general-data-protection-regulation-eu-2016-679.pdf, p.32
Protection of natural persons' rights and freedoms regarding personal data processing.
1 Subject-matter and objectives
general-data-protection-regulation-eu-2016-679.pdf, p.39
Processing of personal data must be carried out under official authority or with Union/Member State law authorisation.
10 Processing of personal data relating to criminal convictions and offences
Controller does not need to identify data subject for processing purposes.
11 Processing which does not require identification
Controller must provide information and communication about data processing to data subjects.
12 Transparent information, communication and modalities for the exercise of the rights of the data
Controller must provide information and communication.
Information provided must be concise, transparent, intelligible, and easily accessible.
general-data-protection-regulation-eu-2016-679.pdf, p.40
Controller must provide personal data subject with certain information when collecting their data.
13 Information to be provided where personal data are collected from the data subject
Must provide information to the data subject
Information includes identity and contact details of controller
general-data-protection-regulation-eu-2016-679.pdf, p.41
Controller must provide personal data subject with certain information.
14 Information to be provided where personal data have not been obtained from the data subject
Must provide information to the data subject.
Information includes identity and contact details of controller.
general-data-protection-regulation-eu-2016-679.pdf, p.43
Data subject has right to access personal data
15 Right of access by the data subject
Data subject has right to rectification of inaccurate personal data.
16 Right to rectification
Data subject has right to rectification.
Rectification is a subclass of data correction.
Data subject has right to erasure of personal data
17 Right to erasure (‘right to be forgotten’)
Controller has obligation to erase personal data
general-data-protection-regulation-eu-2016-679.pdf, p.44
Data subject has right to restrict processing under certain conditions.
18 Right to restriction of processing
Data subject has right to restrict processing.
general-data-protection-regulation-eu-2016-679.pdf, p.45
Controller must notify recipients of personal data rectification or erasure.
19 Notification obligation regarding rectification or erasure of personal data or restriction of
2 Material scope
Liability rules of intermediary service providers
Includes certain activities outside the scope of Union law
Subclass of filing systems and personal data intended to form a filing system
Data subject has right to receive personal data in a structured format and transmit it to another controller.
20 Right to data portability
Right to data portability is defined for natural persons.
Data subject has right to object to processing of personal data for certain purposes.
21 Right to object
general-data-protection-regulation-eu-2016-679.pdf, p.46
Right not to be subject to decision based solely on automated processing, including profiling.
22 Automated individual decision-making, including profiling
Right to be free from automated decision-making.
specific provisions regarding purposes, categories of processing, scope of restrictions, safeguards, controller information, storage periods, and risks to rights and freedoms
Restrictions on data processing obligations and rights
23 Restrictions
Restricts data processing obligations and rights
Demonstration of compliance with obligations
general-data-protection-regulation-eu-2016-679.pdf, p.47
Controller must implement technical and organisational measures to ensure data protection.
24 Responsibility of the controller
Data minimisation, pseudonymisation, necessary safeguards
general-data-protection-regulation-eu-2016-679.pdf, p.48
Implement technical and organisational measures for data protection
25 Data protection by design and by default
Nature, scope, context and purposes of processing
Joint controllers must determine their respective responsibilities for compliance with the obligations under this Regulation.
26 Joint controllers
Designation of representative for controllers and processors not established in the Union
27 Representatives of controllers or processors not established in the Union
Obligation to designate a representative
guarantees, documentation, and information for audits
general-data-protection-regulation-eu-2016-679.pdf, p.49
Processor must implement technical and organisational measures to ensure data protection.
28 Processor
Processor must implement measures to ensure data protection.
Processor is a subprocessor of the controller.
general-data-protection-regulation-eu-2016-679.pdf, p.50
Processor must not process personal data except on instructions from the controller.
29 Processing under the authority of the controller or processor
Processor must not process personal data.
Regulation applies to processing of personal data in Union and non-Union territories.
3 Territorial scope
Regulation applies to specified territories.
Controller and processor must maintain records of processing activities.
30 Records of processing activities
Classification of data subjects and categories
general-data-protection-regulation-eu-2016-679.pdf, p.51
Cooperation with supervisory authority upon request.
