General Data Protection Regulation — Regulation (EU) 2016/679

Overview

This Regulation establishes rules for the protection of natural persons concerning the processing of their personal data and for the free movement of such data. It aims to protect the fundamental rights and freedoms of individuals, particularly their right to the protection of personal data. (Art. 1)

The Regulation applies to the processing of personal data by automated means or in a structured filing system. It covers controllers and processors established in the EU, as well as those outside the EU if they offer goods or services to, or monitor the behaviour of, data subjects within the Union. It does not apply to processing for purely personal/household activities or for law enforcement and national security purposes. (Art. 2 Art. 3)

Key points

• Personal data must be processed lawfully, fairly, and transparently; collected for specified, explicit, and legitimate purposes; and be adequate, relevant, and limited to what is necessary ('data minimisation'). (Art. 5)
• Processing is only lawful if there is a valid legal basis, such as the data subject's consent, contractual necessity, a legal obligation, protection of vital interests, a task in the public interest, or the controller's legitimate interests. (Art. 6)
• Data subjects are granted several rights, including the right of access to their data, rectification of inaccuracies, erasure ('right to be forgotten'), restriction of processing, data portability, and the right to object to processing. (Art. 15 Art. 16 Art. 17 Art. 18 Art. 20 Art. 21)
• Controllers must implement technical and organisational measures to ensure and demonstrate compliance, including data protection by design and by default, and must notify the supervisory authority of a personal data breach without undue delay. (Art. 24 Art. 25 Art. 33)
• Transfers of personal data to countries outside the EU are restricted unless the Commission has decided the country provides an adequate level of protection, or if appropriate safeguards (like standard contractual clauses or binding corporate rules) are in place. (Art. 44 Art. 45 Art. 46)
• Supervisory authorities in each Member State are empowered to monitor and enforce the regulation, including by imposing significant administrative fines for infringements, up to €20 million or 4% of worldwide annual turnover. (Art. 51 Art. 58 Art. 83)

Structure

The Regulation begins with General Provisions (Ch. I) defining its scope and key terms, followed by Principles (Ch. II) for lawful data processing. Chapter III details the Rights of the Data Subject. Chapter IV outlines the obligations of Controllers and Processors, including security and impact assessments. Chapter V governs international data transfers. Chapters VI-VIII establish the roles and cooperation of independent Supervisory Authorities and the European Data Protection Board, as well as remedies and penalties. The remaining chapters cover specific processing situations, delegated acts, and final provisions.

Related instruments

• Article 25(6) of Directive 95/46/EC (31995L0046) — This Regulation repeals and replaces Directive 95/46/EC, which was the previous EU data protection framework.
• Directive 2002/58/EC (32002L0058) — This Regulation does not impose additional obligations where specific rules with the same objective are set out in the ePrivacy Directive (2002/58/EC) concerning electronic communications services.
• Regulation (EC) No 45/2001 — This Regulation's principles and rules are to be adapted for the processing of personal data by Union institutions and bodies, which are governed by Regulation (EC) No 45/2001.