GDPR Principles, Lawful Basis, and Rights — Articles 5 to 23

Articles 5 to 23 of the GDPR, Regulation (EU) 2016/679, give rules for processing personal data and rights of data subjects. Articles 5 to 11 (Chapter II) give the principles, the legal bases for processing, and the conditions for consent. They also give the rules for special categories, for criminal convictions, and for processing that does not make identification necessary. Articles 12 to 23 (Chapter III) give the rights of the data subject. They also give the restrictions to these rights that Union or Member State law can make. For where the GDPR applies and for its definitions, see Where the GDPR applies.

The proposal COM(2025) 837 (19 November 2025) to amend Articles 5(1)(b), 9, 12(5), 13, and 22, and other Articles of the GDPR, is not law as of October 2026.

Article 5 — principles relating to processing of personal data

The controller is “responsible for” compliance with the six principles for processing personal data in Article 5(1) of the GDPR:

Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

Article 5(2) puts the responsibility for these principles on the controller:

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

Article 24(1) sets an obligation for the controller to use appropriate measures “to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation”.

Article 5 does not identify records that the controller must keep for each principle. The controller can keep records to demonstrate compliance with Articles 5(2) and 24(1). Examples are records of the purposes, of the tests of compatible further processing, or of the storage periods.

Article 6 — Lawfulness of processing

Article 6(1) of the GDPR gives the legal bases for the controller's processing:

Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

For points (c) and (e), Union law or “Member State law to which the controller is subject” must give the legal basis (Article 6(3)). The purpose of the processing “shall be determined in that legal basis” or, for point (e), the purpose must be “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The law must “meet an objective of public interest and be proportionate to the legitimate aim pursued”.

The controller determines the purposes and means of the processing (Article 4(7)). Article 5(1)(b) tells the controller that the purposes must be “specified, explicit and legitimate”. Thus, the purposes of an AI system are the purposes that the controller specified. No Article of the GDPR makes each operation of an AI system a different purpose. Recital 50 gives this interpretation for compatible further processing: “In such a case, no legal basis separate from that which allowed the collection of the personal data is required.”

Article 6 does not tell the controller to record the legal basis for each purpose. The controller can keep this record to demonstrate compliance with Articles 5(2) and 24(1).

Article 6(4) gives a test for processing for a purpose that is different from the purpose for which the controller collected the personal data:

Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:

(a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;

(b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;

(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;

(d) the possible consequences of the intended further processing for data subjects;

(e) the existence of appropriate safeguards, which may include encryption or pseudonymisation.

Points (a) to (e) are not all the points that the controller examines (“inter alia”).

The European Data Protection Board has its “Guidelines 03/2026 on web scraping in the context of generative AI” in consultation, with a “Feedback period” from 8 July to 30 October 2026. These guidelines can change after the consultation.

Articles 7 and 8 — Conditions for consent

Article 7 of the GDPR gives the controller conditions for processing where the data subject's consent is the legal basis. Article 8 adds conditions for the consent of a child to information society services. For consent in Article 4(11), see Article 4 — Definitions.

Article 7 of the GDPR has these conditions:

• Article 7(1). Where consent is the legal basis of the processing, the controller must be able to demonstrate that the data subject gave consent.
• Article 7(2). A data subject can give consent in a written declaration that is also about other items. The controller must then make the request for consent “clearly distinguishable from the other matters”. The request must be in an “intelligible and easily accessible form”, in “clear and plain language”. Each part of the written declaration that “constitutes an infringement of this Regulation shall not be binding”.
• Article 7(3). The data subject has the right to withdraw consent at all times. “The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.” The data subject must get this information before the data subject gives consent. It must be as easy to withdraw consent as to give it.
• Article 7(4). Article 7(4) tells the controller how to find if consent is “freely given”: “utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract”.

Article 8 of the GDPR has these conditions for a child:

• Article 8(1). Article 8(1) applies to the “offer of information society services directly to a child”, where consent is the legal basis of the processing (Article 6(1)(a)). The processing is lawful where the child is “at least 16 years old”. If the child is “below the age of 16 years”, the processing is lawful “only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child”. A Member State can set “a lower age” by law, but “not below 13 years”.
• Article 8(2). The controller must make “reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology”.
• Article 8(3). Article 8(1) does not change the general contract law of Member States, for example “the rules on the validity, formation or effect of a contract in relation to a child”.