31 Cooperation with the supervisory authority
Implement appropriate technical and organisational measures to ensure a level of security.
32 Security of processing
Must implement appropriate technical and organisational measures.
Should implement appropriate technical and organisational measures.
Notification of personal data breach, including measures to address it.
general-data-protection-regulation-eu-2016-679.pdf, p.52
Controller must notify supervisory authority of personal data breach within 72 hours.
33 Notification of a personal data breach to the supervisory authority
Controller must notify supervisory authority.
Personal data breach information and measures
Controller must communicate personal data breach to data subject without undue delay if risk is high.
34 Communication of a personal data breach to the data subject
Controller must communicate personal data breach
general-data-protection-regulation-eu-2016-679.pdf, p.53
Controller must carry out data protection impact assessment prior to processing operations likely to result in high risk to rights and freedoms of natural persons.
35 Data protection impact assessment
Controller must carry out data protection impact assessment.
Data protection impact assessment is a specific type of processing operation.
Information about the intended processing, measures and safeguards, contact details of data protection officer, and data protection impact assessment.
general-data-protection-regulation-eu-2016-679.pdf, p.54
Controller must consult supervisory authority prior to processing where a data protection impact assessment indicates high risk.
36 Prior consultation
Timeframe for consultation is up to eight weeks.
Controller must consult supervisory authority.
Controller shall provide information to supervisory authority.
Supervisory authority may use its powers.
Information about the intended processing is required.
general-data-protection-regulation-eu-2016-679.pdf, p.55
37 Designation of the data protection officer
Must designate a data protection officer
Controller and processor must ensure data protection officer is involved in protecting personal data.
38 Position of the data protection officer
general-data-protection-regulation-eu-2016-679.pdf, p.56
Data protection officer's tasks and responsibilities
39 Tasks of the data protection officer
general-data-protection-regulation-eu-2016-679.pdf, p.33
4 Definitions
4(1) Definitions
4(10) Definitions
Natural or legal person, public authority, agency or body
4(11) Definitions
4(12) Definitions
...leading to the accidental or unlawful destruction...
4(13) Definitions
4(14) Definitions
4(15) Definitions
Definition of main establishment for controllers and processors
4(16) Definitions
the establishment having taken such decisions is to be considered to be the main establishment
Temporal relation between decisions and implementation
the latter establishment has the power to have such decisions implemented...
the decisions on the purposes and means of the processing of personal data are taken in another establishment...
the place of its central adminis­tration in the Union
(a) as regards a controller with establishments in more than one Member State, the place of its central administration in the Union...
(b) as regards a processor with establishments in more than one Member State, the place of its central administration in the Union...
Defines 'representative' for the purposes of the regulation.
4(17) Definitions
4(18) Definitions
4(19) Definitions
Defines 'processing' as any operation performed on personal data.
4(2) Definitions
4(20) Definitions
Personal data protection policies are adhered to by a controller or processor
Defines scope of binding corporate rules
Transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings
Within a group of enterprises engaged in a joint economic activity
Transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of enterprises engaged in a joint economic activity
Established on the territory of a Member State
Personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State
Transfers or a set of transfers of personal data to a controller or processor in one or more third countries
Within a group of undertakings, or group of enterprises engaged in a joint economic activity
4(21) Definitions
4(22) Definitions
...a supervisory authority which is concerned by the processing of personal data
(22) ‘supervisory authority concerned’ means...
The controller or processor is established on the territory of the Member State...
4(23) Definitions
Definition of relevant and reasoned objection
4(24) Definitions
Definition of information society service
4(25) Definitions
(25) ‘information society service’ means...
Definition of international organisation
4(26) Definitions
Definition of 'restriction of processing'
4(3) Definitions
Defines profiling as automated processing of personal data for certain aspects.
4(4) Definitions
...evaluating or predicting aspects concerning that natural person's performance at work...
...personal data to evaluate certain personal aspects relating to a natural person...
4(5) Definitions
the personal data can no longer be attributed to a specific data subject without the use of additional information
(5) ‘pseudonymisation’ means the processing of personal data in such a manner that...
