+REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance)
---+CHAPTER I General provisions
------+Article 1 Subject-matter and objectives
---------+Article 1 1.
---------+Article 1 2.
---------+Article 1 3.
------+Article 2 Material scope
---------+Article 2 1.
---------+Article 2 2.
---------+Article 2 3.
---------+Article 2 4.
------+Article 3 Territorial scope
---------+Article 3 1.
---------+Article 3 2.
---------+Article 3 3.
------+Article 4 Definitions
---+CHAPTER II Principles
------+Article 5 Principles relating to processing of personal data
---------+Article 5 1.
---------+Article 5 2.
------+Article 6 Lawfulness of processing
---------+Article 6 1.
---------+Article 6 2.
---------+Article 6 3.
---------+Article 6 4.
------+Article 7 Conditions for consent
---------+Article 7 1.
---------+Article 7 2.
---------+Article 7 3.
---------+Article 7 4.
------+Article 8 Conditions applicable to child's consent in relation to information society services
---------+Article 8 1.
---------+Article 8 2.
---------+Article 8 3.
------+Article 9 Processing of special categories of personal data
---------+Article 9 1.
---------+Article 9 2.
---------+Article 9 3.
---------+Article 9 4.
------+Article 10 Processing of personal data relating to criminal convictions and offences
------+Article 11 Processing which does not require identification
---------+Article 11 1.
---------+Article 11 2.
---+CHAPTER III Rights of the data subject
------+Section 1 Transparency and modalities
---------+Article 12 Transparent information, communication and modalities for the exercise of the rights of the data subject
------------+Article 12 1.
------------+Article 12 2.
------------+Article 12 3.
------------+Article 12 4.
------------+Article 12 5.
------------+Article 12 6.
------------+Article 12 7.
------------+Article 12 8.
------+Section 2 Information and access to personal data
---------+Article 13 Information to be provided where personal data are collected from the data subject
------------+Article 13 1.
------------+Article 13 2.
------------+Article 13 3.
------------+Article 13 4.
---------+Article 14 Information to be provided where personal data have not been obtained from the data subject
------------+Article 14 1.
------------+Article 14 2.
------------+Article 14 3.
------------+Article 14 4.
------------+Article 14 5.
---------+Article 15 Right of access by the data subject
------------+Article 15 1.
------------+Article 15 2.
------------+Article 15 3.
------------+Article 15 4.
------+Section 3 Rectification and erasure
---------+Article 16 Right to rectification
---------+Article 17 Right to erasure (‘right to be forgotten’)
------------+Article 17 1.
------------+Article 17 2.
------------+Article 17 3.
---------+Article 18 Right to restriction of processing
------------+Article 18 1.
------------+Article 18 2.
------------+Article 18 3.
---------+Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing
---------+Article 20 Right to data portability
------------+Article 20 1.
------------+Article 20 2.
------------+Article 20 3.
------------+Article 20 4.
------+Section 4 Right to object and automated individual decision-making
---------+Article 21 Right to object
------------+Article 21 1.
------------+Article 21 2.
------------+Article 21 3.
------------+Article 21 4.
------------+Article 21 5.
------------+Article 21 6.
---------+Article 22 Automated individual decision-making, including profiling
------------+Article 22 1.
------------+Article 22 2.
------------+Article 22 3.
------------+Article 22 4.
------+Section 5 Restrictions
---------+Article 23 Restrictions
------------+Article 23 1.
------------+Article 23 2.
---+CHAPTER IV Controller and processor
------+Section 1 General obligations
---------+Article 24 Responsibility of the controller
------------+Article 24 1.
------------+Article 24 2.
------------+Article 24 3.
---------+Article 25 Data protection by design and by default
------------+Article 25 1.
------------+Article 25 2.
------------+Article 25 3.
---------+Article 26 Joint controllers
------------+Article 26 1.
------------+Article 26 2.
------------+Article 26 3.
---------+Article 27 Representatives of controllers or processors not established in the Union
------------+Article 27 1.
------------+Article 27 2.
------------+Article 27 3.
------------+Article 27 4.
------------+Article 27 5.
---------+Article 28 Processor
------------+Article 28 1.
------------+Article 28 2.
------------+Article 28 3.
