General Data Protection Regulation (EU) 2016/679
1 Subject-matter and objectives
Protection of natural persons' rights and freedoms regarding personal data processing.
general-data-protection-regulation-eu-2016-679.pdf, p.32
2 Material scope
Includes certain activities outside the scope of Union law
Subclass of filing systems and personal data intended to form a filing system
Liability rules of intermediary service providers
3 Territorial scope
Regulation applies to processing of personal data in Union and non-Union territories.
Regulation applies to specified territories.
4 Definitions
general-data-protection-regulation-eu-2016-679.pdf, p.33
4(1) Definitions
4(2) Definitions
Defines 'processing' as any operation performed on personal data.
4(3) Definitions
Definition of 'restriction of processing'
4(4) Definitions
Defines profiling as automated processing of personal data for certain aspects.
...personal data to evaluate certain personal aspects relating to a natural person...
...evaluating or predicting aspects concerning that natural person's performance at work...
4(5) Definitions
(5) ‘pseudonymisation’ means the processing of personal data in such a manner that...
the personal data can no longer be attributed to a specific data subject without the use of additional information
4(6) Definitions
4(7) Definitions
4(8) Definitions
Defines processor as a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
Defines processor with clear boundaries.
Establishes a clear class hierarchy for processors.
4(9) Definitions
4(10) Definitions
Natural or legal person, public authority, agency or body
4(11) Definitions
4(12) Definitions
...leading to the accidental or unlawful destruction...
4(13) Definitions
4(14) Definitions
4(15) Definitions
4(16) Definitions
Definition of main establishment for controllers and processors
(a) as regards a controller with establishments in more than one Member State, the place of its central administration in the Union...
the place of its central adminis­tration in the Union
(b) as regards a processor with establishments in more than one Member State, the place of its central administration in the Union...
Temporal relation between decisions and implementation
the latter establishment has the power to have such decisions implemented...
the establishment having taken such decisions is to be considered to be the main establishment
the decisions on the purposes and means of the processing of personal data are taken in another establishment...
4(17) Definitions
Defines 'representative' for the purposes of the regulation.
4(18) Definitions
4(19) Definitions
4(20) Definitions
Personal data protection policies are adhered to by a controller or processor
Defines scope of binding corporate rules
Transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings
Transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of enterprises engaged in a joint economic activity
Within a group of enterprises engaged in a joint economic activity
Personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State
Established on the territory of a Member State
Transfers or a set of transfers of personal data to a controller or processor in one or more third countries
Within a group of undertakings, or group of enterprises engaged in a joint economic activity
4(21) Definitions
4(22) Definitions
(22) ‘supervisory authority concerned’ means...
...a supervisory authority which is concerned by the processing of personal data
The controller or processor is established on the territory of the Member State...
4(23) Definitions
4(24) Definitions
Definition of relevant and reasoned objection
4(25) Definitions
Definition of information society service
(25) ‘information society service’ means...
4(26) Definitions
Definition of international organisation
5 Principles relating to processing of personal data
Processing of personal data must be lawful, fair, transparent, and secure.
general-data-protection-regulation-eu-2016-679.pdf, p.35
Must provide processing of personal data in a lawful manner.
6 Lawfulness of processing
Processing of personal data is lawful only if one of the specified conditions applies.
general-data-protection-regulation-eu-2016-679.pdf, p.36
7 Conditions for consent
Controller must demonstrate data subject consent for processing personal data.
general-data-protection-regulation-eu-2016-679.pdf, p.37
Controller must demonstrate data subject consent
8 Conditions applicable to child's consent in relation to information society services
Processing of child's personal data requires consent from parent or guardian if child is under 16.
Processing requires consent from parent or guardian.
9 Processing of special categories of personal data
Processing of special categories of personal data is prohibited.
general-data-protection-regulation-eu-2016-679.pdf, p.38
Prohibits processing of special categories of personal data.
10 Processing of personal data relating to criminal convictions and offences
Processing of personal data must be carried out under official authority or with Union/Member State law authorisation.
general-data-protection-regulation-eu-2016-679.pdf, p.39
11 Processing which does not require identification
Controller does not need to identify data subject for processing purposes.
