Frequently asked questions about the GDPR

Each item gives the short GDPR rule and refers to the full rule.

Disclaimer

This page gives general information. It is not legal advice.

What is the GDPR and when does it apply?

The GDPR is Regulation (EU) 2016/679 of 27 April 2016. It applies from 25 May 2018, and it is “binding in its entirety and directly applicable in all Member States” (Article 99). Union or Member State law can add rules or restrict rules in some areas. Examples are Article 23(1) restrictions and Article 8(1) rules for consent to “the offer of information society services directly to a child”. See Dates of the GDPR.

Who must comply with GDPR?

Controllers and processors must comply when their processing is in the material scope of GDPR Article 2 and the territorial scope of Article 3:

• Article 2(1): processing “wholly or partly by automated means”, and other processing of personal data in a filing system or “intended to form part of a filing system”.
• Article 2(2): four types of processing to which the GDPR does not apply:
  • (a) processing “in the course of an activity which falls outside the scope of Union law”.
  • (b) processing “by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU”.
  • (c) processing “by a natural person in the course of a purely personal or household activity”.
  • (d) processing “by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security”.
• Article 2(3): other rules for the “Union institutions, bodies, offices and agencies”.
• Article 3(1): processing “in the context of the activities of an establishment” in the Union, “regardless of whether the processing takes place in the Union or not”.
• Article 3(2): processing related to offering goods or services to data subjects in the Union, or to monitoring their behavior there, by a controller or processor not established in the Union.
• Article 3(3): a controller not established in the Union, “in a place where Member State law applies by virtue of public international law”.

See Article 2 and Article 3.

What are the GDPR principles?

Article 5(1) sets six principles for the processing of personal data: “lawfulness, fairness and transparency”, “purpose limitation”, “data minimisation”, “accuracy”, “storage limitation”, and “integrity and confidentiality”. Article 5(2) adds “accountability”: “The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1”. Article 5 does not identify records that the controller must keep for each principle. See Article 5.

What does Article 22 say about AI and automated decisions?

GDPR Article 22(1) gives data subjects a right against decisions “based solely on automated processing, including profiling”, with legal effects or similarly significant effects. The Court of Justice reads Article 22(1) as “a prohibition in principle” (C-634/21, paragraph 52). These conditions apply:

• Article 22(2): three exceptions, which are contract necessity, Union or Member State law with suitable measures, and explicit consent.
• Article 22(3): for contract necessity and explicit consent, as a minimum, the right “to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision”.
• Article 22(4): no special categories of personal data, unless Article 9(2)(a) or (g) applies with suitable measures.
• C-634/21: the “automated establishment” by a “credit information agency” of a “probability value” about a person’s “ability to meet payment commitments in the future” is “automated individual decision-making” where a third party “draws strongly” on it “to establish, implement or terminate a contractual relationship with that person”.

See SCHUFA, operative part and Article 22 conditions.

When does GDPR require a DPIA?

The controller must do a data protection impact assessment (DPIA) before processing that is “likely to result in a high risk” to natural persons' rights and freedoms (GDPR Article 35(1)). These conditions apply:

• Article 35(1): the “nature, scope, context and purposes” of the processing, “in particular using new technologies”.
• Article 35(3): three types of processing for which a DPIA is necessary “in particular”. A DPIA can also be necessary for other processing.
• Article 35(2): the advice of the data protection officer (DPO), where designated.
• Article 35(4): the “list of the kind of processing operations” of each supervisory authority.
• Article 35(10): an exception for some processing in point (c) or (e) of Article 6(1), unless Member States “deem it to be necessary”.

See Article 35 for these conditions.

What are the GDPR breach notification timelines?

The controller must notify the competent supervisory authority without undue delay and, “where feasible”, “not later than 72 hours after having become aware of it” (GDPR Article 33(1)). The exception is a breach “unlikely to result in a risk to the rights and freedoms of natural persons”. A notification after 72 hours must give “reasons for the delay”. Processors must notify controllers without undue delay after they become aware of a breach (33(2)). Controllers must record each breach (33(5)).