------------+Article 28 4.
------------+Article 28 5.
------------+Article 28 6.
------------+Article 28 7.
------------+Article 28 8.
------------+Article 28 9.
------------+Article 28 10.
---------+Article 29 Processing under the authority of the controller or processor
---------+Article 30 Records of processing activities
------------+Article 30 1.
------------+Article 30 2.
------------+Article 30 3.
------------+Article 30 4.
------------+Article 30 5.
---------+Article 31 Cooperation with the supervisory authority
------+Section 2 Security of personal data
---------+Article 32 Security of processing
------------+Article 32 1.
------------+Article 32 2.
------------+Article 32 3.
------------+Article 32 4.
---------+Article 33 Notification of a personal data breach to the supervisory authority
------------+Article 33 1.
------------+Article 33 2.
------------+Article 33 3.
------------+Article 33 4.
------------+Article 33 5.
---------+Article 34 Communication of a personal data breach to the data subject
------------+Article 34 1.
------------+Article 34 2.
------------+Article 34 3.
------------+Article 34 4.
------+Section 3 Data protection impact assessment and prior consultation
---------+Article 35 Data protection impact assessment
------------+Article 35 1.
------------+Article 35 2.
------------+Article 35 3.
------------+Article 35 4.
------------+Article 35 5.
------------+Article 35 6.
------------+Article 35 7.
------------+Article 35 8.
------------+Article 35 9.
------------+Article 35 10.
------------+Article 35 11.
---------+Article 36 Prior consultation
------------+Article 36 1.
------------+Article 36 2.
------------+Article 36 3.
------------+Article 36 4.
------------+Article 36 5.
------+Section 4 Data protection officer
---------+Article 37 Designation of the data protection officer
------------+Article 37 1.
------------+Article 37 2.
------------+Article 37 3.
------------+Article 37 4.
------------+Article 37 5.
------------+Article 37 6.
------------+Article 37 7.
---------+Article 38 Position of the data protection officer
------------+Article 38 1.
------------+Article 38 2.
------------+Article 38 3.
------------+Article 38 4.
------------+Article 38 5.
------------+Article 38 6.
---------+Article 39 Tasks of the data protection officer
------------+Article 39 1.
------------+Article 39 2.
------+Section 5 Codes of conduct and certification
---------+Article 40 Codes of conduct
------------+Article 40 1.
------------+Article 40 2.
------------+Article 40 3.
------------+Article 40 4.
------------+Article 40 5.
------------+Article 40 6.
------------+Article 40 7.
------------+Article 40 8.
------------+Article 40 9.
------------+Article 40 10.
------------+Article 40 11.
---------+Article 41 Monitoring of approved codes of conduct
------------+Article 41 1.
------------+Article 41 2.
------------+Article 41 3.
------------+Article 41 4.
------------+Article 41 5.
------------+Article 41 6.
---------+Article 42 Certification
------------+Article 42 1.
------------+Article 42 2.
------------+Article 42 3.
------------+Article 42 4.
------------+Article 42 5.
------------+Article 42 6.
------------+Article 42 7.
------------+Article 42 8.
---------+Article 43 Certification bodies
------------+Article 43 1.
------------+Article 43 2.
------------+Article 43 3.
------------+Article 43 4.
------------+Article 43 5.
------------+Article 43 6.
------------+Article 43 7.
------------+Article 43 8.
------------+Article 43 9.
---+CHAPTER V Transfers of personal data to third countries or international organisations
------+Article 44 General principle for transfers
------+Article 45 Transfers on the basis of an adequacy decision
---------+Article 45 1.
---------+Article 45 2.
---------+Article 45 3.
---------+Article 45 4.
---------+Article 45 5.
---------+Article 45 6.
---------+Article 45 7.
---------+Article 45 8.
---------+Article 45 9.
------+Article 46 Transfers subject to appropriate safeguards
---------+Article 46 1.
---------+Article 46 2.
---------+Article 46 3.
---------+Article 46 4.
---------+Article 46 5.
------+Article 47 Binding corporate rules
---------+Article 47 1.
---------+Article 47 2.
---------+Article 47 3.
------+Article 48 Transfers or disclosures not authorised by Union law
------+Article 49 Derogations for specific situations
---------+Article 49 1.
---------+Article 49 2.
---------+Article 49 3.
---------+Article 49 4.
---------+Article 49 5.
---------+Article 49 6.
