(1) Lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of such data.

(2) Protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data.

(3) The free movement of personal data within the Union is neither restricted nor prohibited for reasons connected with this protection.

(1) Applies to the processing of personal data wholly or partly by automated means, and to non-automated processing of personal data forming part of, or intended to form part of, a filing system.

(2) Does not apply to processing (a) outside the scope of Union law; (b) by Member States carrying out activities within the scope of Title V, Chapter 2 TEU; (c) by a natural person in the course of a purely personal or household activity; (d) by competent authorities for the prevention, investigation, detection or prosecution of criminal offences, including safeguarding against public-security threats.

(3) Processing by Union institutions, bodies, offices and agencies is governed by Regulation (EC) No 45/2001, to be aligned with the principles of this Regulation.

(4) Does not affect the application of Directive 2000/31/EC, in particular the intermediary-liability rules in its Articles 12 to 15.

(1) Applies to processing carried out in the context of the activities of an establishment of a controller or processor in the Union, regardless of whether the processing itself takes place in the Union.

(2) Applies to processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing relates to (a) offering goods or services to such data subjects, or (b) monitoring their behaviour as far as it takes place within the Union.

(3) Applies to processing by a controller not established in the Union but in a place where Member State law applies by virtue of public international law.

Sets out the definitions used throughout the Regulation, including the following:

(1) "personal data" — any information relating to an identified or identifiable natural person ("data subject").

(2) "processing" — any operation performed on personal data, such as collection, storage, use, disclosure or erasure, whether automated or not.

(3) "restriction of processing" — marking stored personal data with the aim of limiting its future processing.

(4) "profiling" — automated processing of personal data used to evaluate or predict personal aspects of a natural person.

(5) "pseudonymisation" — processing personal data so that it can no longer be attributed to a specific data subject without additional, separately-held information.

(6) "filing system" — any structured set of personal data accessible according to specific criteria.

(7) "controller" — the person or body that alone or jointly determines the purposes and means of processing.

(8) "processor" — the person or body that processes personal data on behalf of the controller.

(9) "recipient" — a person or body to whom personal data are disclosed, with certain public authorities acting under a specific inquiry excluded.

(10) "third party" — any person or body other than the data subject, controller, processor and persons authorised to process data under their direct authority.

(11) "consent" — any freely given, specific, informed and unambiguous indication of the data subject's wishes.

(12) "personal data breach" — a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to personal data.

(13) "genetic data" — personal data relating to the inherited or acquired genetic characteristics of a natural person.

(14) "biometric data" — personal data from specific technical processing of physical, physiological or behavioural characteristics allowing unique identification.

(15) "data concerning health" — personal data related to the physical or mental health of a natural person, including health care services.

(16) "main establishment" — broadly, the place of a controller's or processor's central administration in the Union.

(17) "representative" — an EU-based person designated in writing under Art. 27 to represent a non-EU controller or processor.

(18) "enterprise" — a natural or legal person engaged in an economic activity.

(19) "group of undertakings" — a controlling undertaking and its controlled undertakings.

(20) "binding corporate rules" — internal data-protection policies adhered to for transfers within a corporate group.

(21) "supervisory authority" — an independent public authority established under Art. 51.

(22) "supervisory authority concerned" — a supervisory authority affected by processing owing to establishment, impact on data subjects, or a complaint lodged.

(23) "cross-border processing" — processing in the context of establishments in more than one Member State, or processing that significantly affects data subjects in more than one Member State.

(24) "relevant and reasoned objection" — an objection to a draft decision on whether there is an infringement or whether intended action complies with the Regulation.

(25) "information society service" — a service as defined in Art. 1(1)(b) of Directive (EU) 2015/1535.

(26) "international organisation" — an organisation governed by public international law and its subordinate bodies, or any other body set up by an agreement between two or more countries.

(1) Personal data must be: (a) processed lawfully, fairly and transparently ("lawfulness, fairness and transparency"); (b) collected for specified, explicit and legitimate purposes and not further processed incompatibly with them, subject to the archiving/research/statistics carve-out in Art. 89(1) ("purpose limitation"); (c) adequate, relevant and limited to what is necessary ("data minimisation"); (d) accurate and, where necessary, kept up to date ("accuracy"); (e) kept in a form permitting identification no longer than necessary, subject to appropriate safeguards for archiving, research or statistical use ("storage limitation"); (f) processed in a manner ensuring appropriate security, including protection against unauthorised or unlawful processing and against loss, destruction or damage ("integrity and confidentiality").

(2) The controller is responsible for, and must be able to demonstrate, compliance with paragraph 1 ("accountability").

(1) Processing is lawful only if at least one applies: (a) the data subject has given consent; (b) necessary for performance of a contract with the data subject or pre-contractual steps at their request; (c) necessary for compliance with a legal obligation; (d) necessary to protect vital interests; (e) necessary for a task carried out in the public interest or in the exercise of official authority; (f) necessary for the legitimate interests of the controller or a third party, unless overridden by the data subject's interests or fundamental rights, in particular where the data subject is a child.

(2) Member States may maintain or introduce more specific provisions adapting the application of the rules for processing under (c) and (e).

(3) The legal basis for processing under (c) and (e) must be laid down by Union law or the law of the Member State to which the controller is subject.

(4) Where processing for a purpose other than the one for which the data were collected is not based on consent or a Union/Member State law necessary and proportionate under Art. 23(1), the controller must assess compatibility, taking into account any link between the purposes, the context of collection, the nature of the data, the possible consequences, and safeguards such as encryption or pseudonymisation.