The GDPR makes explicit consent the condition of three exceptions:

• Article 9(2)(a), for the special categories of personal data (see Article 9).
• Article 22(2)(c), for a decision based solely on automated processing (see Article 22).
• Article 49(1)(a), for a transfer to a third country or an international organization. This derogation applies only if there is no adequacy decision and there are no appropriate safeguards. The data subject must first get information about the possible risks of the transfer. See Articles 44 to 49.

Article 4 gives no definition of explicit consent.

Article 9 — special categories of personal data

Controllers and processors must not process these special categories of personal data (GDPR Article 9(1)), unless Article 9(2) applies:

• personal data that shows racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership.
• genetic data.
• biometric data “for the purpose of uniquely identifying a natural person”.
• data concerning health.
• “data concerning a natural person's sex life or sexual orientation”.

Article 9(2) gives ten exceptions. The prohibition does not apply if one of these exceptions applies:

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;

(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;

(e) processing relates to personal data which are manifestly made public by the data subject;

(f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Each exception has its conditions. Points (g), (i), and (j) are possible only with Union or Member State law that has the conditions of that point. For point (b), Union or Member State law or a “collective agreement” must let the controller do the processing. For point (h), the processing must agree with Union or Member State law or with a contract with a “health professional”.

For point (h), Article 9(3) lets the processing occur “by or under the responsibility of a professional subject to the obligation of professional secrecy”. A different person with an obligation of secrecy can also process the data. The obligation comes from Union or Member State law or from rules of “national competent bodies”.

Article 9(4) lets Member States “maintain or introduce further conditions, including limitations”, for genetic data, biometric data, and data concerning health. For these three types of data, the law of a Member State can thus add conditions to Article 9.

The EU AI Act also has a rule for special categories. Article 4a(1) of the AI Act lets “providers” of high-risk AI systems “exceptionally process special categories of personal data”, “to the extent strictly necessary” for bias detection and correction. The conditions of Article 4a(1) apply together with the GDPR. Article 4a(2) lets “providers and deployers of other AI systems and models and deployers of high-risk AI systems” do the same processing, on the conditions of that paragraph. Regulation (EU) 2026/1744 removed Article 10(5) from the AI Act.

Articles 10 and 11 — criminal convictions and processing without identification

Article 10 of the GDPR applies when controllers or processors process personal data “relating to criminal convictions and offences or related security measures”. The processing of these data on a legal basis of Article 6(1) can occur only in one of these two conditions:

• the processing is “under the control of official authority”.
• Union or Member State law lets the processing occur and gives appropriate safeguards for the rights and freedoms of data subjects.

Only an official authority can control a “comprehensive register of criminal convictions”.

Article 11 of the GDPR applies when the purposes of the controller “do not or do no longer require the identification of a data subject by the controller”:

• Article 11(1). It is not necessary for the controller to keep, get, or process more information to identify the data subject, only to obey the GDPR.
• Article 11(2). Where the controller can demonstrate that it cannot identify the data subject, the controller must tell this to the data subject, if possible. Articles 15 to 20 then do not apply. They apply again if the data subject gives more information that makes identification possible, to use those rights.

Articles 12 to 14 — transparency and information to the data subject

Article 12 of the GDPR gives rules for the information to the data subject and for the requests of the data subject:

• Article 12(1). The controller must use appropriate measures to give the information of Articles 13 and 14 and each communication in Articles 15 to 22 and 34. The controller must give them “in a concise, transparent, intelligible and easily accessible form”. The controller must use “clear and plain language”, “in particular for any information addressed specifically to a child”.
• Article 12(2). The controller must help the data subject to use the rights in Articles 15 to 22. In the conditions of Article 11(2), the controller must not “refuse to act on the request”, unless it demonstrates that it cannot identify the data subject.
• Article 12(3). The controller must give the data subject “information on action taken on a request under Articles 15 to 22”. It must do this without undue delay, and not more than one month after it receives the request. Where necessary, the controller can extend this period by two more months because of “the complexity and number of the requests”. The controller must tell the data subject about the extension, with the “reasons for the delay”, not more than one month after it receives the request.
• Article 12(4). If the controller does “not take action on the request of the data subject”, it must tell the data subject “without delay and at the latest within one month of receipt of the request”. The controller gives the “reasons for not taking action”. It also tells the data subject that the data subject can lodge a complaint with a supervisory authority and can use a judicial remedy.
• Article 12(5). The controller must not charge for the information of Articles 13 and 14. It also must not charge for the communications and the steps in Articles 15 to 22 and 34. For requests that are “manifestly unfounded or excessive”, for example because they occur again and again, the controller can “charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested” or “refuse to act on the request”. The controller must demonstrate that a request is “manifestly unfounded or excessive”.
• Article 12(6). “Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.”