Article 34 adds communication to data subjects without undue delay for high-risk breaches, with exceptions and the authority’s decisions in paragraphs 3 and 4. See Articles 33 and 34.

What are the GDPR fines?

GDPR Article 83 sets two maximum levels of administrative fines. The infringement determines the level:

• “10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher” (83(4)).
• “20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher” (83(5) and (6)).

A fine can come “in addition to, or instead of” the measures in Article 58(2), points (a) to (h) and (j). The supervisory authority examines the items of Article 83(2) when it is “deciding whether to impose an administrative fine and deciding on the amount of the administrative fine”. Member States can set rules for fines on public authorities and bodies (83(7)), and they set other penalties (84(1)). See Administrative fines and other penalties.

Can personal data be transferred outside the EU under the GDPR?

Yes, but only on the conditions of GDPR Chapter V. These conditions apply to controllers and processors, also for onward transfers (Article 44). A transfer is permitted only with one of these:

• An adequacy decision of the Commission (Article 45).
• Without an adequacy decision, “appropriate safeguards”, with “enforceable data subject rights and effective legal remedies” (Article 46).
• Without an adequacy decision or appropriate safeguards, an Article 49 derogation on its conditions.

With standard data protection clauses, the controller or processor checks the law of the third country “on a case-by-case basis”. If it is “not able to take adequate additional measures to guarantee such protection”, it must “suspend or end the transfer” (C-311/18, paragraphs 134 and 135). The US adequacy decision applies only to “commercial organisations participating in the EU-US Data Privacy Framework”. See Articles 44 to 49.

How does GDPR interact with the EU AI Act?

The GDPR and EU AI Act each apply in their scope. EU AI Act Article 2(7) “shall not affect Regulation (EU) 2016/679”, “Without prejudice to Articles 4a and 59”. The GDPR sets obligations for controllers and processors, and the EU AI Act sets obligations for, for example, “providers” and “deployers”. The connections include:

• Decisions: GDPR Article 22 and EU AI Act Articles 14, 26(2), and 86.
• Incidents: GDPR Article 33 and EU AI Act Article 73.
• The data protection impact assessment: EU AI Act Articles 26(9) and 27(4).
• Special categories of personal data: EU AI Act Article 4a, with the GDPR.

See The GDPR and the EU AI Act.

Will the Digital Omnibus change the GDPR?

The Digital Omnibus is a proposal of the European Commission of 19 November 2025 (COM(2025) 837). As of October 2026, it is not law, and the GDPR applies without its changes. For AI, the proposal has changes to Article 4(1) on personal data, Article 9 on special categories, and Article 22 on automated individual decision-making. It also has changes to Article 33 on breach notification and Article 35 on the data protection impact assessment. It adds Articles 88a to 88c. See The Digital Omnibus proposal.

Which Modulos Frameworks cover the GDPR?

Modulos gives the GDPR as two Frameworks with the name GDPR: OFF-11 for the Organization, and MFF-12 for each AI System. MFF-12 has the Requirements for Articles 15 to 22, 25, and 32. OFF-11 has the Requirements for the other Articles from 5 to 99, but not for Articles 48 and 50.

The GDPR Frameworks have no Requirement for Articles 1 to 4. You make the scope and controller or processor decisions before you add these Frameworks. You add OFF-11 to your organization AI System. If you do not have an organization AI System, contact Modulos. See The two GDPR Frameworks.

What does Article 2 exclude from GDPR scope?

The GDPR does not apply to this processing (Article 2(2)):

• “in the course of an activity which falls outside the scope of Union law” (a).
• By Member States in “activities which fall within the scope of Chapter 2 of Title V of the TEU” (b).
• By a natural person in a purely personal or household activity (c).
• By competent authorities for the law enforcement purposes of Article 2(2)(d) (d).