(1) Where processing is based on consent, the controller must be able to demonstrate that the data subject has consented.

(2) If consent is given within a written declaration that also concerns other matters, the request for consent must be clearly distinguishable from those other matters, in an intelligible and easily accessible form using plain language; parts of the declaration that infringe the Regulation are not binding.

(3) The data subject has the right to withdraw consent at any time, and withdrawal must be as easy as giving it; withdrawal does not affect the lawfulness of processing carried out before withdrawal, and the data subject must be informed of this before consenting.

(4) When assessing whether consent is freely given, utmost account must be taken of whether performance of a contract — including provision of a service — is made conditional on consent to processing not necessary for that contract.

(1) Where Art. 6(1)(a) applies to an information society service offered directly to a child, processing is lawful where the child is at least 16 years old; below that age it is lawful only if consent is given or authorised by the holder of parental responsibility. Member States may lower this threshold by law, but not below 13 years.

(2) The controller must make reasonable efforts, taking available technology into account, to verify that parental consent was given or authorised.

(3) Does not affect the general contract law of Member States, such as rules on the validity, formation or effect of a contract involving a child.

(1) Prohibits processing of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for unique identification, health data, or data concerning a person's sex life or sexual orientation.

(2) The prohibition does not apply where, among other conditions: (a) the data subject has given explicit consent; (b) processing is necessary for obligations in employment, social security or social protection law; (c) necessary to protect vital interests where the data subject is incapable of consent; (d) carried out by a non-profit body with a political, philosophical, religious or trade-union aim, limited to its members; (e) the data were manifestly made public by the data subject; (f) necessary for legal claims or judicial acts; (g) necessary for substantial public-interest reasons; (h) necessary for health or social care, occupational medicine, or managing health/social-care systems; (i) necessary for public health reasons; (j) necessary for archiving, scientific/historical research or statistical purposes.

(3) Data processed under (2)(h) may only be processed by, or under the responsibility of, a professional bound by a duty of secrecy.

(4) Member States may maintain or introduce further conditions, including limitations, for genetic, biometric or health data.

Processing of personal data relating to criminal convictions and offences or related security measures based on Art. 6(1) may only take place under the control of official authority, or when authorised by Union or Member State law providing appropriate safeguards. Any comprehensive register of criminal convictions may only be kept under the control of official authority.

(1) Where the purposes for which a controller processes personal data do not or no longer require identification of a data subject, the controller is not obliged to acquire, retain or process additional information solely to comply with this Regulation.

(2) Where the controller can demonstrate it is not in a position to identify the data subject, it must inform the data subject accordingly where possible; Articles 15 to 20 then do not apply, unless the data subject provides additional information enabling identification in order to exercise those rights.

(3) No further identifiers may be collected or retained for the sole purpose of complying with this Regulation.

(1) The controller must take appropriate measures to provide all information under Art. 13 and 14 and all communications under Art. 15 to 22 and 34 in a concise, transparent, intelligible and easily accessible form, in clear and plain language — particularly for information addressed to children; provided in writing or, where appropriate, electronically, or orally on request once identity is verified.

(2) The controller must facilitate the exercise of data subject rights under Art. 15 to 22, and may only refuse to act on a request in the Art. 11(2) case where it demonstrates it cannot identify the data subject.

(3) The controller must provide information on action taken on a request under Art. 15 to 22 without undue delay and within one month, extendable by two further months where necessary given complexity or volume, with the data subject informed of any extension and its reasons within the first month; requests made electronically should be answered electronically unless otherwise requested.

(4) Where the controller does not act on a request, it must inform the data subject without delay, and at the latest within one month, of the reasons and of the possibility to lodge a complaint with a supervisory authority or seek a judicial remedy.

(5) Information and communications under Art. 13, 14 and 15 to 22 and 34 are provided free of charge; for manifestly unfounded or excessive requests, in particular due to repetitive character, the controller may charge a reasonable administrative fee or refuse to act.

(6) Where there are reasonable doubts about identity, the controller may request additional information necessary to confirm identity.

(7) Information may be combined with standardised icons to give an easily visible, intelligible and clearly legible overview of the intended processing.

(1) Where data are collected from the data subject, the controller must, at the time of collection, provide: (a) identity and contact details of the controller (and representative); (b) contact details of the data protection officer, if any; (c) the purposes and legal basis of processing; (d) where based on legitimate interests, those interests; (e) any recipients or categories of recipients; (f) intention to transfer data to a third country or international organisation, if applicable.

(2) In addition, to ensure fair and transparent processing, the controller must provide: (a) the storage period or criteria for determining it; (b) the existence of the right to withdraw consent; (c) the existence of rights to access, rectification, erasure, restriction, objection and portability; (d) the right to withdraw consent under Art. 6(1)(a) or 9(2)(a); (e) the right to lodge a complaint with a supervisory authority; (f) whether providing the data is a statutory or contractual requirement and the consequences of not providing it; (g) the existence of automated decision-making, including profiling, and meaningful information about the logic involved.

(3) Where data are to be further processed for a different purpose, the controller must inform the data subject of that other purpose before further processing.

(4) Paragraphs 1 to 3 do not apply where and insofar as the data subject already has the information.

(1) Where data are not obtained from the data subject, the controller must provide the same core information as under Art. 13(1), plus the categories of personal data concerned.

(2) In addition, the controller must provide the information needed to ensure fair and transparent processing, mirroring Art. 13(2), plus the source the data originated from, and whether it came from publicly accessible sources.