Article 13 applies when the controller collects personal data from the data subject. The controller gives the information at the time when it gets the data. Article 14 applies when the controller did not get the personal data from the data subject.

Articles 13(1)–(2) and 14(1)–(2) have these items of information that are the same in the two Articles:

• “the identity and the contact details of the controller and, where applicable, of the controller's representative”.
• “the contact details of the data protection officer, where applicable”.
• the purposes of the processing and its legal basis.
• where Article 6(1)(f) is the legal basis, the legitimate interests of the controller or of a third party.
• the recipients or categories of recipients, if there are recipients.
• where applicable, a transfer to a third country or international organization, and if there is an adequacy decision or not. For transfers in Articles 46 or 47 or in “the second subparagraph of Article 49(1)”, a “reference to the appropriate or suitable safeguards” and to how to get a copy of them.
• the storage period or, if it is not possible to give that period, “the criteria used to determine that period”.
• the right to request access, rectification, erasure, and restriction of processing, the right to object, and the right to data portability.
• where Article 6(1)(a) or 9(2)(a) is the legal basis, the right to withdraw consent at all times.
• the right to lodge a complaint with a supervisory authority.
• the automated decision-making, as shown below.

Article 13(2)(e) adds if the provision of personal data is a “statutory or contractual requirement”, or a requirement to make a contract. It also adds if the data subject must give the data, and the possible results if the data subject does not give them. Article 14 adds the categories of personal data (Article 14(1)(d)). It also adds the source of the data, and if the data came from “publicly accessible sources” (Article 14(2)(f)).

Further processing can be for a purpose that is different from the purpose for which the controller collected the data. Before that further processing, the controller must give the data subject information on that other purpose (Articles 13(3) and 14(4)). It must also give “any relevant further information” in paragraph 2 of the applicable Article.

Articles 13(2)(f), 14(2)(g), and 15(1)(h) include this information on automated decision-making:

the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Article 14(3) gives the time limits for the information of Article 14. The controller must obey each applicable time limit:

• (a) in a “reasonable period” after the controller gets the personal data, but not more than one month after, “having regard to the specific circumstances in which the personal data are processed”.
• (b) if the controller uses the personal data for communication with the data subject, at or before the first communication to that data subject.
• (c) if there will be a disclosure to a different recipient, at or before the first disclosure of the personal data.

Article 14(5) gives four exceptions. Article 14(1) to (4) do not apply “where and insofar as” one of these exceptions applies:

• (a) “the data subject already has the information”.
• (b) the information “proves impossible or would involve a disproportionate effort”, “in particular” for “archiving purposes in the public interest, scientific or historical research purposes or statistical purposes” in Article 89(1). The exception also applies if the obligation “is likely to render impossible or seriously impair the achievement of the objectives of that processing”. In these conditions, the controller must use appropriate measures for the protection of the data subject's rights and freedoms and legitimate interests, “including making the information publicly available”.
• (c) the “obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject”, and that law gives appropriate measures for the protection of the legitimate interests of the data subject.
• (d) the personal data must stay “confidential subject to an obligation of professional secrecy regulated by Union or Member State law”, for example “a statutory obligation of secrecy”.

Article 13(4) has only the first exception: Article 13(1) to (3) do not apply “where and insofar as the data subject already has the information”.

Articles 15–21 — data subject rights

Articles 15 to 21 of the GDPR give the data subject rights against the controller. Article 12 gives the time limits and the charges for each request.