------+Article 50 International cooperation for the protection of personal data
---+CHAPTER VI Independent supervisory authorities
------+Section 1 Independent status
---------+Article 51 Supervisory authority
------------+Article 51 1.
------------+Article 51 2.
------------+Article 51 3.
------------+Article 51 4.
---------+Article 52 Independence
------------+Article 52 1.
------------+Article 52 2.
------------+Article 52 3.
------------+Article 52 4.
------------+Article 52 5.
------------+Article 52 6.
---------+Article 53 General conditions for the members of the supervisory authority
------------+Article 53 1.
------------+Article 53 2.
------------+Article 53 3.
------------+Article 53 4.
---------+Article 54 Rules on the establishment of the supervisory authority
------------+Article 54 1.
------------+Article 54 2.
------+Section 2 Competence, tasks and powers
---------+Article 55 Competence
------------+Article 55 1.
------------+Article 55 2.
------------+Article 55 3.
---------+Article 56 Competence of the lead supervisory authority
------------+Article 56 1.
------------+Article 56 2.
------------+Article 56 3.
------------+Article 56 4.
------------+Article 56 5.
------------+Article 56 6.
---------+Article 57 Tasks
------------+Article 57 1.
------------+Article 57 2.
------------+Article 57 3.
------------+Article 57 4.
---------+Article 58 Powers
------------+Article 58 1.
------------+Article 58 2.
------------+Article 58 3.
------------+Article 58 4.
------------+Article 58 5.
------------+Article 58 6.
---------+Article 59 Activity reports
---+CHAPTER VII Cooperation and consistency
------+Section 1 Cooperation
---------+Article 60 Cooperation between the lead supervisory authority and the other supervisory authorities concerned
------------+Article 60 1.
------------+Article 60 2.
------------+Article 60 3.
------------+Article 60 4.
------------+Article 60 5.
------------+Article 60 6.
------------+Article 60 7.
------------+Article 60 8.
------------+Article 60 9.
------------+Article 60 10.
------------+Article 60 11.
------------+Article 60 12.
---------+Article 61 Mutual assistance
------------+Article 61 1.
------------+Article 61 2.
------------+Article 61 3.
------------+Article 61 4.
------------+Article 61 5.
------------+Article 61 6.
------------+Article 61 7.
------------+Article 61 8.
------------+Article 61 9.
---------+Article 62 Joint operations of supervisory authorities
------------+Article 62 1.
------------+Article 62 2.
------------+Article 62 3.
------------+Article 62 4.
------------+Article 62 5.
------------+Article 62 6.
------------+Article 62 7.
------+Section 2 Consistency
---------+Article 63 Consistency mechanism
---------+Article 64 Opinion of the Board
------------+Article 64 1.
------------+Article 64 2.
------------+Article 64 3.
------------+Article 64 4.
------------+Article 64 5.
------------+Article 64 6.
------------+Article 64 7.
------------+Article 64 8.
---------+Article 65 Dispute resolution by the Board
------------+Article 65 1.
------------+Article 65 2.
------------+Article 65 3.
------------+Article 65 4.
------------+Article 65 5.
------------+Article 65 6.
---------+Article 66 Urgency procedure
------------+Article 66 1.
------------+Article 66 2.
------------+Article 66 3.
------------+Article 66 4.
---------+Article 67 Exchange of information
------+Section 3 European data protection board
---------+Article 68 European Data Protection Board
------------+Article 68 1.
------------+Article 68 2.
------------+Article 68 3.
------------+Article 68 4.
------------+Article 68 5.
------------+Article 68 6.
---------+Article 69 Independence
------------+Article 69 1.
------------+Article 69 2.
---------+Article 70 Tasks of the Board
------------+Article 70 1.
------------+Article 70 2.
------------+Article 70 3.
------------+Article 70 4.
---------+Article 71 Reports
------------+Article 71 1.
------------+Article 71 2.
---------+Article 72 Procedure
------------+Article 72 1.
------------+Article 72 2.
---------+Article 73 Chair
------------+Article 73 1.
------------+Article 73 2.
---------+Article 74 Tasks of the Chair
------------+Article 74 1.
------------+Article 74 2.
---------+Article 75 Secretariat
------------+Article 75 1.
------------+Article 75 2.
------------+Article 75 3.
------------+Article 75 4.
------------+Article 75 5.
------------+Article 75 6.
---------+Article 76 Confidentiality
------------+Article 76 1.