(3) This information must be given within a reasonable period after obtaining the data, and at the latest within one month; if used to communicate with the data subject, at the latest at the time of first communication; if disclosure to another recipient is envisaged, at the latest when the data are first disclosed.

(4) Where the data are to be further processed for a different purpose, the controller must inform the data subject of that other purpose before further processing.

(5) The obligations do not apply where the data subject already has the information, where provision proves impossible or would involve disproportionate effort (particularly for archiving, research or statistical purposes), where obtaining or disclosure is expressly regulated by law with appropriate safeguards, or where the data are subject to an obligation of professional secrecy.

(1) The data subject has the right to obtain confirmation whether personal data concerning them are processed and, if so, access to the data and to information on: (a) purposes; (b) categories of data; (c) recipients, in particular in third countries or international organisations; (d) envisaged storage period or criteria; (e) rights to rectification, erasure, restriction or objection; (f) the right to lodge a complaint; (g) the source of the data if not collected from the data subject; (h) the existence of automated decision-making, including profiling, and meaningful information about the logic involved.

(2) Where data are transferred to a third country or international organisation, the data subject has the right to be informed of the appropriate safeguards under Art. 46.

(3) The controller must provide a copy of the personal data undergoing processing; a reasonable fee may be charged for further copies; electronic requests should be answered in a commonly used electronic format unless requested otherwise.

(4) The right to obtain a copy must not adversely affect the rights and freedoms of others.

The data subject has the right to obtain without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject also has the right to have incomplete personal data completed, including by means of a supplementary statement.

(1) The data subject has the right to obtain erasure of personal data without undue delay where, among other grounds: (a) the data are no longer necessary for the purposes for which they were collected; (b) the data subject withdraws consent and there is no other legal basis; (c) the data subject objects under Art. 21(1) with no overriding legitimate grounds, or objects under Art. 21(2); (d) the data have been unlawfully processed; (e) erasure is required for compliance with a legal obligation; (f) the data were collected in relation to an information society service offered to a child under Art. 8(1).

(2) Where the controller has made the data public and is obliged to erase it, it must take reasonable steps, including technical measures, to inform other controllers processing the data that the data subject has requested erasure of any links to, or copies of, the data.

(3) Paragraphs 1 and 2 do not apply to the extent processing is necessary for exercising the right of freedom of expression and information; compliance with a legal obligation or performance of a public-interest task; public health reasons under Art. 9(2)(h)/(i) and 9(3); archiving, scientific/historical research or statistical purposes under Art. 89(1) where erasure would seriously impair those aims; or the establishment, exercise or defence of legal claims.

(1) The data subject has the right to obtain restriction of processing where: (a) accuracy is contested, for a period enabling verification; (b) processing is unlawful and the data subject opposes erasure and requests restriction instead; (c) the controller no longer needs the data but the data subject needs them for legal claims; (d) the data subject has objected under Art. 21(1) pending verification of overriding grounds.

(2) Where processing has been restricted, the data may — apart from storage — only be processed with the data subject's consent, for legal claims, to protect the rights of another person, or for important public-interest reasons.

(3) A data subject who obtained restriction must be informed before the restriction is lifted.

The controller must communicate any rectification, erasure or restriction under Art. 16, 17(1) and 18 to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller must inform the data subject about those recipients if requested.

(1) The data subject has the right to receive personal data they provided to a controller in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance, where (a) processing is based on consent under Art. 6(1)(a) or 9(2)(a), or on a contract under Art. 6(1)(b), and (b) processing is carried out by automated means.

(2) The data subject also has the right to have data transmitted directly from one controller to another, where technically feasible.

(3) Does not affect Art. 17, and does not apply to processing necessary for a task carried out in the public interest or exercise of official authority.

(4) Must not adversely affect the rights and freedoms of others.

(1) The data subject has the right, on grounds relating to their particular situation, to object at any time to processing based on Art. 6(1)(e) or (f), including profiling based on those provisions; the controller must stop processing unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or the processing serves legal claims.

(2) Where data are processed for direct marketing, the data subject has the right to object at any time, including to related profiling.

(3) Where a data subject objects to processing for direct marketing, the data must no longer be processed for those purposes.

(4) The data subject must be explicitly informed of the right in paragraphs 1 and 2 at the latest at the time of first communication, presented clearly and separately from other information.

(5) In the context of information society services, the data subject may exercise the right to object by automated means using technical specifications, notwithstanding Directive 2002/58/EC.

(6) Where data are processed for scientific/historical research or statistical purposes under Art. 89(1), the data subject has the right to object on grounds relating to their particular situation, unless processing is necessary for a public-interest task.

(1) The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them.

(2) Does not apply where the decision (a) is necessary for entering into or performing a contract; (b) is authorised by Union or Member State law providing suitable safeguards; or (c) is based on explicit consent.

(3) In cases (a) and (c), the controller must implement suitable measures to safeguard rights and freedoms, including at least the right to obtain human intervention, to express one's point of view, and to contest the decision.

(4) Decisions under paragraph 2 must not be based on special categories of data under Art. 9(1), unless Art. 9(2)(a) or (g) applies with suitable safeguards in place.

(1) Union or Member State law may restrict, by legislative measure, the obligations and rights under Art. 12 to 22 and Art. 34, and Art. 5 insofar as it corresponds to those rights and obligations, provided such a restriction respects the essence of fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard objectives such as: national security; defence; public security; the prevention, investigation, detection or prosecution of criminal offences; other important public interests, including monetary, budgetary and taxation matters, public health and social security; the protection of judicial independence and proceedings; the prevention of breaches of ethics for regulated professions; monitoring and regulatory functions connected with official authority in the above areas; protection of the data subject or the rights of others; and the enforcement of civil law claims.

