GDPR — Regulation (EU) 2016/679

The General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — governs the processing of personal data in the European Union. It is the most widely cited EU regulation for AI systems because most AI systems process personal data somewhere in their lifecycle (training data, inference inputs, operational logs, downstream decisions about people, or vendor flows).

This page is a Modulos compliance guide for AI use cases. Article references and key dates are drawn from the published OJ text; the platform mapping references real Modulos surfaces.

Quick decision

• Processing in the context of activities of an establishment in the Union, OR non-EU processing related to offering goods/services to data subjects in the Union or monitoring their behaviour in the Union → GDPR applies under Article 3. Determine your role (controller vs joint controller vs processor — Article 4(7)–(8); Article 26 joint controllers) before scoping obligations. Read Scope and applicability first.
• Decision-making AI affecting natural persons (credit, hiring, insurance, eligibility, monitoring) → Article 22 is the central provision. Read Key principles and obligations for the verbatim Article 22 wording, the three Article 22(2) exceptions, and the Article 22(3) safeguards.
• High-risk processing (new technology, profiling with significant effects, large-scale special categories, systematic monitoring) → Article 35 DPIA is required. The Article 35(3)(a)–(c) trigger list is the operative test; supervisory authorities also publish "mandatory DPIA" lists under Article 35(4). Read Controller obligations and breach notification.
• Subject to the EU AI Act in addition to GDPR → both apply concurrently. See EU AI Act vs GDPR; the Article 22 GDPR / Article 14 EU AI Act distinction is the most common point of confusion.
• Detected a personal-data breach → Article 33 sets the 72-hour controller notification window; Article 34 sets the data-subject communication trigger (high risk to rights and freedoms). Both run independently of any AI-Act Article 73 serious-incident reporting.

TL;DR

• GDPR = Regulation (EU) 2016/679, published in OJ L 119, 4.5.2016, pp. 1–88. Adopted 27 April 2016, applies from 25 May 2018 (Article 99). Corrigenda in OJ L 127, 23.5.2018.
• Scope — Article 2 material scope (excluding activities outside the scope of Union law; Member State activities under Chapter 2 of Title V TEU / CFSP; purely personal/household processing; and competent-authority law-enforcement processing covered by Directive (EU) 2016/680); Article 3 territorial scope (establishment + offering goods/services + behaviour monitoring).
• Principles — Article 5(1)(a)–(f) six principles + Article 5(2) accountability; Article 6(1)(a)–(f) lawful basis; Article 9 special categories.
• Rights — Articles 12–22, with Article 22 (automated individual decision-making, including profiling) the most consequential provision for AI use cases.
• Controller and processor obligations — Articles 24–32, including Article 25 data protection by design and by default, Article 28 processor contracts, Article 30 records of processing activities, Article 32 security.
• Breach + DPIA — Article 33 (72-hour controller notification) + Article 34 (data subject communication where high risk); Article 35 DPIA + Article 36 prior consultation.
• Transfers — Articles 44–50 (transfers to third countries; reference in cross-framework table).
• Enforcement — Article 83(5) sets maximum administrative fines at EUR 20 million or 4% of total worldwide annual turnover, whichever is higher.

Primary source

Regulation (EU) 2016/679 on EUR-Lex (CELEX 32016R0679) · OJ L 119, 4.5.2016, pp. 1–88 · Corrigendum: OJ L 127, 23.5.2018, pp. 2–5

Article 1 — subject matter

Article 1(1) defines the subject matter:

This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.

Article 1(2) protects fundamental rights and freedoms — in particular the right to the protection of personal data. Article 1(3) prohibits the restriction or prohibition of free movement of personal data within the Union for reasons connected with the protection of natural persons with regard to the processing of personal data.

GDPR structure

Regulation (EU) 2016/679 (GDPR)

Chapter I — General provisionsArticles 1–4: subject matter, material scope, territorial scope, definitions

Chapter II — PrinciplesArticles 5–11: principles relating to processing, lawful basis, conditions for consent, special categories

Chapter III — Rights of the data subjectArticles 12–23: transparency, information, access, rectification, erasure, restriction, portability, objection, automated decisions, restrictions

Chapter IV — Controller and processorArticles 24–43: general obligations, data protection by design, joint controllers, processors, RoPA, security, breach notification, DPIA, DPO, codes of conduct, certification

Chapter V — Transfers to third countriesArticles 44–50: adequacy decisions, appropriate safeguards, derogations, international cooperation

Chapter VI — Independent supervisory authoritiesArticles 51–59: status, competence, tasks, powers

Chapter VII — Cooperation and consistencyArticles 60–76: one-stop-shop, mutual assistance, European Data Protection Board

Chapter VIII — Remedies, liability, penaltiesArticles 77–84: rights to complain and to effective remedy, liability, administrative fines (Art 83 fines)

Chapter IX — Specific processing situationsArticles 85–91: freedom of expression, public access, national identification, employment, archiving, churches

Chapter X — Delegated and implementing actsArticles 92–93

Chapter XI — Final provisionsArticles 94–99: repeal of Directive 95/46/EC, application from 25 May 2018

For AI use cases, the four operationally dense chapters are II (principles), III (rights — especially Article 22), IV (controller / processor obligations — especially Articles 25, 30, 32, 33, 35), and VIII (penalties).