------------+Article 76 2.
---+CHAPTER VIII Remedies, liability and penalties
------+Article 77 Right to lodge a complaint with a supervisory authority
---------+Article 77 1.
---------+Article 77 2.
------+Article 78 Right to an effective judicial remedy against a supervisory authority
---------+Article 78 1.
---------+Article 78 2.
---------+Article 78 3.
---------+Article 78 4.
------+Article 79 Right to an effective judicial remedy against a controller or processor
---------+Article 79 1.
---------+Article 79 2.
------+Article 80 Representation of data subjects
---------+Article 80 1.
---------+Article 80 2.
------+Article 81 Suspension of proceedings
---------+Article 81 1.
---------+Article 81 2.
---------+Article 81 3.
------+Article 82 Right to compensation and liability
---------+Article 82 1.
---------+Article 82 2.
---------+Article 82 3.
---------+Article 82 4.
---------+Article 82 5.
---------+Article 82 6.
------+Article 83 General conditions for imposing administrative fines
---------+Article 83 1.
---------+Article 83 2.
---------+Article 83 3.
---------+Article 83 4.
---------+Article 83 5.
---------+Article 83 6.
---------+Article 83 7.
---------+Article 83 8.
---------+Article 83 9.
------+Article 84 Penalties
---------+Article 84 1.
---------+Article 84 2.
---+CHAPTER IX Provisions relating to specific processing situations
------+Article 85 Processing and freedom of expression and information
---------+Article 85 1.
---------+Article 85 2.
---------+Article 85 3.
------+Article 86 Processing and public access to official documents
------+Article 87 Processing of the national identification number
------+Article 88 Processing in the context of employment
---------+Article 88 1.
---------+Article 88 2.
---------+Article 88 3.
------+Article 89 Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
---------+Article 89 1.
---------+Article 89 2.
---------+Article 89 3.
---------+Article 89 4.
------+Article 90 Obligations of secrecy
---------+Article 90 1.
---------+Article 90 2.
------+Article 91 Existing data protection rules of churches and religious associations
---------+Article 91 1.
---------+Article 91 2.
---+CHAPTER X Delegated acts and implementing acts
------+Article 92 Exercise of the delegation
---------+Article 92 1.
---------+Article 92 2.
---------+Article 92 3.
---------+Article 92 4.
---------+Article 92 5.
------+Article 93 Committee procedure
---------+Article 93 1.
---------+Article 93 2.
---------+Article 93 3.
---+CHAPTER XI Final provisions
------+Article 94 Repeal of Directive 95/46/EC
---------+Article 94 1.
---------+Article 94 2.
------+Article 95 Relationship with Directive 2002/58/EC
------+Article 96 Relationship with previously concluded Agreements
------+Article 97 Commission reports
---------+Article 97 1.
---------+Article 97 2.
---------+Article 97 3.
---------+Article 97 4.
---------+Article 97 5.
------+Article 98 Review of other Union legal acts on data protection
------+Article 99 Entry into force and application
---------+Article 99 1.
---------+Article 99 2.
 English - European Union - Data Privacy -

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance)

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 27 April 2016

on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

(Text with EEA relevance)

This Regulation shall be binding in its entirety and directly applicable in all Member States.

1. Overview

,
CHAPTER I General provisions CHAPTER I General provisions
CHAPTER II Principles CHAPTER II Principles
CHAPTER III Rights of the data subject CHAPTER III Rights of the data subject
CHAPTER IV Controller and processor CHAPTER IV Controller and processor
CHAPTER V Transfers of personal data to third countries or international organisations CHAPTER V Transfers of personal data to third countries or international organisations
CHAPTER VI Independent supervisory authorities CHAPTER VI Independent supervisory authorities
CHAPTER VII Cooperation and consistency CHAPTER VII Cooperation and consistency
CHAPTER VIII Remedies, liability and penalties CHAPTER VIII Remedies, liability and penalties
CHAPTER IX Provisions relating to specific processing situations CHAPTER IX Provisions relating to specific processing situations
CHAPTER X Delegated acts and implementing acts CHAPTER X Delegated acts and implementing acts
CHAPTER XI Final provisions CHAPTER XI Final provisions

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

Requirements

3. Related Standards

Standards