- Laws
- GDPR
General Data Protection Regulation
gdprThe privacy law of the European Union, clause by clause, from its official source.
- Region
- European Union
- Version
- 2026.1
- In force since
- 25 May 2018
- Text
- English
- Clauses
- 1,040
- Source
- eur-lex.europa.eu
- Article 1Subject-matter and objectives
- Article 2Material scope
- Article 3Territorial scope
- Article 4Definitions
- Article 5Principles relating to processing of personal data
- Article 6Lawfulness of processing
- Article 7Conditions for consent
- Article 8Conditions applicable to child's consent in relation to information society services
- Article 9Processing of special categories of personal data
- Article 10Processing of personal data relating to criminal convictions and offences
- Article 11Processing which does not require identification
- Article 12Transparent information, communication and modalities for the exercise of the rights of the data subject
- Article 13Information to be provided where personal data are collected from the data subject
- Article 14Information to be provided where personal data have not been obtained from the data subject
- Article 15Right of access by the data subject
- Article 16Right to rectification
- Article 17Right to erasure (‘right to be forgotten’)
- Article 18Right to restriction of processing
- Article 19Notification obligation regarding rectification or erasure of personal data or restriction of processing
- Article 20Right to data portability
- Article 21Right to object
- Article 22Automated individual decision-making, including profiling
- Article 23Restrictions
- Article 24Responsibility of the controller
- Article 25Data protection by design and by default
- Article 26Joint controllers
- Article 27Representatives of controllers or processors not established in the Union
- Article 28Processor
- Article 29Processing under the authority of the controller or processor
- Article 30Records of processing activities
- Article 31Cooperation with the supervisory authority
- Article 32Security of processing
- Article 33Notification of a personal data breach to the supervisory authority
- Article 34Communication of a personal data breach to the data subject
- Article 35Data protection impact assessment
- Article 36Prior consultation
- Article 37Designation of the data protection officer
- Article 38Position of the data protection officer
- Article 39Tasks of the data protection officer
- Article 40Codes of conduct
- Article 41Monitoring of approved codes of conduct
- Article 42Certification
- Article 43Certification bodies
- Article 44General principle for transfers
- Article 45Transfers on the basis of an adequacy decision
- Article 46Transfers subject to appropriate safeguards
- Article 47Binding corporate rules
- Article 48Transfers or disclosures not authorised by Union law
- Article 49Derogations for specific situations
- Article 50International cooperation for the protection of personal data
- Article 51Supervisory authority
- Article 52Independence
- Article 53General conditions for the members of the supervisory authority
- Article 54Rules on the establishment of the supervisory authority
- Article 55Competence
- Article 56Competence of the lead supervisory authority
- Article 57Tasks
- Article 58Powers
- Article 59Activity reports
- Article 60Cooperation between the lead supervisory authority and the other supervisory authorities concerned
- Article 61Mutual assistance
- Article 62Joint operations of supervisory authorities
- Article 63Consistency mechanism
- Article 64Opinion of the Board
- Article 65Dispute resolution by the Board
- Article 66Urgency procedure
- Article 67Exchange of information
- Article 68European Data Protection Board
- Article 69Independence
- Article 70Tasks of the Board
- Article 71Reports
- Article 72Procedure
- Article 73Chair
- Article 74Tasks of the Chair
- Article 75Secretariat
- Article 76Confidentiality
- Article 77Right to lodge a complaint with a supervisory authority
- Article 78Right to an effective judicial remedy against a supervisory authority
- Article 79Right to an effective judicial remedy against a controller or processor
- Article 80Representation of data subjects
- Article 81Suspension of proceedings
- Article 82Right to compensation and liability
- Article 83General conditions for imposing administrative fines
- Article 84Penalties
- Article 85Processing and freedom of expression and information
- Article 86Processing and public access to official documents
- Article 87Processing of the national identification number
- Article 88Processing in the context of employment
- Article 89Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
- Article 90Obligations of secrecy
- Article 91Existing data protection rules of churches and religious associations
- Article 92Exercise of the delegation
- Article 93Committee procedure
- Article 94Repeal of Directive 95/46/EC
- Article 95Relationship with Directive 2002/58/EC
- Article 96Relationship with previously concluded Agreements
- Article 97Commission reports
- Article 98Review of other Union legal acts on data protection
- Article 99Entry into force and application
- Recital 1The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Ri
- Recital 2The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their national
- Recital 3Directive 95/46/EC of the European Parliament and of the Council seeks to harmonise the protection of fundamental rights and freedoms of natural perso
- Recital 4The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be
- Recital 5The economic and social integration resulting from the functioning of the internal market has led to a substantial increase in cross-border flows of p
- Recital 6Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of the collection and sh
- Recital 7Those developments require a strong and more coherent data protection framework in the Union, backed by strong enforcement, given the importance of cr
- Recital 8Where this Regulation provides for specifications or restrictions of its rules by Member State law, Member States may, as far as necessary for coheren
- Recital 9The objectives and principles of Directive 95/46/EC remain sound, but it has not prevented fragmentation in the implementation of data protection acro
- Recital 10In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union
- Recital 11Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the
- Recital 12Article 16(2) TFEU mandates the European Parliament and the Council to lay down the rules relating to the protection of natural persons with regard to
- Recital 13In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of
- Recital 14The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the proce