12 Transparent information, communication and modalities for the exercise of the rights of the data
Controller must provide information and communication about data processing to data subjects.
Controller must provide information and communication.
Information provided must be concise, transparent, intelligible, and easily accessible.
13 Information to be provided where personal data are collected from the data subject
Controller must provide personal data subject with certain information when collecting their data.
general-data-protection-regulation-eu-2016-679.pdf, p.40
Must provide information to the data subject
Information includes identity and contact details of controller
14 Information to be provided where personal data have not been obtained from the data subject
Controller must provide personal data subject with certain information.
general-data-protection-regulation-eu-2016-679.pdf, p.41
Must provide information to the data subject.
Information includes identity and contact details of controller.
15 Right of access by the data subject
Data subject has right to access personal data
general-data-protection-regulation-eu-2016-679.pdf, p.43
16 Right to rectification
Data subject has right to rectification of inaccurate personal data.
Data subject has right to rectification.
Rectification is a subclass of data correction.
17 Right to erasure (‘right to be forgotten’)
Data subject has right to erasure of personal data
Controller has obligation to erase personal data
18 Right to restriction of processing
Data subject has right to restrict processing under certain conditions.
general-data-protection-regulation-eu-2016-679.pdf, p.44
Data subject has right to restrict processing.
19 Notification obligation regarding rectification or erasure of personal data or restriction of
Controller must notify recipients of personal data rectification or erasure.
general-data-protection-regulation-eu-2016-679.pdf, p.45
20 Right to data portability
Data subject has right to receive personal data in a structured format and transmit it to another controller.
Right to data portability is defined for natural persons.
21 Right to object
Data subject has right to object to processing of personal data for certain purposes.
22 Automated individual decision-making, including profiling
Right not to be subject to decision based solely on automated processing, including profiling.
general-data-protection-regulation-eu-2016-679.pdf, p.46
Right to be free from automated decision-making.
23 Restrictions
Restrictions on data processing obligations and rights
specific provisions regarding purposes, categories of processing, scope of restrictions, safeguards, controller information, storage periods, and risks to rights and freedoms
Restricts data processing obligations and rights
24 Responsibility of the controller
Controller must implement technical and organisational measures to ensure data protection.
Demonstration of compliance with obligations
general-data-protection-regulation-eu-2016-679.pdf, p.47
25 Data protection by design and by default
Implement technical and organisational measures for data protection
Data minimisation, pseudonymisation, necessary safeguards
general-data-protection-regulation-eu-2016-679.pdf, p.48
Nature, scope, context and purposes of processing
26 Joint controllers
Joint controllers must determine their respective responsibilities for compliance with the obligations under this Regulation.
27 Representatives of controllers or processors not established in the Union
Designation of representative for controllers and processors not established in the Union
Obligation to designate a representative
28 Processor
Processor must implement technical and organisational measures to ensure data protection.
guarantees, documentation, and information for audits
general-data-protection-regulation-eu-2016-679.pdf, p.49
Processor must implement measures to ensure data protection.
Processor is a subprocessor of the controller.
29 Processing under the authority of the controller or processor
Processor must not process personal data except on instructions from the controller.
general-data-protection-regulation-eu-2016-679.pdf, p.50
Processor must not process personal data.
30 Records of processing activities
Controller and processor must maintain records of processing activities.
Classification of data subjects and categories
31 Cooperation with the supervisory authority
Cooperation with supervisory authority upon request.
general-data-protection-regulation-eu-2016-679.pdf, p.51
32 Security of processing
Implement appropriate technical and organisational measures to ensure a level of security.
Must implement appropriate technical and organisational measures.
Should implement appropriate technical and organisational measures.
33 Notification of a personal data breach to the supervisory authority
Controller must notify supervisory authority of personal data breach within 72 hours.
Notification of personal data breach, including measures to address it.
general-data-protection-regulation-eu-2016-679.pdf, p.52
Controller must notify supervisory authority.
34 Communication of a personal data breach to the data subject
Controller must communicate personal data breach to data subject without undue delay if risk is high.