• Article 15 — right of access. The data subject has the right to know if the controller processes personal data about the data subject. If it does, the data subject has the right of access to the data. The data subject also gets the information in Article 15(1)(a) to (h), which includes the automated decision-making of Article 22(1) and (4). Article 15(2) gives the data subject the right to know the Article 46 safeguards for a transfer to a third country or international organization.

  The controller gives a copy of the personal data that it processes. For more copies that the data subject requests, the controller can charge a “reasonable fee based on administrative costs” (Article 15(3)). The right to get a copy must not “adversely affect the rights and freedoms of others” (Article 15(4)). For the Court of Justice on Article 15(1)(h), see Article 22.

• Article 16 — right to rectification. The data subject has the right to get rectification of personal data that is not accurate, without undue delay. “Taking into account the purposes of the processing”, the data subject also has the right to complete personal data that is not complete, for example with “a supplementary statement”.

• Article 17 — right to erasure (“right to be forgotten”). The controller must erase personal data without undue delay where one of the six “grounds” of Article 17(1) applies:

  • (a) “the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed”.
  • (b) the data subject withdraws consent (Article 6(1)(a) or 9(2)(a)), and there is no other legal ground for the processing.
  • (c) the data subject uses the right to object in Article 21(1) and there are “no overriding legitimate grounds” for the processing, or uses the right to object in Article 21(2).
  • (d) “the personal data have been unlawfully processed”.
  • (e) a legal obligation in Union or Member State law tells the controller to erase the data.
  • (f) the controller collected the data for information society services in Article 8(1).

  Article 17(2) applies where the controller “has made the personal data public” and must erase the data (Article 17(1)). The controller must then use “reasonable steps, including technical measures” to tell other controllers that process the data about the request for erasure. The request is for the erasure of “any links to, or copy or replication of, those personal data”. The controller does this “taking account of available technology and the cost of implementation”. Article 17(1) and (2) do not apply “to the extent that processing is necessary” for one of these (Article 17(3)):

  • (a) the right of “freedom of expression and information”.
  • (b) “for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.
  • (c) public interest in the area of public health in Article 9(2)(h) and (i) and 9(3).
  • (d) “archiving purposes in the public interest, scientific or historical research purposes or statistical purposes” in Article 89(1), “in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing”.
  • (e) the “establishment, exercise or defence of legal claims”.

• Article 18 — right to restriction of processing. The data subject has the right to get restriction of processing where one of these four conditions applies:

  • (a) “the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data”.
  • (b) the processing is not lawful, and the data subject “opposes the erasure of the personal data and requests the restriction of their use instead”.
  • (c) “the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims”.
  • (d) the data subject uses the right to object in Article 21(1), while the controller makes sure “whether the legitimate grounds of the controller override those of the data subject”.

  After a restriction, the controller can only keep the data, unless one of the conditions of Article 18(2) applies. The controller must tell the data subject before it lifts the restriction (Article 18(3)).

• Article 19 — notification obligation. The controller must notify each rectification, erasure, or restriction of processing to each recipient that got the personal data. This obligation does not apply if the communication “proves impossible or involves disproportionate effort”. The controller must tell the data subject about those recipients “if the data subject requests it”.

• Article 20 — right to data portability. The right applies to personal data about the data subject that the data subject gave to a controller. The data subject has the right to get these data in a “structured, commonly used and machine-readable format”, and to transmit them to a different controller. The right applies only if the legal basis is consent (Article 6(1)(a) or 9(2)(a)) or a contract (Article 6(1)(b)). The processing must also be “carried out by automated means”.

  Where “technically feasible”, the data subject can have the data sent directly from one controller to a different controller (Article 20(2)). The right does not apply to processing necessary for a task in the public interest or in the exercise of official authority (Article 20(3)). The right must not “adversely affect the rights and freedoms of others” (Article 20(4)).

• Article 21 — right to object. The data subject has the right to object at all times, “on grounds relating to his or her particular situation”, to processing with Article 6(1)(e) or (f) as the legal basis, which includes profiling. The controller then stops the processing, unless it demonstrates “compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject”, or the processing is for legal claims (Article 21(1)).

  For direct marketing, the data subject has the right to object at all times (Article 21(2)). The controller then stops the processing for direct marketing (Article 21(3)).