(2) Legislative measures under paragraph 1 must in particular specify the purposes of processing, categories of data concerned, the scope of the restrictions, safeguards against abuse, the identity of the controller, storage periods, risks to data subjects' rights and freedoms, and the right of data subjects to be informed of the restriction unless this would be prejudicial to its purpose.

(1) Taking into account the nature, scope, context and purposes of processing and the varying risks to natural persons, the controller must implement appropriate technical and organisational measures to ensure and be able to demonstrate that processing complies with this Regulation, reviewing and updating them as needed.

(2) Where proportionate, those measures include implementation of appropriate data protection policies by the controller.

(3) Adherence to approved codes of conduct under Art. 40 or approved certification under Art. 42 may be used to demonstrate compliance.

(1) Taking into account the state of the art, cost of implementation, and the nature, scope, context and purposes of processing as well as the risks to natural persons, the controller must implement appropriate technical and organisational measures — such as pseudonymisation — both at the time of determining the means of processing and at the time of processing itself, designed to implement data protection principles such as data minimisation effectively.

(2) The controller must implement appropriate measures ensuring that, by default, only personal data necessary for each specific purpose are processed — regarding the amount collected, the extent of processing, the storage period and accessibility — and in particular that personal data are not made accessible without the individual's intervention to an indefinite number of people.

(3) An approved certification under Art. 42 may be used to demonstrate compliance with paragraphs 1 and 2.

(1) Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers and must, in a transparent arrangement, determine their respective responsibilities, in particular regarding the exercise of data subject rights and their information duties under Art. 13 and 14; the arrangement may designate a contact point for data subjects.

(2) The arrangement must duly reflect the joint controllers' respective roles and relationships vis-à-vis data subjects, and its essence must be made available to data subjects.

(3) Irrespective of the arrangement, the data subject may exercise their rights under this Regulation against and with each of the controllers.

(1) Where Art. 3(2) applies, the controller or processor must designate in writing a representative in the Union.

(2) The obligation does not apply to occasional processing that does not include large-scale processing of special categories of data or criminal-offence data and is unlikely to result in a risk to individuals, or to public authorities and bodies.

(3) The representative must be established in one of the Member States where the data subjects whose data are processed in connection with offered goods/services or monitored behaviour are located.

(4) The representative is mandated to be addressed, in addition to or instead of the controller/processor, by supervisory authorities and data subjects on all issues related to processing.

(5) Designating a representative does not affect legal action that could be taken against the controller or processor itself.

(1) Where processing is carried out on behalf of a controller, the controller must use only processors providing sufficient guarantees to implement appropriate technical and organisational measures ensuring compliance and protection of data subject rights.

(2) A processor must not engage another processor without prior specific or general written authorisation of the controller; under general authorisation, the processor must inform the controller of any intended changes so the controller can object.

(3) Processing by a processor must be governed by a contract or other legal act setting out subject-matter, duration, nature and purpose of processing, the type of data, categories of data subjects, and the obligations and rights of the controller, requiring in particular that the processor: (a) processes only on documented instructions; (b) ensures confidentiality commitments for authorised staff; (c) takes all measures required under Art. 32; (d) respects the conditions for engaging sub-processors; (e) assists the controller in responding to data subject rights requests; (f) assists with compliance under Art. 32–36; (g) at the controller's choice deletes or returns all data after the service ends; (h) makes available all information necessary to demonstrate compliance and allows for audits.

(4) Where a processor engages another processor, the same data protection obligations must be imposed on that sub-processor by contract, and the first processor remains fully liable to the controller for the sub-processor's performance.

(5) Adherence to an approved code of conduct or certification may be used as an element to demonstrate sufficient guarantees.

(6) The contract may be based, wholly or in part, on standard contractual clauses.

(7) The Commission may lay down standard contractual clauses for the matters in paragraphs 3 and 4.

(8) A supervisory authority may also establish its own standard contractual clauses, subject to the consistency mechanism under Art. 63.

(9) The contract must be in writing, including in electronic form.

(10) A processor that processes data beyond the controller's instructions is considered a controller for that processing and subject to the liability regime of Art. 82.

A processor, and any person acting under the authority of the controller or processor with access to personal data, may only process that data on instructions from the controller, unless required to do so by Union or Member State law.

(1) Every controller (and its representative, if any) must maintain a record of processing activities under its responsibility, containing: (a) name and contact details of the controller (and joint controller, representative, DPO); (b) purposes of processing; (c) description of the categories of data subjects and data; (d) categories of recipients, including in third countries or international organisations; (e) transfers to third countries, including documentation of appropriate safeguards; (f) envisaged erasure deadlines where possible; (g) a general description of technical and organisational security measures where possible.

(2) Every processor (and its representative) must maintain a record of all categories of processing carried out on behalf of a controller, covering: (a) names and contact details of processor(s), each controller, and any representative/DPO; (b) categories of processing per controller; (c) transfers to third countries, including safeguards; (d) a general description of security measures where possible.

(3) The records must be in writing, including electronic form.

(4) The controller/processor must make the record available to the supervisory authority on request.

(5) The obligations in paragraphs 1 and 2 do not apply to an organisation employing fewer than 250 persons, unless the processing is likely to result in a risk to data subjects, is not occasional, or includes special categories of data under Art. 9(1) or criminal-offence data under Art. 10.

The controller and processor, and their representatives if any, must cooperate, on request, with the supervisory authority in the performance of its tasks.