How to operationalize GDPR in Modulos

Modulos models GDPR through two complementary framework templates:

Framework	Project type	Focus	Requirement count
OFF-11 (GDPR (org))	Organisation	Article-by-article organisational obligations across the 99 articles	31 (ORF-225 to ORF-255)
MFF-12 (GDPR (app))	AI application	Per-AI-system technical and operational obligations	10 (MRF-233 to MRF-242)

The split mirrors the controller (organisation) / processing-activity (per-AI-system) distinction in GDPR itself: the controller-level obligations (RoPA, DPO, breach-notification process, supervisory cooperation) sit on the organisation project; the activity-level obligations (lawful basis decision, transparency notice content, data subject rights workflow, technical security measures) sit on each AI-system project.

A typical setup:

1. Requirements — each GDPR obligation is recorded as a requirement on the relevant project (OFF-11 organisation or MFF-12 AI service). Fulfilment tracks through Not fulfilled → Fulfilled (with optional Out of scope).
2. Controls — implemented measures (lawful-basis assessment, transparency notice template, data subject rights workflow, processor due-diligence policy, Article 30 RoPA, Article 32 security measures, breach-handling SOP) are documented as named controls and mapped to one or more requirements.
3. Evidence — Article 30 records, DPIA reports, prior-consultation submissions to the supervisory authority, breach-notification artefacts, processor contracts (Article 28 clauses), training records are recorded once and linked to multiple controls.
4. Readiness + fulfilment attestation — a requirement becomes ready for review once linked controls are in a final state; the requirement owner attests fulfilment for the project scope.
5. Modulos does not provide dedicated UI surfaces for the Article 30 RoPA, the DPIA workflow, or the Article 33–34 breach notification — these are tracked as evidence linked to the relevant requirement on OFF-11 / MFF-12.

See Operationalizing GDPR in Modulos for the practical rollout sequence.

See it in Modulos

Modulos lets enterprise teams record GDPR obligations as requirements, link evidence, evaluate controls through reviews, and track remediation loops.

Request a demo

Cross-framework mapping (preview)

GDPR area	EU AI Act (Regulation (EU) 2024/1689)	ISO/IEC 27701:2025	NIS2 (Directive (EU) 2022/2555)
Article 5 principles	Article 10 data governance (data quality, training-set governance)	Privacy information management system, Annex A / B PII controls	(no direct equivalent)
Article 6 lawful basis	Article 10 (training data lawfulness for high-risk AI)	(no direct equivalent — ISO 27701 doesn't decide lawful basis)	(no direct equivalent)
Article 22 automated decisions	Article 14 human oversight design (provider obligation) — distinct duty; do not conflate	(no direct equivalent)	(no direct equivalent)
Articles 12–20 transparency + rights	Article 13 transparency to deployers + Article 50 transparency to natural persons	Annex A / B disclosure and access controls	(no direct equivalent)
Articles 25 + 32 security	Article 15 cybersecurity for high-risk AI	Information security baseline (via ISO 27001)	Article 21(2)(a)–(j) cybersecurity measures
Article 30 RoPA	Article 11 + Annex IV technical documentation	Annex A / B record-keeping controls	(no direct equivalent)
Article 33–34 breach notification	Article 73 serious incidents (high-risk AI)	(no direct equivalent for breach notification timelines)	Article 23 incident reporting (24h / 72h / final)
Article 35 DPIA	Article 27 fundamental rights impact assessment (FRIA — narrow trigger, distinct duty)	(no direct equivalent)	(no direct equivalent)
Article 83 administrative fines	Article 99 administrative fines (up to EUR 35M / 7% turnover for Art 5)	(no direct equivalent)	Article 34 administrative fines (min maxima EUR 10M / 2% for essential entities)

For the pairwise comparison with the EU AI Act see EU AI Act vs GDPR; for the full hub see framework comparison.

Related pages

Scope and applicability

Article 2 material scope, Article 3 territorial scope, Article 4 key definitions

Key principles and obligations

Article 5 principles, Article 6 lawful basis, Article 9 special categories, Articles 12–22 rights (including Article 22 automated decisions)

Controller obligations and breach notification

Articles 24–32 obligations, Article 33–34 breach notification, Article 35 DPIA, Article 37 DPO

Operationalizing in Modulos

Practical rollout sequence for OFF-11 and MFF-12

EU AI Act vs GDPR

How the two binding EU Regulations interact for AI systems that process personal data

Source attribution

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) is published in the Official Journal of the European Union L 119, 4.5.2016, pp. 1–88. A corrigendum is published in OJ L 127, 23.5.2018, pp. 2–5. References on this page are descriptive references to the published text.

Disclaimer

This page is for general informational purposes and does not constitute legal advice.