- Recital 15In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depen
- Recital 16This Regulation does not apply to issues of protection of fundamental rights and freedoms or the free flow of personal data related to activities whic
- Recital 17Regulation (EC) No 45/2001 of the European Parliament and of the Council applies to the processing of personal data by the Union institutions, bodies,
- Recital 18This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thu
- Recital 19The protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investig
- Recital 20While this Regulation applies, inter alia, to the activities of courts and other judicial authorities, Union or Member State law could specify the pro
- Recital 21This Regulation is without prejudice to the application of Directive 2000/31/EC of the European Parliament and of the Council, in particular of the li
- Recital 22Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out
- Recital 23In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of persona
- Recital 24The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject
- Recital 25Where Member State law applies by virtue of public international law, this Regulation should also apply to a controller not established in the Union,
- Recital 26The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have un
- Recital 27This Regulation does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data
- Recital 28The application of pseudonymisation to personal data can reduce the risks to the data subjects concerned and help controllers and processors to meet t
- Recital 29In order to create incentives to apply pseudonymisation when processing personal data, measures of pseudonymisation should, whilst allowing general an
- Recital 30Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addr
- Recital 31Public authorities to which personal data are disclosed in accordance with a legal obligation for the exercise of their official mission, such as tax
- Recital 32Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's ag
- Recital 33It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Th
- Recital 34Genetic data should be defined as personal data relating to the inherited or acquired genetic characteristics of a natural person which result from th
- Recital 35Personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the pas
- Recital 36The main establishment of a controller in the Union should be the place of its central administration in the Union, unless the decisions on the purpos
- Recital 37A group of undertakings should cover a controlling undertaking and its controlled undertakings, whereby the controlling undertaking should be the unde
- Recital 38Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned a
- Recital 39Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collecte
- Recital 40In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legiti
- Recital 41Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, w
- Recital 42Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the p
- Recital 43In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific cas
- Recital 44Processing should be lawful where it is necessary in the context of a contract or the intention to enter into a contract.
- Recital 45Where processing is carried out in accordance with a legal obligation to which the controller is subject or where processing is necessary for the perf
- Recital 46The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of t
- Recital 47The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provid
- Recital 48Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting perso
- Recital 49The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e.
- Recital 50The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the pr
- Recital 51Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the conte
- Recital 52Derogating from the prohibition on processing special categories of personal data should also be allowed when provided for in Union or Member State la
- Recital 53Special categories of personal data which merit higher protection should be processed for health-related purposes only where necessary to achieve thos
- Recital 54The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of
- Recital 55Moreover, the processing of personal data by official authorities for the purpose of achieving the aims, laid down by constitutional law or by interna
- Recital 56Where in the course of electoral activities, the operation of the democratic system in a Member State requires that political parties compile personal
- Recital 57If the personal data processed by a controller do not permit the controller to identify a natural person, the data controller should not be obliged to
- Recital 58The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to u
- Recital 59Modalities should be provided for facilitating the exercise of the data subject's rights under this Regulation, including mechanisms to request and, i
- Recital 60The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purpo
- Recital 61The information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection fr
- Recital 62However, it is not necessary to impose the obligation to provide information where the data subject already possesses the information, where the recor
- Recital 63A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and
- Recital 64The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online
- Recital 65A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such d
- Recital 66To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who ha
- Recital 67Methods by which to restrict the processing of personal data could include, inter alia, temporarily moving the selected data to another processing sys
- Recital 68To further strengthen the control over his or her own data, where the processing of personal data is carried out by automated means, the data subject
- Recital 69Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in
- Recital 70Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including
- Recital 71The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or he
- Recital 72Profiling is subject to the rules of this Regulation governing the processing of personal data, such as the legal grounds for processing or data prote
- Recital 73Restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data
- Recital 74The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller's behalf sho
- Recital 75The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead
- Recital 76The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context
- Recital 77Guidance on the implementation of appropriate measures and on the demonstration of compliance by the controller or the processor, especially as regard
