Home › Governance › GDPR — Regulation (EU) 2016/679
NOVARIC® — GDPR — Regulation (EU) 2016/679
General Data Protection Regulation — protection of natural persons in relation to processing of personal data and free movement of such data
☰ TABLE OF CONTENTS — Click to expand
General Data Protection Regulation — Regulation (EU) 2016/679 — OJ L 119, 4.5.2016
Reference: Regulation (EU) 2016/679 — OJ L 119/1, 4.5.2016 — CELEX: 32016R0679 | Document ID: NOVARIC-POL-GD-001 | Classification: Public
Published on NOVARIC® for reference and compliance. This is not legal advice. For the authoritative text consult
the official EUR-Lex source ↗
Repealing: Directive 95/46/EC & Decision 2000/520/EC
OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
of 27 April 2016 — on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC — General Data Protection Regulation (GDPR)
THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Having regard to the opinion of the European Economic and Social Committee,
Having regard to the opinion of the Committee of the Regions,
Acting in accordance with the ordinary legislative procedure,
Whereas:
Recitals — Whereas (1)–(173)
The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.
The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.
Directive 95/46/EC of the European Parliament and of the Council seeks to harmonise the protection of fundamental rights and freedoms of natural persons in respect of processing activities and to ensure the free flow of personal data between Member States.
The processing of personal data should be designed to serve mankind. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.
The economic and social integration resulting from the functioning of the internal market has led to a substantial increase in cross-border flows of personal data.
Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of the collection and sharing of personal data has increased significantly.
Those developments require a strong and more coherent data protection framework in the Union, backed by strong enforcement, given the importance of creating the trust that will allow the digital economy to develop across the internal market.
Where this Regulation provides for specifications or restrictions of its rules by Member State law, Member States may, as far as necessary for coherence and for making the national provisions comprehensible to the persons to whom they apply, incorporate elements of this Regulation into their national law.
The objectives and principles of Directive 95/46/EC remain sound, but it has not prevented fragmentation in the implementation of data protection across the Union, legal uncertainty or a widespread public perception that there are significant risks to the protection of natural persons, in particular with regard to online activity.
In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States.
Recitals (11)–(173) continue in the same format. See the official EUR-Lex publication for the complete authoritative text of all 173 recitals.
General provisions — Art. 1–4
1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.
2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.
3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of personal data.
1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
2. This Regulation does not apply to the processing of personal data in the course of an activity which falls outside the scope of Union law; by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU; by a natural person in the course of a purely personal or household activity; by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences.
1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union.
For the purposes of this Regulation, the following definitions apply:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;
‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information;
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;
‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
Principles — Art. 5–11
1. Personal data shall be:
processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (‘purpose limitation’);
adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
accurate and, where necessary, kept up to date (‘accuracy’);
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (‘storage limitation’);
processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage (‘integrity and confidentiality’).
2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
1. Processing shall be lawful only if and to the extent that at least one of the following applies:
the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
processing is necessary for compliance with a legal obligation to which the controller is subject;
processing is necessary in order to protect the vital interests of the data subject or of another natural person;
processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
2. If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.
3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
Full text of Article 8 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 9 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 10 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 11 — see the official EUR-Lex publication for the authoritative text.
Rights of the data subject — Art. 12–23
Full text of Article 12 — see the official EUR-Lex publication for the authoritative text.
1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information: (a) the identity and the contact details of the controller; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing and the legal basis; (d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued; (e) the recipients or categories of recipients, if any; (f) where applicable, transfers to third countries and related safeguards.
2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with further information necessary to ensure fair and transparent processing, including: (a) the period for which the personal data will be stored; (b) the existence of the right to request access, rectification, erasure or restriction; (c) where processing is based on consent, the right to withdraw consent at any time; (d) the right to lodge a complaint with a supervisory authority.
Full text of Article 14 — see the official EUR-Lex publication for the authoritative text.
1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and information on: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients to whom the personal data have been or will be disclosed; (d) where possible, the envisaged period for which the personal data will be stored; (e) the existence of the right to request rectification, erasure or restriction; (f) the right to lodge a complaint with a supervisory authority.
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing;
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation.
