Docs

Appearance

GDPR — Regulation (EU) 2016/679 ​

GDPR illustration

The General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. It gives rules on “the protection of natural persons with regard to the processing of personal data” and rules on “the free movement of personal data” (Article 1(1)).

Article 3 sets the territorial scope of the GDPR. The GDPR applies to processing “in the context of the activities of an establishment of a controller or a processor in the Union”. It also applies to some processing by a controller or processor that is not established in the Union (Article 3).

For GDPR scope, obligations, enforcement, and work in Modulos, see these five pages: Where the GDPR applies, Principles and rights of data subjects, Obligations of controllers and processors, Supervisory authorities, remedies, and penalties, and GDPR Frameworks in Modulos.

Dates and rules of the GDPR ​

The GDPR is in the Official Journal of the European Union, OJ L 119, 4.5.2016, p. 1. Its full name is “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)”. One corrigendum corrects the Regulation: OJ L 127, 23.5.2018, p. 2.

The GDPR entered into force on 24 May 2016, “the twentieth day following that of its publication in the Official Journal of the European Union” (Article 99(1)). It applies from 25 May 2018 (Article 99(2)). It is “binding in its entirety and directly applicable in all Member States” (Article 99).

Article 94(1) repeals Directive 95/46/EC with effect from 25 May 2018. Article 94(2) adds: “References to the repealed Directive shall be construed as references to this Regulation”. Article 94(2) also gives this rule: “References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC shall be construed as references to the European Data Protection Board established by this Regulation”. On this page, “the Board” is the European Data Protection Board.

The GDPR lets Union or Member State law add rules or restrict rules in some areas. Each area is on a different page:

  • Article 8(1) — Member States can set a “lower age” than 16, but not below 13, for a child’s consent to information society services, on the conditions of Articles 7 and 8.
  • Article 9(4) — Member States “may maintain or introduce further conditions, including limitations” for genetic data, biometric data, and data concerning health (Article 9).
  • Article 23(1) — Union or Member State law can restrict some GDPR rights and obligations by a legislative measure, on the conditions of Article 23.
  • Article 37(4) — when Article 37(1) does not apply, the controller or the processor “may or, where required by Union or Member State law shall, designate a data protection officer” (Articles 37 to 39).
  • Chapter IX — “Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information” (Article 85(1)). Member States can also set “more specific rules” for the processing of personal data “in the employment context” (Article 88(1)).

Regulation (EU) 2025/2518 adds procedural rules for supervisory authorities in cross-border processing, from 2 April 2027 (its Article 37(2)). Its Article 36 applies its Chapters III and IV to “ex officio investigations opened after 2 April 2027” and to “complaint-based investigations where the complaint was lodged after 2 April 2027”. It applies its Chapters V and VI to “all cases referred to dispute resolution under Article 65 and urgency procedure under Article 66(2) and (3) of Regulation (EU) 2016/679 after 2 April 2027”. See Supervisory authorities.

Guidance and case law ​

The recitals of the GDPR come before its Articles and give the purpose of the rules. They help you to read the Articles, but they do not set obligations.

The European Data Protection Board has the task to “issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation” (GDPR Article 70(1)(e)). This guidance is not law. The obligations of controllers and processors are in the GDPR and in the Union and Member State law that applies. The guidance of a supervisory authority is also not law.

On 25 May 2018, the Board endorsed the GDPR guidelines of the Article 29 Working Party (Endorsement 1/2018). The Board’s Endorsed WP29 Guidelines page marks WP250 rev.01 on breach notification as “superseded by Guidelines 9/2022 on personal data breach notification under GDPR”. The page shows no replacement for these two guidelines:

  • WP251rev.01, “Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679”
  • WP248 rev.01, the guidelines on data protection impact assessment (DPIA).

The Board guidelines on breach notification (9/2022) and on Article 25 (4/2019) are on the page Obligations of controllers and processors.

