 13 and 14 information. Keeping privacy notices clear without waiting for official icons? Layered notices and clear, consistent wording carry the Article 13 and 14 information today. Keeping them in step with what you actually process is the part that takes ongoing work. Explore privacy governance tools Related Key Issues GDPR Fines / Penalties GDPR Privacy Impact Assessment

1The Commission shall be assisted by a committee. 2That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Where reference is made to this paragraph, Article 8 of Regulation ((EU) No 182/2011, in conjunction with Article 5 thereof, shall apply. Related Recitals (8) Adoption into National Law (10) Harmonised Level of Data Protection Despite National Scope (11) Harmonisation of the Powers and Sanctions Frequently Asked Questions about Article 93 +What is the committee procedure under Article 93 GDPR? Article 93 provides that the Commission is assisted by a committee when adopting implementing acts, following the EU's standard comitology procedures. +How are GDPR implementing acts adopted? Implementing acts are adopted with the involvement of a committee of member state representatives, using the examination procedure under EU rules. + What is the difference between delegated and implementing acts? Delegated acts supplement or amend non-essential parts of the law, while implementing acts set uniform conditions for applying it, with member states involved through a committee. Related Key Issues GDPR Fines / Penalties GDPR Privacy by Design

Directive 95/46/EC is repealed with effect from 25 May 2018. 1References to the repealed Directive shall be construed as references to this Regulation. 2References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC shall be construed as references to the European Data Protection Board established by this Regulation. Related Recitals (171) Repeal of Directive 95/46/EC and Transitional Provisions Frequently Asked Questions about Article 94 +Did the GDPR replace the Data Protection Directive? Yes. Article 94 repealed Directive 95/46/EC with effect from 25 May 2018, when the GDPR became applicable across the EU. +What was Directive 95/46/EC? Directive 95/46/EC was the EU's previous data protection framework, which the GDPR replaced to create a single, directly applicable regulation across member states. + Do references to the old Directive still apply? References to the repealed Directive are construed as references to the GDPR, and references to the former Working Party as references to the European Data Protection Board. Related Key Issues GDPR Privacy Impact Assessment GDPR Records of Processing Activities

This Regulation shall not impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union in relation to matters for which they are subject to specific obligations with the same objective set out in Directive 2002/58/EC. Related Recitals (173) Relationship to Directive 2002/58/EC Frequently Asked Questions about Article 95 +How does the GDPR relate to the ePrivacy Directive? Article 95 provides that the GDPR does not impose additional obligations where Directive 2002/58/EC already sets specific obligations for the same processing in electronic communications. +Does the GDPR or ePrivacy apply to cookies? The ePrivacy rules govern many aspects of cookies and electronic communications, while the GDPR applies to the personal data involved, with the two operating together. + What is the ePrivacy Directive? Directive 2002/58/EC, known as the ePrivacy Directive, sets specific privacy rules for electronic communications, including confidentiality and the use of cookies. Related Key Issues GDPR Right to be Informed GDPR Records of Processing Activities

International agreements involving the transfer of personal data to third countries or international organisations which were concluded by Member States prior to 24 May 2016, and which comply with Union law as applicable prior to that date, shall remain in force until amended, replaced or revoked. Related Recitals (108) Appropriate Safeguards (109) Standard Data Protection Clauses Frequently Asked Questions about Article 96 +Do older international agreements survive the GDPR? Article 96 provides that international agreements involving data transfers concluded before 24 May 2016 remain in force until amended, replaced, or revoked, if compliant with the law applicable then. +Can pre-GDPR data transfer agreements still be used? Yes, where they were concluded before the cut-off date and complied with the law in force at that time, until they are updated or revoked. + Why does Article 96 matter for international transfers? It provides legal continuity, ensuring existing agreements are not automatically invalidated by the GDPR while encouraging eventual alignment. Related Key Issues GDPR Personal Data GDPR Right to be Forgotten

1By 25 May 2020 and every four years thereafter, the Commission shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council. 2The reports shall be made public. In the context of the evaluations and reviews referred to in paragraph 1, the Commission shall examine, in particular, the application and functioning of: Chapter V on the transfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC; Chapter VII on cooperation and consistency. For the purpose of paragraph 1, the Commission may request information from Member States and supervisory authorities. In carrying out the evaluations and reviews referred to in paragraphs 1 and 2, the Commission shall take into account the positions and findings of the European Parliament, of the Council, and of other relevant bodies or sources. The Commission shall, if necessary, submit appropriate proposals to amend this Regulation, in particular taking into account of developments in information technology and in the light of the state of progress in the information society. Related Recitals (6) Ensuring a High Level of Data Protection Despite the Increased Exchange of Data (7) The Framework is Based on Control and Certainty (9) Different Standards of Protection by the Directive 95/46/EC Frequently Asked Questions about Article 97 +Does the European Commission review the GDPR? Yes. Article 97 requires the Commission to report on the evaluation and review of the GDPR periodically, with the first report due by 25 May 2020. +How often is the GDPR evaluated? The Commission must submit reports at least every four years, examining areas such as international transfers and cooperation between supervisory authorities. + Can the GDPR be amended after review? Yes. Based on its evaluations, the Commission may submit proposals to amend the GDPR if appropriate. Related Key Issues GDPR Privacy Impact Assessment GDPR Right to be Forgotten

1The Commission shall, if appropriate, submit legislative proposals with a view to amending other Union legal acts on the protection of personal data, in order to ensure uniform and consistent protection of natural persons with regard to processing. 2This shall in particular concern the rules relating to the protection of natural persons with regard to processing by Union institutions, bodies, offices and agencies and on the free movement of such data. Related Recitals (7) The Framework is Based on Control and Certainty (8) Adoption into National Law (9) Different Standards of Protection by the Directive 95/46/EC (13) Taking Account of Micro, Small and Medium-sized Enterprises Frequently Asked Questions about Article 98 +What does Article 98 GDPR require? Article 98 directs the Commission to review other EU legal acts on data protection, such as those applying to EU institutions, to align them with the GDPR where appropriate. +Does the GDPR apply to EU institutions? EU institutions are covered by separate but aligned rules, and Article 98 supports updating those acts to ensure consistent data protection across the EU. + Why review other EU data protection laws? Reviewing related acts ensures a coherent and uniform approach to data protection across all EU legislation, not just the GDPR. Related Key Issues GDPR Right to be Informed GDPR Records of Processing Activities

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from 25 May 2018. Related Recitals (4) Data Protection in Balance with Other Fundamental Rights (6) Ensuring a High Level of Data Protection Despite the Increased Exchange of Data (7) The Framework is Based on Control and Certainty Frequently Asked Questions about Article 99 +When did the GDPR come into force? Article 99 provides that the GDPR entered into force on 24 May 2016 and became applicable from 25 May 2018, giving organisations a two-year transition period. +What is the difference between entry into force and application? The GDPR entered into force in 2016, but its obligations only became enforceable, or applicable, from 25 May 2018. + Is the GDPR directly applicable in all EU countries? Yes. As a regulation, the GDPR is binding in its entirety and directly applicable in all member states without needing national transposition. Related Key Issues GDPR Third Countries GDPR Privacy by Design