  The controller must tell the data subject “explicitly” about these two rights, at the time of the first communication or before it. The controller must give this information “clearly and separately from any other information” (Article 21(4)). For information society services, the data subject has the right to object “by automated means” (Article 21(5)).

  Article 21(6) is about “scientific or historical research purposes or statistical purposes” in Article 89(1). For this processing, the data subject has the right to object “on grounds relating to his or her particular situation”, unless the processing is necessary for a task “carried out for reasons of public interest”.

Article 22 — automated individual decision-making, including profiling

Article 22 of the GDPR gives protection to the data subject against decisions based solely on automated processing. Article 22(1) gives the right:

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Article 22(2) gives three exceptions:

Paragraph 1 shall not apply if the decision:

(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;

(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

(c) is based on the data subject's explicit consent.

Article 22(3) gives safeguards for points (a) and (c):

In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

Article 22(4) gives a limit for the special categories:

Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.

Where Article 22(1) applies, a decision based solely on automated processing is possible only with one of the exceptions of Article 22(2). For points (a) and (c), the controller must apply, as a minimum, the three safeguards of Article 22(3). Thus, the controller can record the exception that it uses and the safeguards that it applies.

Recital 71 helps to read Article 22. It gives two examples of such a decision: the “automatic refusal of an online credit application” and “e-recruiting practices without any human intervention”.

SCHUFA (C-634/21)

The Court of Justice gave its judgment in Case C-634/21 (SCHUFA Holding (Scoring)) on 7 December 2023. The judgment makes these points on Article 22(1) of the GDPR:

• Paragraph 43. Article 22(1) applies only if there are all three of these conditions:
  • there is a decision.
  • the decision is “based solely on automated processing, including profiling”.
  • the decision has legal effects for the data subject or similarly significantly affects the data subject.
• Paragraph 52. Article 22(1) “lays down a prohibition in principle, the infringement of which does not need to be invoked individually” by the data subject.
• Operative part. The operative part is about “the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future”. This is “automated individual decision-making” in Article 22(1) on one condition. The condition is that a third party that gets the value “draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person”.

Dun & Bradstreet Austria (C-203/22)

The Court of Justice gave its judgment in Case C-203/22 (Dun & Bradstreet Austria) on 27 February 2025. The judgment is about Article 15(1)(h) of the GDPR for the automated decision-making of Article 22(1):

• Operative part, point 1. For automated decision-making in Article 22(1), “the data subject may require the controller, as ‘meaningful information about the logic involved’, to explain, by means of relevant information and in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied in order to use, by automated means, the personal data concerning that person with a view to obtaining a specific result, such as a credit profile”.
• Operative part, point 2. The controller can think that the information “contains data of third parties protected by that regulation or trade secrets”. The controller must then give that information to the “competent supervisory authority or court”. The authority or court must “balance the rights and interests at issue with a view to determining the extent of the data subject’s right of access”.

Article 22 and the EU AI Act

Article 22 of the GDPR and some Articles of the EU AI Act can apply to the same decision.

EU AI Act Articles 14 and 26(2) are in Chapter III. They apply on the dates of Article 113(3), point (c), with the conditions of the EU AI Act. For these dates, see Digital Omnibus on AI.

Article 86 is in Chapter IX. Article 113 gives no special date for Chapter IX. Thus, Article 86 applies from 2 August 2026. Article 86(1) refers to “a high-risk AI system listed in Annex III”. Article 113(3), point (c)(i), applies “Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5)” from “2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III”.

Article 111(2) is about high-risk AI systems “other than the systems referred to in paragraph 1 of this Article, that have been placed on the market or put into service before the date of application of Chapter III referred to in Article 113”. The EU AI Act applies to the “operators” of these systems “only if, as from that date, those systems are subject to significant changes in their designs”. Article 111(2) also gives this rule: “In any case, the providers and deployers of high-risk AI systems intended to be used by public authorities shall take the necessary steps to comply with the requirements and obligations laid down in this Regulation by 2 August 2030.”