4(6) Definitions
4(7) Definitions
Defines processor as a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
4(8) Definitions
Defines processor with clear boundaries.
Establishes a clear class hierarchy for processors.
4(9) Definitions
Codes of conduct for proper application of Regulation
40 Codes of conduct
Obligation to prepare and approve codes of conduct
general-data-protection-regulation-eu-2016-679.pdf, p.58
A body with expertise and independence can be accredited to monitor compliance with a code of conduct.
41 Monitoring of approved codes of conduct
Establishes procedures for assessing eligibility and monitoring compliance.
Member States, supervisory authorities, Board, and Commission shall encourage establishment of data protection certification mechanisms.
42 Certification
Certification mechanisms must be established at Union level.
Establishment of certification mechanisms is obligatory.
general-data-protection-regulation-eu-2016-679.pdf, p.59
Certification bodies must be accredited and meet specific requirements.
43 Certification bodies
Certification body accreditation requirements
general-data-protection-regulation-eu-2016-679.pdf, p.60
Transfer of personal data must comply with conditions in Chapter 4.
44 General principle for transfers
general-data-protection-regulation-eu-2016-679.pdf, p.61
Commission may decide that a third country or international organisation ensures an adequate level of protection.
45 Transfers on the basis of an adequacy decision
Article classifies third countries and international organisations based on their data protection levels.
general-data-protection-regulation-eu-2016-679.pdf, p.62
Controller or processor must provide appropriate safeguards when transferring personal data to a third country.
46 Transfers subject to appropriate safeguards
Controller or processor must provide appropriate safeguards.
Binding corporate rules must be approved by the competent supervisory authority and meet certain requirements.
47 Binding corporate rules
Binding corporate rules must be approved by the competent supervisory authority.
Data subjects have enforceable rights regarding the processing of their personal data.
The binding corporate rules must specify certain information about the group of undertakings or enterprises.
The binding corporate rules must be legally binding and apply to all members of the group.
general-data-protection-regulation-eu-2016-679.pdf, p.64
No transfer or disclosure of personal data without international agreement.
48 Transfers or disclosures not authorised by Union law
Prohibits transfer or disclosure of personal data.
Transfer of personal data to a third country or international organisation requires explicit consent, contract necessity, public interest, legal claims, vital interests, or consultation.
49 Derogations for specific situations
Negation of transfer without consent or necessity
general-data-protection-regulation-eu-2016-679.pdf, p.35
Processing of personal data must be lawful, fair, transparent, and secure.
5 Principles relating to processing of personal data
Must provide processing of personal data in a lawful manner.
general-data-protection-regulation-eu-2016-679.pdf, p.65
Commission and supervisory authorities shall take appropriate steps to develop international cooperation mechanisms.
50 International cooperation for the protection of personal data
Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation.
51 Supervisory authority
Member States must provide for one or more independent public authorities.
general-data-protection-regulation-eu-2016-679.pdf, p.66
Member States must ensure supervisory authorities have necessary resources and staff.
52 Independence
...ensuring each supervisory authority is provided with the human, technical and financial resources...
...which shall be subject to the exclusive direction of the member or members of the supervisory authority concerned.
Member States must choose and have staff for supervisory authorities.
Each Member State shall ensure that each supervisory authority chooses...
...during their term of office, engage in any incompatible occupation...
Supervisory authorities must not engage in incompatible occupations.
Member or members of each supervisory authority shall refrain from any action...
...neither seek nor take instructions from anybody.
Supervisory authorities must remain free from external influence.
Member or members of each supervisory authority shall, in the performance of their tasks and exercise of their powers...
Member States shall appoint supervisory authority members through a transparent procedure.
53 General conditions for the members of the supervisory authority
Member States must provide for the establishment of supervisory authorities.
54 Rules on the establishment of the supervisory authority
Establishment of supervisory authorities is a classification of Member State laws.
general-data-protection-regulation-eu-2016-679.pdf, p.67
Supervisory authorities are competent for tasks and powers within their own Member State.