Personal data breach information and measures
Controller must communicate personal data breach
35 Data protection impact assessment
Controller must carry out data protection impact assessment prior to processing operations likely to result in high risk to rights and freedoms of natural persons.
general-data-protection-regulation-eu-2016-679.pdf, p.53
Controller must carry out data protection impact assessment.
Data protection impact assessment is a specific type of processing operation.
36 Prior consultation
Controller must consult supervisory authority prior to processing where a data protection impact assessment indicates high risk.
Information about the intended processing, measures and safeguards, contact details of data protection officer, and data protection impact assessment.
general-data-protection-regulation-eu-2016-679.pdf, p.54
Controller must consult supervisory authority.
Information about the intended processing is required.
Controller shall provide information to supervisory authority.
Timeframe for consultation is up to eight weeks.
Supervisory authority may use its powers.
37 Designation of the data protection officer
general-data-protection-regulation-eu-2016-679.pdf, p.55
Must designate a data protection officer
38 Position of the data protection officer
Controller and processor must ensure data protection officer is involved in protecting personal data.
39 Tasks of the data protection officer
Data protection officer's tasks and responsibilities
general-data-protection-regulation-eu-2016-679.pdf, p.56
40 Codes of conduct
Codes of conduct for proper application of Regulation
Obligation to prepare and approve codes of conduct
41 Monitoring of approved codes of conduct
A body with expertise and independence can be accredited to monitor compliance with a code of conduct.
general-data-protection-regulation-eu-2016-679.pdf, p.58
Establishes procedures for assessing eligibility and monitoring compliance.
42 Certification
Member States, supervisory authorities, Board, and Commission shall encourage establishment of data protection certification mechanisms.
Establishment of certification mechanisms is obligatory.
Certification mechanisms must be established at Union level.
43 Certification bodies
Certification bodies must be accredited and meet specific requirements.
general-data-protection-regulation-eu-2016-679.pdf, p.59
Certification body accreditation requirements
44 General principle for transfers
Transfer of personal data must comply with conditions in Chapter 4.
general-data-protection-regulation-eu-2016-679.pdf, p.60
45 Transfers on the basis of an adequacy decision
Commission may decide that a third country or international organisation ensures an adequate level of protection.
general-data-protection-regulation-eu-2016-679.pdf, p.61
Article classifies third countries and international organisations based on their data protection levels.
46 Transfers subject to appropriate safeguards
Controller or processor must provide appropriate safeguards when transferring personal data to a third country.
general-data-protection-regulation-eu-2016-679.pdf, p.62
Controller or processor must provide appropriate safeguards.
47 Binding corporate rules
Binding corporate rules must be approved by the competent supervisory authority and meet certain requirements.
Binding corporate rules must be approved by the competent supervisory authority.
The binding corporate rules must specify certain information about the group of undertakings or enterprises.
Data subjects have enforceable rights regarding the processing of their personal data.
The binding corporate rules must be legally binding and apply to all members of the group.
48 Transfers or disclosures not authorised by Union law
No transfer or disclosure of personal data without international agreement.
general-data-protection-regulation-eu-2016-679.pdf, p.64
Prohibits transfer or disclosure of personal data.
49 Derogations for specific situations
Transfer of personal data to a third country or international organisation requires explicit consent, contract necessity, public interest, legal claims, vital interests, or consultation.
Negation of transfer without consent or necessity
50 International cooperation for the protection of personal data
Commission and supervisory authorities shall take appropriate steps to develop international cooperation mechanisms.
general-data-protection-regulation-eu-2016-679.pdf, p.65
51 Supervisory authority
Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation.
Member States must provide for one or more independent public authorities.
52 Independence
Member States must ensure supervisory authorities have necessary resources and staff.
general-data-protection-regulation-eu-2016-679.pdf, p.66
...ensuring each supervisory authority is provided with the human, technical and financial resources...
Member States must choose and have staff for supervisory authorities.
Each Member State shall ensure that each supervisory authority chooses...
...which shall be subject to the exclusive direction of the member or members of the supervisory authority concerned.
Supervisory authorities must not engage in incompatible occupations.
Member or members of each supervisory authority shall refrain from any action...
