# General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679 URL: https://consilena.com/coverage/laws/stat_eu_32016r0679 - Jurisdiction: European Union - Type: Regulation - Short name: GDPR - Identifier: 32016R0679 - Current as of: 4 May 2016 - Provisions: 99 - Official text: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504 - Licence: [Commission Decision 2011/833/EU](https://eur-lex.europa.eu/eli/dec/2011/833/oj) - Attribution: Source: EUR-Lex, © European Union, https://eur-lex.europa.eu. Reuse authorised under Commission Decision 2011/833/EU; only the Official Journal text is authentic. > The library is a research copy. Check the official source before relying on a provision: the text published there, not the copy in Consilena, is the law. ## Provisions ### Chapter I – General provisions - **Art. 1 Subject-matter and objectives**: 1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free… - **Art. 2 Material scope**: 1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of… - **Art. 3 Territorial scope**: 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union… - **Art. 4 Definitions**: For the purposes of this Regulation: (1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an… ### Chapter II – Principles - **Art. 5 Principles relating to processing of personal data**: 1. Personal data shall be: (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and… - **Art. 6 Lawfulness of processing**: 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of… - **Art. 7 Conditions for consent**: 1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal… - **Art. 8 Conditions applicable to child's consent in relation to information society services**: 1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data… - **Art. 9 Processing of special categories of personal data**: 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the… - **Art. 10 Processing of personal data relating to criminal convictions and offences**: Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under… - **Art. 11 Processing which does not require identification**: 1. If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the… ### Chapter III – Rights of the data subject - **Art. 12 Transparent information, communication and modalities for the exercise of the rights of the data subject**: 1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22… - **Art. 13 Information to be provided where personal data are collected from the data subject**: 1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained… - **Art. 14 Information to be provided where personal data have not been obtained from the data subject**: 1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (a) the… - **Art. 15 Right of access by the data subject**: 1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being… - **Art. 16 Right to rectification**: The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her… - **Art. 17 Right to erasure (‘right to be forgotten’)**: 1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the… - **Art. 18 Right to restriction of processing**: 1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: (a) the accuracy of the… - **Art. 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing**: The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article… - **Art. 20 Right to data portability**: 1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured… - **Art. 21 Right to object**: and automated individual decision-making — Art. 21 — Right to object 1. The data subject shall have the right to object, on grounds relating to his or her… - **Art. 22 Automated individual decision-making, including profiling**: 1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal… - **Art. 23 Restrictions**: — Art. 23 — Restrictions 1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the… ### Chapter IV – Controller and processor - **Art. 24 Responsibility of the controller**: 1. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and… - **Art. 25 Data protection by design and by default**: 1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of… - **Art. 26 Joint controllers**: 1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. They shall in a transparent manner… - **Art. 27 Representatives of controllers or processors not established in the Union**: 1. Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union. 2. The obligation laid down in… - **Art. 28 Processor**: 1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement… - **Art. 29 Processing under the authority of the controller or processor**: The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data… - **Art. 30 Records of processing activities**: 1. Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That… - **Art. 31 Cooperation with the supervisory authority**: The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance… - **Art. 32 Security of processing**: 1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of… - **Art. 33 Notification of a personal data breach to the supervisory authority**: 1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of… - **Art. 34 Communication of a personal data breach to the data subject**: 1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the… - **Art. 35 Data protection impact assessment**: and prior consultation — Art. 35 — Data protection impact assessment 1. Where a type of processing in particular using new technologies, and taking into… - **Art. 36 Prior consultation**: 1. The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the… - **Art. 37 Designation of the data protection officer**: 1. The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or… - **Art. 38 Position of the data protection officer**: 1. The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to… - **Art. 39 Tasks of the data protection officer**: 1. The data protection officer shall have at least the following tasks: (a) to inform and advise the controller or the processor and the employees who carry… - **Art. 40 Codes of conduct**: and certification — Art. 40 — Codes of conduct 1. The Member States, the supervisory authorities, the Board and the Commission shall encourage the drawing up… - **Art. 41 Monitoring of approved codes of conduct**: 1. Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the monitoring of compliance with a code of… - **Art. 42 Certification**: 1. The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data… - **Art. 43 Certification bodies**: 1. Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, certification bodies which have an appropriate… ### Chapter V – Transfers of personal data to third countries or international organisations - **Art. 44 General principle for transfers**: Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international… - **Art. 45 Transfers on the basis of an adequacy decision**: 1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a… - **Art. 46 Transfers subject to appropriate safeguards**: 1. In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international… - **Art. 47 Binding corporate rules**: 1. The competent supervisory authority shall approve binding corporate rules in accordance with the consistency mechanism set out in Article 63, provided that… - **Art. 48 Transfers or disclosures not authorised by Union law**: Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or… - **Art. 49 Derogations for specific situations**: 1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a… - **Art. 50 International cooperation for the protection of personal data**: In relation to third countries and international organisations, the Commission and supervisory authorities shall take appropriate steps to: (a) develop… ### Chapter VI – Independent supervisory authorities - **Art. 51 Supervisory authority**: 1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order… - **Art. 52 Independence**: 1. Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation. 