These judgments of the Court of Justice of the European Union are on other pages:

  • C-131/12, Google Spain (13 May 2014): processing “in the context of the activities of an establishment”, a judgment on Article 4(1)(a) of Directive 95/46/EC (Article 3(1)).
  • C-634/21, SCHUFA (7 December 2023), and C-203/22, Dun & Bradstreet Austria (27 February 2025): Article 22 and Article 15(1)(h) (Article 22).
  • C-311/18, Schrems II (16 July 2020): transfers on standard data protection clauses (Articles 44 to 49).

GDPR structure ​

Regulation (EU) 2016/679 (GDPR)
Chapter I — General provisionsArticles 1–4: subject-matter and objectives, material scope, territorial scope, definitions
Chapter II — PrinciplesArticles 5–11: principles, lawfulness of processing, consent, consent of a child, special categories, criminal convictions and offenses, processing that does not need identification
Chapter III — Rights of the data subjectArticles 12–23: transparency, information and access, rectification and erasure, restriction, data portability, the right to object, automated individual decision-making, restrictions
Chapter IV — Controller and processorArticles 24–43: general obligations, security of personal data, data protection impact assessment and prior consultation, data protection officer, codes of conduct and certification
Chapter V — Transfers of personal data to third countries or international organisationsArticles 44–50: general principle, adequacy decisions, appropriate safeguards, binding corporate rules, judgments of third countries, derogations, international cooperation
Chapter VI — Independent supervisory authoritiesArticles 51–59: independent status, competence, tasks, and powers
Chapter VII — Cooperation and consistencyArticles 60–76: cooperation and the “one-stop-shop mechanism”, the consistency mechanism, the European Data Protection Board
Chapter VIII — Remedies, liability and penaltiesArticles 77–84: complaints, judicial remedies, representation of data subjects, compensation and liability, administrative fines, other penalties
Chapter IX — Provisions relating to specific processing situationsArticles 85–91: freedom of expression and information, public access to official documents, national identification number, employment, archiving and research, secrecy, churches and religious associations
Chapter X — Delegated acts and implementing actsArticles 92–93: exercise of the delegation, committee procedure
Chapter XI — Final provisionsArticles 94–99: repeal of Directive 95/46/EC, relationship with other acts, Commission reports, entry into force and application

Use these pages for the GDPR provisions below:

For the other provisions of Chapters IX to XI, see the GDPR, Articles 85 to 99.

Supervisory authorities, remedies, and fines ​

The supervisory authorities enforce the GDPR, data subjects have remedies, and Chapter VIII sets the penalties and the maximum fines (Supervisory authorities, remedies, and penalties).

The Digital Omnibus proposal ​

The Digital Omnibus is a proposal of the European Commission of 19 November 2025 (COM(2025) 837, procedure 2025/0360(COD)). As of October 2026, the Digital Omnibus is not law. The GDPR applies without these changes until a regulation that amends the GDPR applies. Article 3 of the proposal amends the GDPR. The proposal has these changes for AI:

  • Article 4(1) — the proposal adds this rule: “Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity.” It also adds: “Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.”
  • Article 9 — the proposal adds two points to Article 9(2) and a new Article 9(5):
    • Point (k) is for “processing in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, subject to the conditions referred to in paragraph 5”.
    • For point (k), Article 9(5) has this rule: “appropriate organisational and technical measures shall be implemented to avoid” “the collection and otherwise processing of special categories of personal data”.
    • Article 9(5) adds: “Where, despite the implementation of such measures, the controller identifies special categories of personal data in the datasets used for training, testing or validation or in the AI system or AI model, the controller shall remove such data.”
    • Article 9(5) also adds: “If removal of those data requires disproportionate effort, the controller shall in any event effectively protect without undue delay such data from being used to produce outputs, from being disclosed or otherwise made available to third parties.”
    • Point (l) is for this processing: “processing of biometric data is necessary for the purpose of confirming the identity of a data subject (verification), where the biometric data or the means needed for the verification is under the sole control of the data subject”.
  • Article 22 — the proposal replaces Article 22(1) and (2) with these rules:
    • “A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:”
    • “(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;”
    • “(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or”
    • “(c) is based on the data subject's explicit consent.”
  • Article 33 — the proposal replaces Article 33(1) and adds paragraphs:
    • The new Article 33(1) applies only to “a personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons”.
    • In the proposal, the controller must notify such a breach “without undue delay and, where feasible, not later than 96 hours after having become aware of it”.
    • In the proposal, the controller must send this notification “via the single-entry point established pursuant to Article 23a of Directive (EU) 2022/2555” to “the supervisory authority competent in accordance with Article 55 and Article 56”.
    • “Where the notification to the supervisory authority is not made within 96 hours, it shall be accompanied by reasons for the delay.”
    • “Until the establishment of the single-entry point pursuant to Article 23a of Directive (EU) 2022/2555, controllers shall continue to notify personal data breaches directly to the competent supervisory authority in accordance with Article 55 and Article 56” (new Article 33(1a)).
    • The Board prepares a proposal for “a common template for notifying a personal data breach” (new Article 33(6)).
    • The Board also prepares a proposal for “a list of the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of a natural person” (new Article 33(6)).
  • Article 35 — the proposal replaces Article 35(4) to (6) and adds paragraphs:
    • The Board prepares a proposal for “a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment” (new Article 35(4)).
    • The Board prepares a proposal for “a list of the kind of processing operations for which no data protection impact assessment is required” (new Article 35(5)).
    • The Board prepares a proposal for “a common template and a common methodology for conducting data protection impact assessments” (new Article 35(6)).
    • The Commission “is empowered to adopt them by way of an implementing act” (new Article 35(6a)).
    • “Lists of the kind of processing operations which are subject to the requirement for a data protection impact assessment and of the kind of processing operations for which no data protection impact assessment is required established and made public by supervisory authorities remain valid until the Commission adopts the implementing act referred to in paragraph 6a” (new Article 35(6c)).
  • New Article 88a — “Storing of personal data, or gaining of access to personal data already stored, in the terminal equipment of a natural person” is permitted only with consent, or on the conditions of Article 88a(2) and (3).
  • New Article 88b — the proposal sets these obligations for controllers:
    • Their “online interfaces” let data subjects give consent “through automated and machine-readable means”, if “the conditions for consent laid down in this Regulation are fulfilled” (Article 88b(1)(a)).
    • Their “online interfaces” let data subjects “decline a request for consent and exercise the right to object pursuant to Article 21(2) through automated and machine-readable means” (Article 88b(1)(b)).
    • “Controllers shall respect the choices made by data subjects in accordance with paragraph 1” (Article 88b(2)).
    • “Paragraphs 1 and 2 shall not apply to controllers that are media service providers when providing a media service” (Article 88b(3)).
  • New Article 88c — the proposal adds this rule for AI:
    • “Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate”.
    • The rule has this limit: “except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.
    • “Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject”. These include “providing data subjects with an unconditional right to object to the processing of their personal data”.

The proposal also amends Articles 5(1)(b), 12(5), 13, 57, 64, and 70. It also adds an Article 41a on data that results from pseudonymization.

The GDPR and the EU AI Act ​

The EU AI Act, Regulation (EU) 2024/1689, does not replace the GDPR. In its Article 2(7), Union law on the protection of personal data “applies to personal data processed in connection with the rights and obligations laid down in this Regulation”. Article 2(7) also gives this rule: “Without prejudice to Articles 4a and 59 of this Regulation, this Regulation shall not affect Regulation (EU) 2016/679”.

Each Regulation applies in its scope. The GDPR sets obligations for controllers and processors (GDPR Articles 2 and 3). The EU AI Act sets obligations for, for example, the “provider” and the “deployer” of an AI system (EU AI Act Article 2).