(1) Taking into account the state of the art, cost of implementation, and the nature, scope, context and purposes of processing as well as the varying risks, the controller and processor must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate: (a) pseudonymisation and encryption; (b) the ability to ensure ongoing confidentiality, integrity, availability and resilience of systems and services; (c) the ability to restore availability and access to data in a timely manner after an incident; (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures.

(2) In assessing the appropriate level of security, account must be taken of risks presented by processing, in particular from accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to data.

(3) Adherence to an approved code of conduct or certification may be used to demonstrate compliance with paragraph 1.

(4) The controller and processor must take steps to ensure that any person acting under their authority with access to personal data processes it only on instruction, unless required by law.

(1) In the case of a personal data breach, the controller must, without undue delay and where feasible within 72 hours of becoming aware of it, notify the competent supervisory authority under Art. 55, unless the breach is unlikely to result in a risk to individuals; a delayed notification must be accompanied by reasons.

(2) A processor must notify the controller without undue delay after becoming aware of a personal data breach.

(3) The notification must at least: (a) describe the nature of the breach, including categories and approximate numbers of data subjects and records concerned; (b) give the DPO or other contact point's details; (c) describe the likely consequences; (d) describe the measures taken or proposed to address and mitigate the breach.

(4) Where information cannot be provided at the same time, it may be provided in phases without undue further delay.

(5) The controller must document all data breaches, including facts, effects and remedial action taken, to enable the supervisory authority to verify compliance.

(1) Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must communicate the breach to the data subject without undue delay.

(2) The communication must describe, in clear and plain language, the nature of the breach and contain at least the information and recommendations set out in Art. 33(3)(b), (c) and (d).

(3) Communication is not required where: (a) appropriate technical and organisational protection measures (e.g. encryption) rendered the data unintelligible to unauthorised persons; (b) the controller has since ensured the high risk is no longer likely to materialise; or (c) it would involve disproportionate effort, in which case a public communication or similar measure must be used instead.

(4) Where the controller has not already communicated the breach, the supervisory authority may require it to do so, or may decide that one of the paragraph 3 conditions is met.

(1) Where a type of processing, in particular using new technologies, is likely to result in a high risk to natural persons given its nature, scope, context and purposes, the controller must, prior to processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.

(2) The DPO, if designated, may be consulted when carrying out a data protection impact assessment.

(3) A DPIA is required in particular for: (a) systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; (b) large-scale processing of special categories of data or criminal-offence data; (c) systematic, large-scale monitoring of publicly accessible areas.

(4) The supervisory authority must establish and publish a list of processing operations subject to a DPIA requirement and communicate it to the EDPB.

(5) The supervisory authority may also establish and publish a list of processing operations for which no DPIA is required, communicated likewise.

(6) Before finalising the lists in paragraphs 4 and 5, the supervisory authority must apply the consistency mechanism under Art. 63 where the lists concern processing related to offering goods/services across multiple Member States, or significantly affecting data subjects there.

(7) The assessment must at least contain: (a) a systematic description of the envisaged processing operations and purposes; (b) an assessment of necessity and proportionality; (c) an assessment of risks to data subjects' rights and freedoms; (d) the measures envisaged to address the risks, including safeguards and mechanisms to ensure compliance.

(8) Compliance with approved codes of conduct under Art. 40 must be duly taken into account in assessing the impact of processing operations.

(9) The controller must seek the DPO's advice, where one has been designated, when carrying out a DPIA.

(10) A DPIA is also required where processing is carried out under Art. 6(1)(c) or (e), unless the Regulation already contains specific rules for such processing.

(11) The controller must carry out a review to assess whether processing is performed in accordance with the DPIA, at least where the risk changes.

(1) The controller must consult the supervisory authority prior to processing where a DPIA under Art. 35 indicates that the processing would result in a high risk in the absence of risk-mitigation measures.

(2) Where the supervisory authority considers the intended processing would not comply with this Regulation — in particular because the risk has been insufficiently identified or mitigated — it must, within up to eight weeks of the consultation request, provide written advice and may exercise its powers under Art. 58.

(3) When consulting, the controller must provide the supervisory authority with: (a) respective responsibilities of controllers/processors, especially within a group; (b) the purposes and means of the intended processing; (c) measures and safeguards for data subjects' rights and freedoms; (d) DPO contact details, if any; (e) the DPIA; (f) any other information requested.

(4) Member States must consult the supervisory authority when preparing legislative or regulatory proposals relating to processing.

(1) The controller and processor must designate a data protection officer (DPO) in any case where: (a) processing is carried out by a public authority or body, except courts acting in their judicial capacity; (b) the core activities require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities consist of large-scale processing of special categories of data or criminal-offence data.

(2) A group of undertakings may appoint a single DPO, provided it is easily accessible from each establishment.

(3) Public authorities/bodies may designate a single DPO for several such entities, taking account of their organisational structure and size.

(4) In other cases, a controller, processor, or associations representing controllers or processors may designate a DPO on a voluntary basis.

(5) The DPO must be designated on the basis of professional qualities, expert knowledge of data protection law and practice, and ability to fulfil the tasks under Art. 39.

(6) The DPO may be a staff member or perform the tasks on the basis of a service contract.

(7) The controller/processor must publish the DPO's contact details and communicate them to the supervisory authority.

(1) The controller and processor must ensure the DPO is involved properly and in a timely manner in all data protection matters.

(2) They must support the DPO by providing the resources necessary to carry out the tasks under Art. 39, access to data and processing operations, and resources to maintain expert knowledge.