In recital 18, the GDPR applies to “controllers or processors which provide the means for processing personal data for such personal or household activities”. Directive (EU) 2016/680 applies to point (d), but GDPR can apply to other purposes of those authorities. Article 2(3) gives different rules for “Union institutions, bodies, offices and agencies”. See Article 2 for the conditions.

When does GDPR apply to non-EU controllers and processors?

GDPR Article 3(2) applies to controllers or processors not established in the Union if they process personal data of data subjects in the Union, related to:

• Offering goods or services to them, “irrespective of whether a payment of the data subject is required” (a).
• Monitoring their behavior in the Union (b).

Recital 23 gives the interpretation of the first condition. Where Article 3(2) applies, the controller or processor must designate “in writing” a representative in the Union (Article 27(1)). Article 27(2) gives exceptions for some occasional processing and for “a public authority or body”. Articles 3(1) and 3(3) also give rules for a Union establishment and public international law. See Article 3 and Article 27 conditions.

How does GDPR define 'personal data' and 'processing'?

In GDPR Article 4(1), personal data are “any information relating to an identified or identifiable natural person”. That natural person is the data subject. In Article 4(2), processing is “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means”. Recital 26 does not apply data protection principles to “anonymous information”. In recital 26, personal data after pseudonymization that “could be attributed to a natural person by the use of additional information” are information on an identifiable natural person (Identifiable natural person). See Article 4.

What is the difference between controller, joint controller, and processor?

A controller determines the purposes and means of processing, “alone or jointly with others” (GDPR Article 4(7)). Where Union or Member State law determines those purposes and means, that law can identify the controller or “the specific criteria for its nomination”. A processor processes “on behalf of the controller” (4(8)).

Joint controllers determine purposes and means together, with the arrangement obligations and law exception in Article 26. A processor that infringes GDPR by determining purposes and means is a controller for that processing (28(10)). Roles follow each processing activity. See Controllers and processors and Article 26.

What is 'profiling' under GDPR Article 4(4)?

In GDPR Article 4(4), profiling is: “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person”. Profiling is a type of processing, and it is not a condition for the GDPR to apply. Articles 13, 14, 15, 21, 22, and 35 have rules for profiling. See Profiling.

What are the six lawful bases in Article 6?

GDPR Article 6(1) makes processing lawful “only if and to the extent that” one or more of these apply:

• (a) consent for one or more “specific purposes”.
• (b) necessity for a contract with the data subject, or for steps before a contract at the data subject's request.
• (c) necessity for a legal obligation of the controller.
• (d) necessity “in order to protect the vital interests of the data subject or of another natural person”.
• (e) necessity for a task in the public interest or in the exercise of official authority.
• (f) necessity for the legitimate interests of the controller or a third party, “except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”.

For points (c) and (e), the law in Article 6(3) is necessary. Public authorities cannot use (f) for their tasks. See Article 6.

When does GDPR require explicit consent vs ordinary consent?

Explicit consent is one possible exception for special categories (GDPR Article 9(2)(a)). It is also an exception for decisions based solely on automated processing (22(2)(c)) and transfers (49(1)(a)). Each has conditions:

• Union or Member State law can keep the Article 9 prohibition.
• Article 22 adds safeguards and restrictions in paragraphs 3 and 4.
• Article 49(1)(a) applies only without an adequacy decision or appropriate safeguards, and the data subject must first get information on “the possible risks of such transfers”. Public authorities cannot use it “in the exercise of their public powers” (49(3)).

All consent must comply with Article 4(11), which gives no definition of explicit consent. See Consent, Article 22, and transfers.

What is the difference between Article 13 and Article 14 information duties?

GDPR Article 13 applies when the controller collects personal data from the data subject. Article 14 applies when the controller gets the data from a different source, and adds the categories of personal data and their source. These conditions apply:

• Article 13(4): Article 13 does not apply where the data subject “already has the information”.
• Article 14(3): the controller gives the information “within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed”. If the controller uses the data to communicate with the data subject, or gives the data to a different recipient, it gives the information not after the first communication or the first disclosure.
• Article 14(5): four exceptions:
  • (a) the data subject “already has the information”.
  • (b) the controller cannot give the information, or to give it “would involve a disproportionate effort” or is “likely to render impossible or seriously impair the achievement of the objectives of that processing”. Then the controller must use “appropriate measures to protect the data subject's rights and freedoms and legitimate interests”.
  • (c) the “obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests”.
  • (d) an obligation of professional secrecy in Union or Member State law.