2. The… - **Art. 53 General conditions for the members of the supervisory authority**: 1. Member States shall provide for each member of their supervisory authorities to be appointed by means of a transparent procedure by: — their parliament; —… - **Art. 54 Rules on the establishment of the supervisory authority**: 1. Each Member State shall provide by law for all of the following: (a) the establishment of each supervisory authority; (b) the qualifications and eligibility… - **Art. 55 Competence**: 1. Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with… - **Art. 56 Competence of the lead supervisory authority**: 1. Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be… - **Art. 57 Tasks**: 1. Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory: (a) monitor and enforce the application… - **Art. 58 Powers**: 1. Each supervisory authority shall have all of the following investigative powers: (a) to order the controller and the processor, and, where applicable, the… - **Art. 59 Activity reports**: Each supervisory authority shall draw up an annual report on its activities, which may include a list of types of infringement notified and types of measures… ### Chapter VII – Cooperation and consistency - **Art. 60 Cooperation between the lead supervisory authority and the other supervisory authorities concerned**: 1. The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach… - **Art. 61 Mutual assistance**: 1. Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a… - **Art. 62 Joint operations of supervisory authorities**: 1. The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which… - **Art. 63 Consistency mechanism**: In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and… - **Art. 64 Opinion of the Board**: 1. The Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures below. To that end, the competent supervisory… - **Art. 65 Dispute resolution by the Board**: 1. In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following… - **Art. 66 Urgency procedure**: 1. In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and… - **Art. 67 Exchange of information**: The Commission may adopt implementing acts of general scope in order to specify the arrangements for the exchange of information by electronic means between… - **Art. 68 European Data Protection Board**: 1. The European Data Protection Board (the ‘Board’) is hereby established as a body of the Union and shall have legal personality. 2. The Board shall be… - **Art. 69 Independence**: 1. The Board shall act independently when performing its tasks or exercising its powers pursuant to Articles 70 and 71. 2. Without prejudice to requests by the… - **Art. 70 Tasks of the Board**: 1. The Board shall ensure the consistent application of this Regulation. To that end, the Board shall, on its own initiative or, where relevant, at the request… - **Art. 71 Reports**: 1. The Board shall draw up an annual report regarding the protection of natural persons with regard to processing in the Union and, where relevant, in third… - **Art. 72 Procedure**: 1. The Board shall take decisions by a simple majority of its members, unless otherwise provided for in this Regulation. 2. The Board shall adopt its own rules… - **Art. 73 Chair**: 1. The Board shall elect a chair and two deputy chairs from amongst its members by simple majority. 2. The term of office of the Chair and of the deputy chairs… - **Art. 74 Tasks of the Chair**: 1. The Chair shall have the following tasks: (a) to convene the meetings of the Board and prepare its agenda; (b) to notify decisions adopted by the Board… - **Art. 75 Secretariat**: 1. The Board shall have a secretariat, which shall be provided by the European Data Protection Supervisor. 2. The secretariat shall perform its tasks… - **Art. 76 Confidentiality**: 1. The discussions of the Board shall be confidential where the Board deems it necessary, as provided for in its rules of procedure. 2. Access to documents… ### Chapter VIII – Remedies, liability and penalties - **Art. 77 Right to lodge a complaint with a supervisory authority**: 1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority… - **Art. 78 Right to an effective judicial remedy against a supervisory authority**: 1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy… - **Art. 79 Right to an effective judicial remedy against a controller or processor**: 1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to… - **Art. 80 Representation of data subjects**: 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with… - **Art. 81 Suspension of proceedings**: 1. Where a competent court of a Member State has information on proceedings, concerning the same subject matter as regards processing by the same controller or… - **Art. 82 Right to compensation and liability**: 1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation… - **Art. 83 General conditions for imposing administrative fines**: 1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation… - **Art. 84 Penalties**: 1. Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not… ### Chapter IX – Provisions relating to specific processing situations - **Art. 85 Processing and freedom of expression and information**: 1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and… - **Art. 86 Processing and public access to official documents**: Personal data in official documents held by a public authority or a public body or a private body for the performance of a task carried out in the public… - **Art. 87 Processing of the national identification number**: Member States may further determine the specific conditions for the processing of a national identification number or any other identifier of general… - **Art. 88 Processing in the context of employment**: 1. Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the… - **Art. 89 Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes**: 1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to… - **Art. 90 Obligations of secrecy**: 1. Member States may adopt specific rules to set out the powers of the supervisory authorities laid down in points (e) and (f) of Article 58(1) in relation to… - **Art. 91 Existing data protection rules of churches and religious associations**: 1. Where in a Member State, churches and religious associations or communities apply, at the time of entry into force of this Regulation, comprehensive rules… ### Chapter X – Delegated acts and implementing acts - **Art. 92 Exercise of the delegation**: 1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The delegation of power referred to… - **Art. 93 Committee procedure**: 1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference… ### Chapter XI – Final provisions - **Art. 94 Repeal of Directive 95/46/EC**: 1. Directive 95/46/EC is repealed with effect from 25 May 2018. 2. References to the repealed Directive shall be construed as references to this Regulation… - **Art. 95 Relationship with Directive 2002/58/EC**: This Regulation shall not impose additional obligations on natural or legal persons in relation to processing in connection with the provision of publicly… - **Art. 96 Relationship with previously concluded Agreements**: International agreements involving the transfer of personal data to third countries or international organisations which were concluded by Member States prior… - **Art. 97 Commission reports**: 1. By 25 May 2020 and every four years thereafter, the Commission shall submit a report on the evaluation and review of this Regulation to the European… - **Art. 98 Review of other Union legal acts on data protection**: The Commission shall, if appropriate, submit legislative proposals with a view to amending other Union legal acts on the protection of personal data, in order… - **Art. 99 Entry into force and application**: 1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. 2. It shall… --- Consilena is a software provider, not a law firm. AI output is not legal advice: consult a licensed lawyer in the relevant jurisdiction. Page: https://consilena.com/coverage/laws/stat_eu_32016r0679. Index of every page: https://consilena.com/llms.txt.