(3) They must ensure the DPO does not receive instructions on the exercise of their tasks, is not dismissed or penalised for performing them, and reports directly to the highest management level.

(4) Data subjects may contact the DPO on all matters related to processing of their data and the exercise of their rights.

(5) The DPO is bound by secrecy or confidentiality regarding the identity of data subjects, unless released from this obligation.

(6) The DPO may fulfil other tasks and duties, provided the controller/processor ensures they do not result in a conflict of interest.

(1) The DPO must at least: (a) inform and advise the controller/processor and its employees of their obligations under this Regulation and other data protection law; (b) monitor compliance, including staff awareness, training, and audits; (c) provide advice on request regarding DPIAs and monitor their performance; (d) cooperate with the supervisory authority; (e) act as the contact point for the supervisory authority, including on prior consultation, and advise on other matters as appropriate.

(2) The DPO must have due regard to the risk associated with processing operations, taking into account their nature, scope, context and purposes.

(1) Member States, supervisory authorities, the EDPB and the Commission must encourage the drawing up of codes of conduct intended to contribute to the proper application of the GDPR, taking account of the specific features of different sectors and the needs of micro, small and medium-sized enterprises.

(2) Associations and other bodies representing categories of controllers or processors may prepare, amend or extend codes of conduct addressing matters such as fair and transparent processing, legitimate interests, data collection, pseudonymisation, information to the public, exercise of data subject rights, information and protection of children, technical and organisational measures under Art. 24/25/32, breach notification, and out-of-court dispute resolution.

(1) Without prejudice to the tasks and powers of the competent supervisory authority under Art. 57 and 58, monitoring of compliance with a code of conduct may be carried out by a body with appropriate expertise, accredited for that purpose by the competent supervisory authority.

(2) A monitoring body may be accredited where it has demonstrated its independence and expertise, established procedures to assess suitability, monitor compliance and periodically review the code, established procedures to handle complaints in a transparent manner, and demonstrates its tasks do not create a conflict of interest.

(1) Member States, supervisory authorities, the EDPB and the Commission must encourage the establishment of data protection certification mechanisms, seals and marks demonstrating compliance with this Regulation.

(2) In addition to adherence by controllers/processors subject to the GDPR, approved certification mechanisms may also demonstrate appropriate safeguards provided by controllers/processors outside the GDPR in the context of transfers under Art. 46(2)(f), through binding and enforceable commitments.

(3) Certification is voluntary and available via a transparent process.

(1) Without prejudice to the tasks and powers of the competent supervisory authority under Art. 57 and 58, certification bodies with an appropriate level of data protection expertise must, after informing the supervisory authority, issue and renew certification.

(2) Certification bodies must be accredited by the competent supervisory authority and/or the national accreditation body in accordance with Regulation (EC) No 765/2008 and EN-ISO/IEC 17065/2012, plus any additional requirements set by the supervisory authority.

Any transfer of personal data which are undergoing processing, or are intended for processing after transfer, to a third country or international organisation is only permitted if the controller and processor comply with the conditions of this Chapter, and only where the other provisions of this Regulation are also respected, so that the level of protection guaranteed by this Regulation is not undermined.

(1) A transfer may take place where the Commission has decided that the third country, a territory or sector within it, or the international organisation ensures an adequate level of protection.

(2) In assessing adequacy, the Commission must consider in particular the rule of law, respect for human rights, relevant general and sectoral legislation including on public security, defence, national security and criminal law and access of public authorities to data, the existence of independent supervisory authorities, and the international commitments entered into by the third country or organisation.

(3) The Commission may, by implementing act, decide that a third country, territory, sector or international organisation ensures an adequate level of protection.

(4) The implementing act must provide for a periodic review mechanism.

(5) The Commission must continuously monitor developments that could affect adequacy decisions, and may repeal, amend or suspend them where the adequate level of protection is no longer ensured.

(1) In the absence of an adequacy decision, a controller or processor may only transfer personal data to a third country or international organisation if it has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies are available.

(2) The appropriate safeguards under paragraph 1 may, without requiring specific authorisation, consist of: (a) a legally binding and enforceable instrument between public authorities; (b) binding corporate rules under Art. 47; (c) standard data protection clauses adopted by the Commission; (d) standard data protection clauses adopted by a supervisory authority and approved by the Commission; (e) an approved code of conduct together with binding and enforceable commitments; or (f) an approved certification mechanism together with binding and enforceable commitments.

(1) The competent supervisory authority approves binding corporate rules in accordance with the consistency mechanism under Art. 63, provided they: (a) are legally binding, apply to and are enforced by every member of the group of undertakings, including their employees; and (b) expressly confer enforceable rights on data subjects regarding the processing of their personal data.

Any judgment of a court or decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforced if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State.

(1) In the absence of an adequacy decision or appropriate safeguards under Art. 46 (including binding corporate rules), a transfer or set of transfers may only take place under one of the following conditions: (a) the data subject has explicitly consented after being informed of the possible risks due to the absence of an adequacy decision and appropriate safeguards; (b) necessary for performance of a contract with the data subject or pre-contractual measures at their request; (c) necessary for a contract concluded in the interest of the data subject; (d) necessary for important reasons of public interest; (e) necessary for legal claims; (f) necessary to protect vital interests where the data subject is incapable of consent; (g) made from a register intended to provide information to the public and open to consultation by the public or persons with a legitimate interest, only to the extent the conditions for consultation are met in that particular case.

(2) A transfer under paragraph 1(g) may not involve the entirety of the personal data or entire categories of data contained in the register.