See Articles 12 to 14 for each condition.

How does the GDPR Article 22 right interact with the EU AI Act?

GDPR Article 22 and EU AI Act human oversight and “Right to explanation of individual decision-making” rules can apply to the same decision. Their limits are different:

• Articles 14 and 26(2): human oversight obligations, which apply on the dates of the EU AI Act (Digital Omnibus on AI).
• Article 86(1): “clear and meaningful explanations” from the “deployer” for decisions from the output of Annex III high-risk AI systems, but not point 2. The conditions include legal effects or similarly significant effects that the person thinks have “an adverse impact on their health, safety or fundamental rights”.
• Article 86(2): exceptions or restrictions from Union law or Member State law that complies with Union law.
• Article 86(3): only where Union law does not give the right in other provisions.

See Article 22 and the EU AI Act.

At what age can a child consent under the GDPR?

At 16: for “the offer of information society services directly to a child” on consent, the processing is lawful if the child is “at least 16 years old” (Article 8(1)). Below 16, the processing is lawful only with consent “given or authorised by the holder of parental responsibility over the child”. A Member State can set “a lower age” by law, but “not below 13 years”, thus the minimum can be different in each Member State. The controller must make “reasonable efforts to verify” this consent (Article 8(2)). See Articles 7 and 8.

What is the difference between Article 33 and Article 34 breach notification?

GDPR Article 33 gives rules for notification to supervisory authorities. Article 34 gives rules for communication to data subjects without undue delay for breaches “likely to result in a high risk” to natural persons' rights and freedoms. These Article 34 conditions apply:

• Article 34(2): “clear and plain language” and the minimum information.
• Article 34(3)(a): no communication if the controller has “implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach”. These measures include “in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption”.
• Article 34(3)(b): no communication if subsequent measures make the high risk “no longer likely to materialise”.
• Article 34(3)(c): if communication “would involve disproportionate effort”, “there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner”.
• Article 34(4): the authority can tell the controller to communicate, or find that a condition of Article 34(3) applies.

See Article 34 and the Article 33 time limits, exceptions, and processor obligation.

What does Article 25 data protection by design and by default require?

The controller must apply “appropriate technical and organisational measures” when it determines the “means for processing” and during processing (GDPR Article 25(1)). The measures must apply data protection principles and the necessary safeguards. The controller must select the measures with these items (Article 25(1)): the state of the art, the cost of implementation, the “nature, scope, context and purposes of processing”, and the risks to the rights and freedoms of natural persons.

By default, only personal data necessary for each “specific purpose” can be processed (25(2)). The obligation applies to the quantity, processing, storage periods, and access. An approved certification mechanism can help demonstrate compliance (25(3)). See Article 25 for each condition.

What does Article 28 require for processor contracts?

GDPR Article 28 makes it necessary to have a contract or other legal act in Union or Member State law, binding the processor to the controller. It must be “in writing, including in electronic form” (28(9)). Check:

• The information about processing, obligations, law exceptions, and the obligation to report an instruction that infringes data protection law (28(3)).
• Written authorization of the controller before the processor engages another processor. With a general written authorization, the processor must tell the controller about “any intended changes concerning the addition or replacement of other processors”, and the controller has “the opportunity to object” (28(2)).
• The same obligations for another processor and the initial processor’s full liability if the other processor does not comply (28(4)).

See Article 28 for these conditions and the standard contractual clauses in paragraphs 6 to 8.

Who must appoint a DPO under GDPR?