55 Competence
Lead supervisory authority competence for cross-border processing
56 Competence of the lead supervisory authority
Lead supervisory authority has competence to act as lead supervisory authority
general-data-protection-regulation-eu-2016-679.pdf, p.68
Supervisory authorities have various tasks related to data protection, including monitoring and enforcing the regulation, promoting public awareness, and handling complaints.
57 Tasks
Supervisory authorities have tasks related to data protection.
general-data-protection-regulation-eu-2016-679.pdf, p.69
Supervisory authorities have various powers and corrective powers to enforce data protection regulations.
58 Powers
Supervisory authorities have various powers.
Supervisory authorities have various corrective powers.
Supervisory authorities have various authorisation and advisory powers.
Powers are a subclass of corrective powers.
general-data-protection-regulation-eu-2016-679.pdf, p.70
Annual report on activities required for supervisory authorities
59 Activity reports
general-data-protection-regulation-eu-2016-679.pdf, p.36
Processing of personal data is lawful only if one of the specified conditions applies.
6 Lawfulness of processing
general-data-protection-regulation-eu-2016-679.pdf, p.71
Cooperation between lead and other supervisory authorities
60 Cooperation between the lead supervisory authority and the other supervisory authorities
general-data-protection-regulation-eu-2016-679.pdf, p.72
Supervisory authorities must provide each other with relevant information and mutual assistance.
61 Mutual assistance
Supervisory authorities must conduct joint operations with other Member States' supervisory authorities.
62 Joint operations of supervisory authorities
Supervisory authorities must conduct joint operations.
general-data-protection-regulation-eu-2016-679.pdf, p.73
Supervisory authorities must cooperate with each other and the Commission through the consistency mechanism.
63 Consistency mechanism
Supervisory authorities and the Commission shall issue an opinion to the Board on certain matters.
64 Opinion of the Board
Supervisory authorities and the Commission shall issue an opinion to the Board.
The excerpt is part of a class hierarchy related to data protection regulations.
general-data-protection-regulation-eu-2016-679.pdf, p.74
The Board shall adopt a binding decision in certain cases.
65 Dispute resolution by the Board
general-data-protection-regulation-eu-2016-679.pdf, p.75
Supervisory authority may adopt provisional measures to protect data subject rights and freedoms.
66 Urgency procedure
Supervisory authority may adopt provisional measures.
general-data-protection-regulation-eu-2016-679.pdf, p.76
Commission may adopt implementing acts for exchanging information by electronic means.
67 Exchange of information
Establishment of European Data Protection Board
68 European Data Protection Board
Establishs the European Data Protection Board
The Board must act independently when performing its tasks or exercising its powers.
69 Independence
The Board shall act independently when performing its tasks or exercising its powers.
The Board must not seek instructions from anybody.
Without prejudice to requests by the Commission referred to in point (b) of Article 70(1) and in Article 70(2), the Board shall, in the performance of its tasks or the exercise of its powers, neither seek nor take instructions from anybody.
The Board must not take instructions from anybody.
The Board must act pursuant to Articles 70 and 71.
The Board shall act independently when performing its tasks or exercising its powers pursuant to Articles 70 and 71.
The Board must act independently pursuant to Articles 70 and 71.
general-data-protection-regulation-eu-2016-679.pdf, p.37
Controller must demonstrate data subject consent for processing personal data.
7 Conditions for consent
Controller must demonstrate data subject consent
The Board shall ensure the consistent application of this Regulation.
70 Tasks of the Board
general-data-protection-regulation-eu-2016-679.pdf, p.78
Annual report on protection of natural persons must be made public and transmitted to EU institutions.
71 Reports
Annual report must be made public and transmitted.
The Board must take decisions by a simple majority of its members.
72 Procedure
The Board must elect a chair and two deputy chairs.
73 Chair
general-data-protection-regulation-eu-2016-679.pdf, p.79
74 Tasks of the Chair
Establishment of secretariat and its tasks
75 Secretariat
Confidentiality discussions shall be kept confidential.