...during their term of office, engage in any incompatible occupation...
Supervisory authorities must remain free from external influence.
Member or members of each supervisory authority shall, in the performance of their tasks and exercise of their powers...
...neither seek nor take instructions from anybody.
53 General conditions for the members of the supervisory authority
Member States shall appoint supervisory authority members through a transparent procedure.
54 Rules on the establishment of the supervisory authority
Member States must provide for the establishment of supervisory authorities.
Establishment of supervisory authorities is a classification of Member State laws.
55 Competence
Supervisory authorities are competent for tasks and powers within their own Member State.
general-data-protection-regulation-eu-2016-679.pdf, p.67
56 Competence of the lead supervisory authority
Lead supervisory authority competence for cross-border processing
Lead supervisory authority has competence to act as lead supervisory authority
57 Tasks
Supervisory authorities have various tasks related to data protection, including monitoring and enforcing the regulation, promoting public awareness, and handling complaints.
general-data-protection-regulation-eu-2016-679.pdf, p.68
Supervisory authorities have tasks related to data protection.
58 Powers
Supervisory authorities have various powers and corrective powers to enforce data protection regulations.
general-data-protection-regulation-eu-2016-679.pdf, p.69
Supervisory authorities have various powers.
Powers are a subclass of corrective powers.
Supervisory authorities have various corrective powers.
Supervisory authorities have various authorisation and advisory powers.
59 Activity reports
Annual report on activities required for supervisory authorities
general-data-protection-regulation-eu-2016-679.pdf, p.70
60 Cooperation between the lead supervisory authority and the other supervisory authorities
Cooperation between lead and other supervisory authorities
general-data-protection-regulation-eu-2016-679.pdf, p.71
61 Mutual assistance
Supervisory authorities must provide each other with relevant information and mutual assistance.
general-data-protection-regulation-eu-2016-679.pdf, p.72
62 Joint operations of supervisory authorities
Supervisory authorities must conduct joint operations with other Member States' supervisory authorities.
Supervisory authorities must conduct joint operations.
63 Consistency mechanism
Supervisory authorities must cooperate with each other and the Commission through the consistency mechanism.
general-data-protection-regulation-eu-2016-679.pdf, p.73
64 Opinion of the Board
Supervisory authorities and the Commission shall issue an opinion to the Board on certain matters.
Supervisory authorities and the Commission shall issue an opinion to the Board.
The excerpt is part of a class hierarchy related to data protection regulations.
65 Dispute resolution by the Board
The Board shall adopt a binding decision in certain cases.
general-data-protection-regulation-eu-2016-679.pdf, p.74
66 Urgency procedure
Supervisory authority may adopt provisional measures to protect data subject rights and freedoms.
general-data-protection-regulation-eu-2016-679.pdf, p.75
Supervisory authority may adopt provisional measures.
67 Exchange of information
Commission may adopt implementing acts for exchanging information by electronic means.
general-data-protection-regulation-eu-2016-679.pdf, p.76
68 European Data Protection Board
Establishment of European Data Protection Board
Establishs the European Data Protection Board
69 Independence
The Board must act independently when performing its tasks or exercising its powers.
The Board shall act independently when performing its tasks or exercising its powers.
The Board must not seek instructions from anybody.
Without prejudice to requests by the Commission referred to in point (b) of Article 70(1) and in Article 70(2), the Board shall, in the performance of its tasks or the exercise of its powers, neither seek nor take instructions from anybody.
The Board must not take instructions from anybody.
The Board must act pursuant to Articles 70 and 71.
The Board shall act independently when performing its tasks or exercising its powers pursuant to Articles 70 and 71.
The Board must act independently pursuant to Articles 70 and 71.
70 Tasks of the Board
The Board shall ensure the consistent application of this Regulation.
71 Reports
Annual report on protection of natural persons must be made public and transmitted to EU institutions.
general-data-protection-regulation-eu-2016-679.pdf, p.78
Annual report must be made public and transmitted.
72 Procedure
The Board must take decisions by a simple majority of its members.
73 Chair
The Board must elect a chair and two deputy chairs.