- Recital 78The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and org
- Recital 79The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation
- Recital 80Where a controller or a processor not established in the Union is processing personal data of data subjects who are in the Union whose processing acti
- Recital 81To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the control
- Recital 82In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its respon
- Recital 83In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inhe
- Recital 84In order to enhance compliance with this Regulation where processing operations are likely to result in a high risk to the rights and freedoms of natu
- Recital 85A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural perso
- Recital 86The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result
- Recital 87It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately w
- Recital 88In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be g
- Recital 89Directive 95/46/EC provided for a general obligation to notify the processing of personal data to the supervisory authorities. While that obligation p
- Recital 90In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular l
- Recital 91This should in particular apply to large-scale processing operations which aim to process a considerable amount of personal data at regional, national
- Recital 92There are circumstances under which it may be reasonable and economical for the subject of a data protection impact assessment to be broader than a si
- Recital 93In the context of the adoption of the Member State law on which the performance of the tasks of the public authority or public body is based and which
- Recital 94Where a data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitig
- Recital 95The processor should assist the controller, where necessary and upon request, in ensuring compliance with the obligations deriving from the carrying o
- Recital 96A consultation of the supervisory authority should also take place in the course of the preparation of a legislative or regulatory measure which provi
- Recital 97Where the processing is carried out by a public authority, except for courts or independent judicial authorities when acting in their judicial capacit
- Recital 98Associations or other bodies representing categories of controllers or processors should be encouraged to draw up codes of conduct, within the limits
- Recital 99When drawing up a code of conduct, or when amending or extending such a code, associations and other bodies representing categories of controllers or
- Recital 100In order to enhance transparency and compliance with this Regulation, the establishment of certification mechanisms and data protection seals and mark
- Recital 101Flows of personal data to and from countries outside the Union and international organisations are necessary for the expansion of international trade
- Recital 102This Regulation is without prejudice to international agreements concluded between the Union and third countries regulating the transfer of personal d
- Recital 103The Commission may decide with effect for the entire Union that a third country, a territory or specified sector within a third country, or an interna
- Recital 104In line with the fundamental values on which the Union is founded, in particular the protection of human rights, the Commission should, in its assessm
- Recital 105Apart from the international commitments the third country or international organisation has entered into, the Commission should take account of oblig
- Recital 106The Commission should monitor the functioning of decisions on the level of protection in a third country, a territory or specified sector within a thi
- Recital 107The Commission may recognise that a third country, a territory or a specified sector within a third country, or an international organisation no longe
- Recital 108In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third coun
- Recital 109The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by a supervisory authority should
- Recital 110A group of undertakings, or a group of enterprises engaged in a joint economic activity, should be able to make use of approved binding corporate rule
- Recital 111Provisions should be made for the possibility for transfers in certain circumstances where the data subject has given his or her explicit consent, whe
- Recital 112Those derogations should in particular apply to data transfers required and necessary for important reasons of public interest, for example in cases o
- Recital 113Transfers which can be qualified as not repetitive and that only concern a limited number of data subjects, could also be possible for the purposes of
- Recital 114In any case, where the Commission has taken no decision on the adequate level of data protection in a third country, the controller or processor shoul
- Recital 115Some third countries adopt laws, regulations and other legal acts which purport to directly regulate the processing activities of natural and legal pe
- Recital 116When personal data moves across borders outside the Union it may put at increased risk the ability of natural persons to exercise data protection righ
- Recital 117The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence,
- Recital 118The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms reg
- Recital 119Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of th
- Recital 120Each supervisory authority should be provided with the financial and human resources, premises and infrastructure necessary for the effective performa
- Recital 121The general conditions for the member or members of the supervisory authority should be laid down by law in each Member State and should in particular
- Recital 122Each supervisory authority should be competent on the territory of its own Member State to exercise the powers and to perform the tasks conferred on i
- Recital 123The supervisory authorities should monitor the application of the provisions pursuant to this Regulation and contribute to its consistent application
- Recital 124Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union and
- Recital 125The lead authority should be competent to adopt binding decisions regarding measures applying the powers conferred on it in accordance with this Regul
- Recital 126The decision should be agreed jointly by the lead supervisory authority and the supervisory authorities concerned and should be directed towards the m
- Recital 127Each supervisory authority not acting as the lead supervisory authority should be competent to handle local cases where the controller or processor is