(1) Each Member State must provide for one or more independent public authorities responsible for monitoring the application of this Regulation, to protect the fundamental rights and freedoms of natural persons and to facilitate the free flow of data within the Union.

(2) Each supervisory authority must contribute to the consistent application of this Regulation throughout the Union.

(3) Where a Member State has more than one supervisory authority, it must designate the authority representing them in the EDPB and set out a mechanism for the others to ensure compliance with the consistency rules under Art. 60.

(1) Each supervisory authority must act with complete independence in performing its tasks and exercising its powers.

(2) Members of each supervisory authority must remain free from external influence, whether direct or indirect, and must neither seek nor take instructions from anybody.

(3) Members must refrain from any incompatible action and, during their term, must not engage in any incompatible occupation, whether gainful or not.

(1) Each supervisory authority is competent to perform the tasks and exercise the powers conferred on it under this Regulation within the territory of its own Member State.

(2) Where processing is carried out by public authorities in the exercise of the rights conferred on data subjects, the supervisory authority of the Member State concerned is competent.

(3) Supervisory authorities are not competent to supervise processing by courts acting in their judicial capacity.

(1) Without prejudice to other tasks set out in this Regulation, each supervisory authority must, within its territory: (a) monitor and enforce the application of this Regulation; (b) promote public awareness of risks, rules, safeguards and rights related to processing; (c) advise national parliament, government and other institutions on legislative measures; (d) promote awareness among controllers and processors of their obligations; (e) provide information to data subjects on exercising their rights on request; (f) handle complaints lodged by data subjects, investigate the subject matter as appropriate, and inform the complainant of progress and outcome within a reasonable period.

(1) Each supervisory authority has all of the following investigative powers: (a) to order the controller/processor to provide any information required for its tasks; (b) to carry out investigations in the form of data protection audits.

(2) Each supervisory authority has all of the following corrective powers: (a) to warn a controller/processor that intended processing is likely to infringe the Regulation; (b) to issue reprimands where processing has infringed the Regulation; (c) to order compliance with data subject requests; (d) to order processing to be brought into compliance, in a specified manner and within a specified period; (e) to order communication of a breach to the data subject; (f) to impose a temporary or definitive limitation, including a ban, on processing; (g) to order rectification, erasure or restriction under Art. 16, 17 and 18; (h) to withdraw a certification or order a certification body to do so; (i) to impose an administrative fine under Art. 83.

(3) Each supervisory authority has all of the following authorisation and advisory powers: (a) to approve standard contractual clauses under Art. 28(8) and 46(2)(d), following the consistency mechanism under Art. 63; (b) to approve binding corporate rules under Art. 47; (c) to accredit certification bodies; (d) to issue certifications; (e) to approve codes of conduct under Art. 40(5).

(1) The lead supervisory authority must cooperate with the other supervisory authorities concerned in accordance with this Article, endeavouring to reach consensus, and must exchange all relevant information with them.

(2) The lead supervisory authority may at any time request mutual assistance under Art. 61 from other supervisory authorities concerned and conduct joint operations under Art. 62, in particular to carry out investigations or monitor implementation of a measure regarding a controller or processor established in another Member State.

In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities must cooperate with each other and, where relevant, with the Commission through the consistency mechanism set out in this Section.

(1) The European Data Protection Board ("the Board") is established as a body of the Union.

(2) The Board consists of the head of one supervisory authority per Member State and the European Data Protection Supervisor, or their representatives.

(3) Where the Commission participates in Board meetings, it has no voting right.

(1) Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if they consider that processing of data concerning them infringes this Regulation.

(2) The supervisory authority with which the complaint has been lodged must inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Art. 78.

(1) Without prejudice to any other administrative or non-judicial remedy, every natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

(2) Every data subject has the right to an effective judicial remedy where the competent supervisory authority does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged under Art. 55 and 56.

(1) Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint under Art. 77, every data subject has the right to an effective judicial remedy where they consider that their rights under this Regulation have been infringed as a result of non-compliant processing.

(2) Proceedings against a controller or processor must be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has their habitual residence, unless the controller/processor is a public authority acting in the exercise of its public powers.

(1) A data subject has the right to mandate a not-for-profit body, organisation or association, properly constituted under Member State law with statutory objectives in the public interest active in the field of protecting data subjects' rights and freedoms, to exercise the rights under Art. 77, 78 and 79 on their behalf.

(2) Member States may provide that any such body, organisation or association has the right to lodge a complaint under Art. 77, and to exercise the rights under Art. 78 and 79, independently of a data subject's mandate, in that Member State.

(1) Any person who has suffered material or non-material damage as a result of an infringement of this Regulation has the right to receive compensation from the controller or processor for the damage suffered.

(2) Any controller involved in processing is liable for damage caused by processing that infringes this Regulation. A processor is liable only where it has not complied with obligations specifically directed to processors, or where it has acted outside or contrary to lawful controller instructions.

(3) A controller or processor is exempt from liability under paragraph 2 if it proves it is not in any way responsible for the event giving rise to the damage.

(4) Where more than one controller or processor is involved in the same processing and is liable for damage, each is held liable for the entire damage in order to ensure effective compensation of the data subject.

(5) A controller/processor that has paid full compensation may subsequently claim back from other controllers/processors involved the part of the compensation corresponding to their part of responsibility for the damage.

(1) Each supervisory authority must ensure that the imposition of administrative fines for infringements of this Regulation under this Article is, in each individual case, effective, proportionate and dissuasive.