74 Tasks of the Chair
general-data-protection-regulation-eu-2016-679.pdf, p.79
75 Secretariat
Establishment of secretariat and its tasks
76 Confidentiality
Confidentiality discussions shall be kept confidential.
77 Right to lodge a complaint with a supervisory authority
Right to lodge a complaint with a supervisory authority
general-data-protection-regulation-eu-2016-679.pdf, p.80
Temporal overlap between complaint lodging and supervisory authority processing
78 Right to an effective judicial remedy against a supervisory authority
Right to an effective judicial remedy against a supervisory authority
79 Right to an effective judicial remedy against a controller or processor
Right to an effective judicial remedy against a controller or processor
Data subject has rights under this Regulation
Controller or processor must provide effective judicial remedy
Data subject has right to lodge complaint with supervisory authority
80 Representation of data subjects
Data subject has right to mandate a not-for-profit body to lodge complaint on their behalf.
general-data-protection-regulation-eu-2016-679.pdf, p.81
Data subject has right to mandate a not-for-profit body.
81 Suspension of proceedings
Court must contact other court in another Member State before proceeding with similar proceedings.
Court must not proceed without contacting other court.
Court has information on proceedings in another Member State.
82 Right to compensation and liability
Right to receive compensation for material or non-material damage caused by infringement of the Regulation.
83 General conditions for imposing administrative fines
Administrative fines shall be imposed in accordance with certain conditions.
general-data-protection-regulation-eu-2016-679.pdf, p.82
Imposition of administrative fines is an obligation.
The duration of the infringement is relevant.
The fine must be imposed before a certain point in time.
The supervisory authority has permission to impose the fine.
84 Penalties
Member States must implement penalties for infringements not subject to administrative fines.
general-data-protection-regulation-eu-2016-679.pdf, p.83
85 Processing and freedom of expression and information
Member States shall reconcile the right to protection of personal data with the right to freedom of expression and information.
Exemptions or derogations from certain chapters
86 Processing and public access to official documents
Personal data may be disclosed to reconcile public access with personal data protection.
general-data-protection-regulation-eu-2016-679.pdf, p.84
87 Processing of the national identification number
Member States must determine specific conditions for processing national identification numbers.
Member States must determine specific conditions.
88 Processing in the context of employment
Member States must provide specific rules for processing employees' personal data.
Member States must provide specific rules.
89 Safeguards and derogations relating to processing for archiving purposes in the public interest,
Processing for archiving purposes in the public interest shall be subject to appropriate safeguards.
safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject
Imposes a duty on Union or Member State law to provide safeguards.
90 Obligations of secrecy
Member States may adopt rules on supervisory authorities' powers regarding controllers or processors with obligations of secrecy.
general-data-protection-regulation-eu-2016-679.pdf, p.85
91 Existing data protection rules of churches and religious associations
Existing data protection rules of churches and religious associations may continue to apply provided they are brought into line with the Regulation.
Existing rules may be brought into line with the Regulation
92 Exercise of the delegation
Delegation of power and notification requirements for delegated acts.
Requires notification and approval for delegated acts.
Defines the time period for objections to delegated acts.
Allows revocation of delegated power by EU institutions.
93 Committee procedure
Establishment of a committee for the Commission.
general-data-protection-regulation-eu-2016-679.pdf, p.86
94 Repeal of Directive 95/46/EC
Establishes a new reference point for personal data processing
References to the repealed Directive shall be construed as references to this Regulation
References to the Working Party on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of Directive 95/46/EC shall be construed as references to the European Data Protection Board established by this Regulation
95 Relationship with Directive 2002/58/EC
No additional obligations on processing in relation to Directive 2002/58/EC
Processing in relation to Directive 2002/58/EC
96 Relationship with previously concluded Agreements
International agreements involving personal data transfer remain in force until amended or revoked.
general-data-protection-regulation-eu-2016-679.pdf, p.87
97 Commission reports
The Commission must submit reports on the evaluation and review of this Regulation.
98 Review of other Union legal acts on data protection
Commission may submit legislative proposals for amending data protection acts.
99 Entry into force and application
Regulation entry into force and application