- Recital 128The rules on the lead supervisory authority and the one-stop-shop mechanism should not apply where the processing is carried out by public authorities
- Recital 129In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the supervisory authorities should have in each Memb
- Recital 130Where the supervisory authority with which the complaint has been lodged is not the lead supervisory authority, the lead supervisory authority should
- Recital 131Where another supervisory authority should act as a lead supervisory authority for the processing activities of the controller or processor but the co
- Recital 132Awareness-raising activities by supervisory authorities addressed to the public should include specific measures directed at controllers and processor
- Recital 133The supervisory authorities should assist each other in performing their tasks and provide mutual assistance, so as to ensure the consistent applicati
- Recital 134Each supervisory authority should, where appropriate, participate in joint operations with other supervisory authorities. The requested supervisory au
- Recital 135In order to ensure the consistent application of this Regulation throughout the Union, a consistency mechanism for cooperation between the supervisory
- Recital 136In applying the consistency mechanism, the Board should, within a determined period of time, issue an opinion, if a majority of its members so decides
- Recital 137There may be an urgent need to act in order to protect the rights and freedoms of data subjects, in particular when the danger exists that the enforce
- Recital 138The application of such mechanism should be a condition for the lawfulness of a measure intended to produce legal effects by a supervisory authority i
- Recital 139In order to promote the consistent application of this Regulation, the Board should be set up as an independent body of the Union. To fulfil its objec
- Recital 140The Board should be assisted by a secretariat provided by the European Data Protection Supervisor. The staff of the European Data Protection Superviso
- Recital 141Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her hab
- Recital 142Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit
- Recital 143Any natural or legal person has the right to bring an action for annulment of decisions of the Board before the Court of Justice under the conditions
- Recital 144Where a court seized of proceedings against a decision by a supervisory authority has reason to believe that proceedings concerning the same processin
- Recital 145For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States whe
- Recital 146The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. The contr
- Recital 147Where specific rules on jurisdiction are contained in this Regulation, in particular as regards proceedings seeking a judicial remedy including compen
- Recital 148In order to strengthen the enforcement of the rules of this Regulation, penalties including administrative fines should be imposed for any infringemen
- Recital 149Member States should be able to lay down the rules on criminal penalties for infringements of this Regulation, including for infringements of national
- Recital 150In order to strengthen and harmonise administrative penalties for infringements of this Regulation, each supervisory authority should have the power t
- Recital 151The legal systems of Denmark and Estonia do not allow for administrative fines as set out in this Regulation. The rules on administrative fines may be
- Recital 152Where this Regulation does not harmonise administrative penalties or where necessary in other cases, for example in cases of serious infringements of
- Recital 153Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or litera
- Recital 154This Regulation allows the principle of public access to official documents to be taken into account when applying this Regulation. Public access to o
- Recital 155Member State law or collective agreements, including ‘works agreements’, may provide for specific rules on the processing of employees' personal data
- Recital 156The processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shou
- Recital 157By coupling information from registries, researchers can obtain new knowledge of great value with regard to widespread medical conditions such as card
- Recital 158Where personal data are processed for archiving purposes, this Regulation should also apply to that processing, bearing in mind that this Regulation s
- Recital 159Where personal data are processed for scientific research purposes, this Regulation should also apply to that processing. For the purposes of this Reg
- Recital 160Where personal data are processed for historical research purposes, this Regulation should also apply to that processing. This should also include his
- Recital 161For the purpose of consenting to the participation in scientific research activities in clinical trials, the relevant provisions of Regulation (EU) No
- Recital 162Where personal data are processed for statistical purposes, this Regulation should apply to that processing. Union or Member State law should, within
- Recital 163The confidential information which the Union and national statistical authorities collect for the production of official European and official nationa
- Recital 164As regards the powers of the supervisory authorities to obtain from the controller or processor access to personal data and access to their premises,
- Recital 165This Regulation respects and does not prejudice the status under existing constitutional law of churches and religious associations or communities in
- Recital 166In order to fulfil the objectives of this Regulation, namely to protect the fundamental rights and freedoms of natural persons and in particular their
- Recital 167In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission when provid
- Recital 168The examination procedure should be used for the adoption of implementing acts on standard contractual clauses between controllers and processors and
- Recital 169The Commission should adopt immediately applicable implementing acts where available evidence reveals that a third country, a territory or a specified
- Recital 170Since the objective of this Regulation, namely to ensure an equivalent level of protection of natural persons and the free flow of personal data throu
- Recital 171Directive 95/46/EC should be repealed by this Regulation. Processing already under way on the date of application of this Regulation should be brought
- Recital 172The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 and delivered an opinion on 7 Mar
- Recital 173This Regulation should apply to all matters concerning the protection of fundamental rights and freedoms vis-à-vis the processing of personal data whi
Nothing matches.