(2) Fines are imposed in addition to, or instead of, measures under Art. 58(2)(a)–(h) and (j). When deciding on a fine and its amount, due regard must be given in each case to factors including: (a) the nature, gravity and duration of the infringement, the number of data subjects affected and the level of damage; (b) intentional or negligent character; (c) mitigating action taken by the controller/processor; (d) degree of responsibility, taking account of Art. 25 and 32 measures; (e) relevant previous infringements; (f) degree of cooperation with the supervisory authority; (g) categories of data affected; (h) how the infringement became known to the authority; (i) compliance with previously ordered measures; (j) adherence to approved codes of conduct or certification; (k) any other aggravating or mitigating factor.

(3) If a controller or processor intentionally or negligently commits several infringements for the same or linked processing operations, the total fine must not exceed the amount for the gravest infringement.

(4) Infringements of controller/processor obligations under Art. 8, 11, 25–39, 42 and 43 are subject to fines of up to €10,000,000, or up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher.

(5) Infringements of the processing principles and consent conditions (Art. 5, 6, 7, 9), data subject rights (Art. 12–22), third-country transfer rules (Art. 44–49), Member State law obligations under Chapter IX, or non-compliance with a supervisory authority order, are subject to fines of up to €20,000,000, or up to 4% of total worldwide annual turnover, whichever is higher.

(6) Non-compliance with an order of the supervisory authority under Art. 58(2) is subject to fines of up to €20,000,000, or up to 4% of total worldwide annual turnover, whichever is higher.

(7) Each Member State may lay down rules on whether and to what extent administrative fines may be imposed on public authorities and bodies.

(8) The exercise of these powers must be subject to appropriate procedural safeguards, including effective judicial remedy and due process.

(9) Where a Member State's legal system does not provide for administrative fines, the article may be applied so that the fine is initiated by the competent supervisory authority and imposed by the competent national courts.

(1) Member States must lay down the rules on other penalties applicable to infringements of this Regulation, in particular for infringements not subject to administrative fines under Art. 83, and must take all measures necessary to ensure their implementation. Such penalties must be effective, proportionate and dissuasive.

(2) Each Member State must notify the Commission by 25 May 2018 of the relevant provisions adopted under paragraph 1, and without delay of any subsequent amendments.

(1) Member States must by law reconcile the right to the protection of personal data with the right to freedom of expression and information, including processing for journalistic purposes and for academic, artistic or literary expression.

(2) For processing carried out for journalistic purposes or for academic, artistic or literary expression, Member States must provide exemptions or derogations from Chapters II, III, IV, V, VI, VII and IX where necessary to reconcile the right to data protection with freedom of expression and information.

(1) Member States may, by law or collective agreements, provide for more specific rules to ensure the protection of rights and freedoms regarding processing of employees' personal data in the employment context, in particular for recruitment, performance of the employment contract, management, planning and organisation of work, equality and diversity, health and safety, protection of employer or customer property, and for exercising and enjoying employment-related rights and benefits, and for termination of the employment relationship.

(2) Such rules must include suitable and specific measures to safeguard human dignity, legitimate interests and fundamental rights, with particular regard to transparency, transfers within a group of undertakings, and monitoring systems at the workplace.

(1) Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes must be subject to appropriate safeguards for the rights and freedoms of the data subject, including technical and organisational measures ensuring data minimisation, in particular pseudonymisation, and, wherever these purposes can be fulfilled through further processing of anonymised data, that approach must be used.

(2) Where personal data are processed for scientific/historical research or statistical purposes, Member States may provide derogations from the rights under Art. 15, 16, 18 and 21, subject to the paragraph 1 conditions, where such rights are likely to render impossible or seriously impair achievement of the specific purposes, and such derogations are necessary for fulfilling those purposes.

(1) The power to adopt delegated acts is conferred on the Commission subject to the conditions set out in this Article.

(2) The delegation of power under Art. 12(8) and Art. 43(8) is conferred on the Commission for an indeterminate period from 24 May 2016.

(3) The delegation under Art. 12(8) and Art. 43(8) may be revoked at any time by the European Parliament or the Council.

(1) The Commission is assisted by a committee, which is a committee within the meaning of Regulation (EU) No 182/2011.

(2) Where reference is made to this paragraph, Art. 5 of Regulation (EU) No 182/2011 applies.

(3) Where reference is made to this paragraph, Art. 8 of Regulation (EU) No 182/2011, in conjunction with Art. 5, applies.

(1) Directive 95/46/EC is repealed with effect from 25 May 2018.

(2) References to the repealed Directive are construed as references to this Regulation. References to the Working Party on the Protection of Individuals under Art. 29 of Directive 95/46/EC are construed as references to the European Data Protection Board established by this Regulation.

This Regulation does not impose additional obligations on natural or legal persons regarding processing in connection with the provision of publicly available electronic communications services in public communication networks in the Union, in relation to matters for which they are already subject to specific obligations under Directive 2002/58/EC pursuing the same objective.

International agreements involving the transfer of personal data to third countries or international organisations, including appropriate safeguards for data subjects, concluded by Member States prior to 24 May 2016 and which comply with Union law as applicable prior to that date, remain in force until amended, replaced or revoked.

(1) By 25 May 2020, and every four years thereafter, the Commission must submit a report on the evaluation and review of this Regulation to the European Parliament and the Council; the reports must be made public.

(2) In the course of the evaluations and reviews under paragraph 1, the Commission must in particular examine the application and functioning of Chapter V on transfers of personal data to third countries or international organisations.

(1) This Regulation enters into force on the twentieth day following its publication in the Official Journal of the European Union.

(2) It applies from 25 May 2018.