These provisions set obligations for different persons and give rights to different persons:

• Article 22 of the GDPR. Article 22 gives the data subject a right against the controller. In C-634/21, paragraph 52, the Court of Justice gives this interpretation: Article 22(1) “lays down a prohibition in principle”.
• Article 14(1) of the AI Act. High-risk AI systems “shall be designed and developed in such a way” that “they can be effectively overseen by natural persons during the period in which they are in use”.
• Article 26(2) of the AI Act. “Deployers” of high-risk AI systems must “assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support”.
• Article 86 of the AI Act. An affected person has the right to get from the “deployer” “clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken” (Article 86(1)). The right applies to a decision that the “deployer” makes “on the basis of the output from a high-risk AI system listed in Annex III, with the exception of systems listed under point 2 thereof”. The decision must be one that has legal effects for the person, or that similarly significantly affects the person “in a way that they consider to have an adverse impact on their health, safety or fundamental rights”. Article 86(2) gives this exception: “Paragraph 1 shall not apply to the use of AI systems for which exceptions from, or restrictions to, the obligation under that paragraph follow from Union or national law in compliance with Union law.” Article 86 applies “only to the extent that the right referred to in paragraph 1 is not otherwise provided for under Union law” (Article 86(3)).

For the general rule between the two Regulations, see The GDPR and the EU AI Act and EU AI Act and GDPR.

Article 23 — Restrictions

Article 23(1) of the GDPR lets Union or Member State law make restrictions to some obligations and rights by a legislative measure:

Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

(a) national security;

(b) defence;

(c) public security;

(d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

(e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;

(f) the protection of judicial independence and judicial proceedings;

(g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;

(h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);

(i) the protection of the data subject or the rights and freedoms of others;

(j) the enforcement of civil law claims.

Article 23(2) gives the provisions that the legislative measure must contain, “where relevant”. Examples are the purposes of the processing, “the scope of the restrictions introduced”, the safeguards against “abuse or unlawful access or transfer”, and the right of data subjects to know about the restriction, “unless that may be prejudicial to the purpose of the restriction”. Thus, a restriction comes from a legislative measure of the Union or of a Member State, not from a decision of the controller.

Principles and rights in Modulos

For the Modulos Requirements of Articles 5 to 23 in the Frameworks OFF-11 and MFF-12, see Requirements of the GDPR Frameworks.

Where to go next

GDPR overview

Dates, structure, guidance, and case law

Supervisory authorities, remedies, and penalties

Articles 51 to 84: supervisory authorities, the right to lodge a complaint, liability, and penalties

Where the GDPR applies

Where the GDPR applies, its definitions, the controller, and the processor

Obligations of controllers and processors

Articles 24 to 49, from accountability to transfers

GDPR Frameworks in Modulos

The two Frameworks, the steps, and the Requirements

The EU AI Act and the GDPR compared

Where the two Regulations apply to the same AI systems

ISO/IEC 27701 and the GDPR

The privacy standard and the GDPR

Sources

• Regulation (EU) 2016/679 (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1, and corrigendum OJ L 127, 23.5.2018, p. 2 (EUR-Lex):
  • Articles 4(7), 4(11), and 5 to 23.
  • Articles 24(1), 24(2), and 49(1)(a).
  • Recitals 50 and 71.
• Court of Justice of the European Union, judgment of 7 December 2023, Case C-634/21, SCHUFA Holding (Scoring), paragraphs 43 and 52 and the operative part (EUR-Lex).
• Court of Justice of the European Union, judgment of 27 February 2025, Case C-203/22, Dun & Bradstreet Austria: the operative part (EUR-Lex).
• European Data Protection Board, the Endorsement 1/2018 of 25 May 2018, with the WP29 “Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, WP251rev.01” (EDPB).
• European Data Protection Board, “Guidelines 03/2026 on web scraping in the context of generative AI”, in consultation, “Open for feedback” from 8 July to 30 October 2026, and can change after the consultation (EDPB).
• Regulation (EU) 2024/1689 (EU AI Act), consolidated text of 27 July 2026: Articles 4a, 6(2), 14(1), 26(2), 86, 111(2), and 113, and Annex III (EUR-Lex).
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L, 24.7.2026, which removed Article 10(5) of Regulation (EU) 2024/1689 (EUR-Lex).
• European Commission, proposal COM(2025) 837 of 19 November 2025 (Digital Omnibus), Article 3, points 2 to 7 (EUR-Lex).

Disclaimer

This page gives general information. It is not legal advice.