76 Confidentiality
general-data-protection-regulation-eu-2016-679.pdf, p.80
Right to lodge a complaint with a supervisory authority
77 Right to lodge a complaint with a supervisory authority
Temporal overlap between complaint lodging and supervisory authority processing
Right to an effective judicial remedy against a supervisory authority
78 Right to an effective judicial remedy against a supervisory authority
Right to an effective judicial remedy against a controller or processor
79 Right to an effective judicial remedy against a controller or processor
Controller or processor must provide effective judicial remedy
Data subject has rights under this Regulation
Data subject has right to lodge complaint with supervisory authority
Processing of child's personal data requires consent from parent or guardian if child is under 16.
8 Conditions applicable to child's consent in relation to information society services
Processing requires consent from parent or guardian.
general-data-protection-regulation-eu-2016-679.pdf, p.81
Data subject has right to mandate a not-for-profit body to lodge complaint on their behalf.
80 Representation of data subjects
Data subject has right to mandate a not-for-profit body.
Court must contact other court in another Member State before proceeding with similar proceedings.
81 Suspension of proceedings
Court must not proceed without contacting other court.
Court has information on proceedings in another Member State.
Right to receive compensation for material or non-material damage caused by infringement of the Regulation.
82 Right to compensation and liability
general-data-protection-regulation-eu-2016-679.pdf, p.82
Administrative fines shall be imposed in accordance with certain conditions.
83 General conditions for imposing administrative fines
The duration of the infringement is relevant.
Imposition of administrative fines is an obligation.
The supervisory authority has permission to impose the fine.
The fine must be imposed before a certain point in time.
general-data-protection-regulation-eu-2016-679.pdf, p.83
Member States must implement penalties for infringements not subject to administrative fines.
84 Penalties
Exemptions or derogations from certain chapters
Member States shall reconcile the right to protection of personal data with the right to freedom of expression and information.
85 Processing and freedom of expression and information
general-data-protection-regulation-eu-2016-679.pdf, p.84
Personal data may be disclosed to reconcile public access with personal data protection.
86 Processing and public access to official documents
Member States must determine specific conditions for processing national identification numbers.
87 Processing of the national identification number
Member States must determine specific conditions.
Member States must provide specific rules for processing employees' personal data.
88 Processing in the context of employment
Member States must provide specific rules.
safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject
Processing for archiving purposes in the public interest shall be subject to appropriate safeguards.
89 Safeguards and derogations relating to processing for archiving purposes in the public interest,
Imposes a duty on Union or Member State law to provide safeguards.
general-data-protection-regulation-eu-2016-679.pdf, p.38
Processing of special categories of personal data is prohibited.
9 Processing of special categories of personal data
Prohibits processing of special categories of personal data.
general-data-protection-regulation-eu-2016-679.pdf, p.85
Member States may adopt rules on supervisory authorities' powers regarding controllers or processors with obligations of secrecy.
90 Obligations of secrecy
Existing data protection rules of churches and religious associations may continue to apply provided they are brought into line with the Regulation.
91 Existing data protection rules of churches and religious associations
Existing rules may be brought into line with the Regulation
Delegation of power and notification requirements for delegated acts.
92 Exercise of the delegation
Requires notification and approval for delegated acts.
Allows revocation of delegated power by EU institutions.
Defines the time period for objections to delegated acts.
general-data-protection-regulation-eu-2016-679.pdf, p.86
Establishment of a committee for the Commission.
93 Committee procedure
94 Repeal of Directive 95/46/EC
References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC shall be construed as references to the European Data Protection Board established by this Regulation
Establishes a new reference point for personal data processing
References to the repealed Directive shall be construed as references to this Regulation
No additional obligations on processing in relation to Directive 2002/58/EC
95 Relationship with Directive 2002/58/EC
Processing in relation to Directive 2002/58/EC
general-data-protection-regulation-eu-2016-679.pdf, p.87
International agreements involving personal data transfer remain in force until amended or revoked.
96 Relationship with previously concluded Agreements
The Commission must submit reports on the evaluation and review of this Regulation.
97 Commission reports
Commission may submit legislative proposals for amending data protection acts.
98 Review of other Union legal acts on data protection
Regulation entry into force and application
99 Entry into force and application
General Data Protection Regulation (EU) 2016/679