Controllers and processors must designate a data protection officer (DPO) in the conditions of GDPR Article 37(1):

• A public authority or body, but not “courts acting in their judicial capacity” (a).
• Core activities with “regular and systematic monitoring of data subjects on a large scale” (b).
• Core activities with large-scale processing of Article 9 special categories or Article 10 data about criminal convictions (c).

Other designation is permitted or can be necessary by Union or Member State law (37(4)). Paragraphs 2 and 3 give conditions for one DPO for more than one organization. Paragraphs 5 to 7 give conditions on “expert knowledge”, designation, and contact information. See Articles 37 to 39.

When does Article 36 prior consultation apply?

The controller must consult the supervisory authority before processing if its data protection impact assessment (DPIA) shows “a high risk in the absence of measures taken by the controller to mitigate the risk” (GDPR Article 36(1)). These conditions apply:

• Article 36(2): if the authority thinks the processing “would infringe this Regulation”, it gives written advice to the controller and, where applicable, to the processor in a period of “up to eight weeks of receipt of the request for consultation”. It can extend this period “by six weeks”, and it tells the controller and, where applicable, the processor about the extension “within one month of receipt of the request for consultation”, with the “reasons for the delay”. The periods can stop until the authority gets the information that it requests. The authority can also use its Article 58 “powers”.
• Article 36(3): the information that the controller gives to the authority.
• Article 36(5): Member State law for tasks in the public interest.

See Article 36 for the conditions.

How does Modulos handle GDPR scope decisions?

You make GDPR scope and controller or processor decisions before you add OFF-11 and MFF-12. These Frameworks have no Requirement for Articles 1 to 4. Examine if Articles 2 and 3 apply to your processing. Then identify your role for each processing activity. The Article 27 representative is in ORF-235.

Each Requirement has the GDPR Role tag “Controller”, and MRF-242, ORF-235 to ORF-239, and ORF-243 to ORF-255 also have the tag “Processor”. Modulos wants to use these tags in a new release. The purpose is to remove a Requirement from the scope for a role that the organization does not have. See Decisions before you add the Frameworks and GDPR Role tags.

Where do DPIAs and breach reports live in Modulos?

In Modulos, OFF-11 holds the Requirements for a data protection impact assessment (DPIA) and breaches, on the organization AI System. The unit of a DPIA is a type of processing, not an AI System (Article 35(1)). See Requirements of the GDPR Frameworks.

How does GDPR rollout coordinate with EU AI Act rollout?

In Modulos, the EU AI Act Framework OFF-1 attaches to the same organization AI System as OFF-11. The EU AI Act Framework MFF-1 can attach to the same AI Systems as MFF-12. The two Regulations have different scope rules and different roles, and they can apply to the same AI system (EU AI Act Article 2(7)). For the Controls that are in the GDPR Frameworks and also in other Frameworks, see Control overlap. See Other Frameworks on the same AI Systems.

What's the typical rollout sequence?

The GDPR sets no sequence. Modulos recommends this order:

1. Check scope and your role as controller or processor. Add the applicable GDPR Frameworks.
2. Check principles, legal bases, consent, information, data subject rights, and restrictions by law.
3. Check accountability, joint controllers, processors, records, data protection by design and by default, and security.
4. Check if a data protection impact assessment, prior consultation, or a data protection officer is necessary.
5. Prepare for personal data breaches, transfers, and cooperation with the supervisory authority.
6. Examine the work again when processing changes.

See Steps that Modulos recommends.

What evidence is typically needed for a GDPR supervisory authority audit?

The GDPR sets no complete set of records for an audit. Controllers must be able to demonstrate compliance (Articles 5(2) and 24(1)), and controllers and processors must cooperate with the supervisory authority on request (Article 31). Examples include records of processing activities (30), records of each breach (33(5)), and a data protection impact assessment (35(7)).

Article 30(5) gives an exception for organizations with “fewer than 250 persons”. The exception does not apply if the processing is likely to result in a risk, is not occasional, or includes special categories or data about criminal convictions. The controller or the processor, and where applicable its representative, must make the record available to the supervisory authority on request (Article 30(4)). See Article 30 and the recommended steps.