Some provisions of the two Regulations can apply together. Each of these items is on a different page:

  • Article 22 GDPR and EU AI Act Articles 14, 26(2), and 86 can apply to the same decision (Article 22 and the EU AI Act).
  • Article 9 GDPR and EU AI Act Article 4a can apply to the same processing of special categories of personal data (Article 9).
  • EU AI Act Articles 26(9) and 27(4) refer to the DPIA of GDPR Article 35 (Article 35).
  • Article 33 GDPR and EU AI Act Article 73 on the “Reporting of serious incidents” are different obligations, and they can apply to the same incident (Article 33).

To compare the two Regulations, see the EU AI Act and the GDPR compared.

The GDPR in Modulos ​

Modulos has two Frameworks with the name “GDPR”: OFF-11 at the Organization level and MFF-12 at the AI System level. MFF-12 has Requirements for Articles 15 to 22, 25, and 32. OFF-11 has Requirements for Articles 5 to 14, 23, 24, 26 to 31, 33 to 47, 49, and 51 to 99. The Frameworks have no Requirements for Articles 1 to 4, 48, or 50. For the decisions, the steps, the GDPR Role tags, and the Requirement table, see GDPR Frameworks in Modulos.

Where to go next ​

Where the GDPR applies

Articles 1 to 4 and 27: the material scope, the territorial scope, the representative, and the controller and the processor.

Principles and rights of data subjects

The principles, the legal basis of processing, consent, special categories, the rights of data subjects, and Article 22.

Obligations of controllers and processors

Accountability, processors, records, security, breach notification, the DPIA, the data protection officer, and transfers.

Supervisory authorities, remedies, and penalties

Chapters VI to VIII: the supervisory authorities, the remedies of data subjects, liability, and the administrative fines.

GDPR Frameworks in Modulos

The Frameworks OFF-11 and MFF-12, the decisions, the steps, and the Requirement table.

The EU AI Act and the GDPR compared

How the GDPR and the EU AI Act apply together.

GDPR FAQ ​

The page GDPR FAQ gives short rules about the GDPR, each with the section that gives the full rule.

Sources of this page ​

  • GDPR, Regulation (EU) 2016/679, OJ L 119, 4.5.2016, p. 1, and its corrigendum, OJ L 127, 23.5.2018, p. 2 (EUR-Lex). Articles used: 1(1), 2, 3, 8(1), 9, 15(1)(h), 22, and 23(1). Also Articles 33, 35, 37(1) and (4), 70(1)(e), 85(1), 88(1), 94, and 99. Also recitals 127 and 128.
  • Regulation (EU) 2025/2518 of 26 November 2025 “laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679”, OJ L, 12.12.2025: Articles 1, 36, and 37(2) (EUR-Lex).
  • COM(2025) 837, the Digital Omnibus proposal of the European Commission of 19 November 2025, procedure 2025/0360(COD): Article 3 (EUR-Lex).
  • EU AI Act, Regulation (EU) 2024/1689, consolidated text of 27 July 2026: Articles 2(7), 4a, 14, 26(2), 26(9), 27(4), 73, and 86 (EUR-Lex).
  • EDPB Endorsement 1/2018 of 25 May 2018, and the Endorsed WP29 Guidelines page of the Board: WP248 rev.01, WP250 rev.01, and WP251rev.01 (EDPB).
  • C-131/12, Google Spain and Google, judgment of the Court of Justice of 13 May 2014 (EUR-Lex).
  • C-311/18, Schrems II, judgment of the Court of Justice of 16 July 2020 (EUR-Lex).
  • C-634/21, SCHUFA Holding (Scoring), judgment of the Court of Justice of 7 December 2023: the operative part (EUR-Lex).
  • C-203/22, Dun & Bradstreet Austria, judgment of the Court of Justice of 27 February 2025: the operative part, point 1 (EUR-Lex).

Disclaimer

This page gives general information. It is not legal advice.