3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and information; (b) for compliance with a legal obligation; (c) for reasons of public interest in the area of public health; (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; (e) for the establishment, exercise or defence of legal claims.
1. The data subject shall have the right to obtain from the controller restriction of processing where the accuracy of the personal data is contested; the processing is unlawful and the data subject opposes erasure; the controller no longer needs the personal data but they are required by the data subject for legal claims; or the data subject has objected to processing pursuant to Article 21(1).
Full text of Article 19 — see the official EUR-Lex publication for the authoritative text.
1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
the processing is based on consent pursuant to point (a) of Article 6(1) or on a contract pursuant to point (b) of Article 6(1); and
the processing is carried out by automated means.
1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject.
2. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing.
Full text of Article 22 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 23 — see the official EUR-Lex publication for the authoritative text.
Controller and processor — Art. 24–43
Full text of Article 24 — see the official EUR-Lex publication for the authoritative text.
1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner.
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.
Full text of Article 26 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 27 — see the official EUR-Lex publication for the authoritative text.
1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.
3. Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.
Full text of Article 29 — see the official EUR-Lex publication for the authoritative text.
1. Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: (a) the name and contact details of the controller; (b) the purposes of the processing; (c) a description of the categories of data subjects and of the categories of personal data; (d) the categories of recipients; (e) transfers to third countries; (f) where possible, the envisaged time limits for erasure; (g) a general description of the technical and organisational security measures.
Full text of Article 31 — see the official EUR-Lex publication for the authoritative text.
1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
the pseudonymisation and encryption of personal data;
the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
3. The notification referred to in paragraph 1 shall at least: (a) describe the nature of the personal data breach including the categories and approximate number of data subjects concerned; (b) communicate the contact details of the data protection officer; (c) describe the likely consequences of the personal data breach; (d) describe the measures taken or proposed to be taken to address the personal data breach.
Full text of Article 34 — see the official EUR-Lex publication for the authoritative text.
1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data.
3. A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of: (a) a systematic and extensive evaluation of personal aspects based on automated processing, including profiling; (b) processing on a large scale of special categories of data; (c) a systematic monitoring of a publicly accessible area on a large scale.
Full text of Article 36 — see the official EUR-Lex publication for the authoritative text.
1. The controller and the processor shall designate a data protection officer in any case where:
the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.
Full text of Article 38 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 39 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 40 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 41 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 42 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 43 — see the official EUR-Lex publication for the authoritative text.
Transfers of personal data to third countries or international organisations — Art. 44–49
Full text of Article 44 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 45 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 46 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 47 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 48 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 49 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 50 — see the official EUR-Lex publication for the authoritative text.
Independent supervisory authorities — Art. 50–59
Full text of Article 51 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 52 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 53 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 54 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 55 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 56 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 57 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 58 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 59 — see the official EUR-Lex publication for the authoritative text.
Cooperation and consistency — Art. 60–76
Full text of Article 60 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 61 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 62 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 63 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 64 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 65 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 66 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 67 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 68 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 69 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 70 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 71 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 72 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 73 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 74 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 75 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 76 — see the official EUR-Lex publication for the authoritative text.
Remedies, liability and penalties — Art. 77–84
Full text of Article 77 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 78 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 79 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 80 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 81 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 82 — see the official EUR-Lex publication for the authoritative text.
4. Infringements of the following provisions shall be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher: the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43.
5. Infringements of the following provisions shall be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher:
the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;
the data subjects’ rights pursuant to Articles 12 to 22;
the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49.
Full text of Article 84 — see the official EUR-Lex publication for the authoritative text.
Provisions relating to specific processing situations — Art. 85–91
Full text of Article 85 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 86 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 87 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 88 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 89 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 90 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 91 — see the official EUR-Lex publication for the authoritative text.
Delegated acts and implementing acts — Art. 92–93
Full text of Article 92 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 93 — see the official EUR-Lex publication for the authoritative text.
Final provisions — Art. 94–99
Full text of Article 94 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 95 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 96 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 97 — see the official EUR-Lex publication for the authoritative text.
Full text of Article 98 — see the official EUR-Lex publication for the authoritative text.
1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
2. It shall apply from 25 May 2018.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Brussels, 27 April 2016.