Processes personal data, in the European Union

Regulation (EU) 2016/679 · Read the law's page

• Establish and document a lawful basis under Article 6 before processing any personal data of a person in the EU.
• Allocate and document controller and processor responsibilities in a written agreement wherever a third party processes personal data on your behalf, and appoint a Data Protection Officer where your core activities involve large scale monitoring or large scale special category processing.controllerprocessor

Regulation (EU) 2016/679, Art. 30 · Read the law's page

• If you are a controller, a processor or the representative of either, keep the records of processing activities that Article 30(1) and (2) require, unless you are an enterprise or organization employing fewer than 250 persons and none of the three conditions in Article 30(5) is met: the processing you carry out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10 (Article 30(5)).controllerprocessor
• If you are a controller or the controller's representative, maintain a record of processing activities under your responsibility containing the name and contact details of the controller, any joint controller, the representative and the data protection officer, the purposes of the processing, a description of the categories of data subjects and of personal data, the categories of recipients, and, where applicable, transfers to a third country or international organization with the documentation of suitable safeguards for the transfers referred to in the second subparagraph of Article 49(1) (Article 30(1), points (a) to (e)).controller
• In the controller's record, include where possible the envisaged time limits for erasure of the different categories of data and a general description of the technical and organizational security measures referred to in Article 32(1) (Article 30(1), points (f) and (g)).controller
• If you are a processor or the processor's representative, maintain a record of all categories of processing activities carried out on behalf of a controller, containing the name and contact details of the processor and of each controller, the categories of processing carried out on behalf of each controller, where applicable the transfers to a third country or international organization, and where possible a general description of the technical and organizational security measures referred to in Article 32(1) (Article 30(2)).processor
• Keep the records in writing, including in electronic form (Article 30(3)).controllerprocessor
• Make the record available to the supervisory authority on request (Article 30(4)).controllerprocessor

Regulation (EU) 2016/679, Art. 4(1) and (5), recital 26 · Read the law's page

• If you hold the additional information that attributes pseudonymised data to a natural person, treat the pseudonymised data as personal data and apply the Regulation to it (Article 4(1) and (5) and recital 26).
• For processing to count as pseudonymisation, keep the additional information needed to attribute the data to a specific data subject separately and subject it to technical and organisational measures that ensure the data are not attributed to an identified or identifiable natural person (Article 4(5)).
• If you receive pseudonymised data, treat it as personal data unless you are not in a position to lift the pseudonymisation measures during any processing under your control and the measures in fact prevent you from attributing the data to the person, including by cross-checking with other factors, judged by the means reasonably likely to be used, with regard to cost, time, available technology and technological developments (recital 26; Case C-413/23 P, paragraphs 77 and 85 to 86).
• If you pass pseudonymised data to a recipient, assess whether the data subject is identifiable from your own point of view as controller at the time of collection, whether or not the data are personal for the recipient, when you give the data subject the information about recipients (Case C-413/23 P, paragraphs 111 and 112, decided on the corresponding duty in Regulation (EU) 2018/1725).
• Where you apply pseudonymisation as a security or design measure, treat it as one of the technical and organisational measures Article 32(1), point (a), and Article 25(1) refer to, and not as a ground for taking the data outside the Regulation (Articles 25(1) and 32(1), point (a), and recital 28).

Regulation (EU) 2016/679, Art. 5 · Read the law's page

• If you process personal data, apply the principles in Article 5(1) to that processing; if you are the controller, you are responsible for compliance with them and must be able to demonstrate it (Article 5(1) and (2)).
• Process personal data lawfully, fairly and in a transparent manner in relation to the data subject (Article 5(1), point (a)).
• Collect personal data for specified, explicit and legitimate purposes and do not further process it in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is not considered incompatible, in accordance with Article 89(1) (Article 5(1), point (b)).
• Limit personal data to what is adequate, relevant and necessary in relation to the purposes for which it is processed, data minimization (Article 5(1), point (c)).
• Keep personal data accurate and, where necessary, up to date, and take every reasonable step to ensure that inaccurate personal data, having regard to the purposes for which it is processed, are erased or rectified without delay (Article 5(1), point (d)).
• Keep personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed, storage limitation; store it for longer only insofar as it will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to the technical and organizational measures the Regulation requires to safeguard the rights and freedoms of the data subject (Article 5(1), point (e)).
• Process personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (Article 5(1), point (f)).
• If you are the controller, be responsible for, and be able to demonstrate compliance with, each of the principles in Article 5(1) (Article 5(2)).controller

Regulation (EU) 2016/679, Art. 9 · Read the law's page

• Obtain explicit consent, or establish another Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
• Treat any biometric identifier your system derives through its own technical processing for the purpose of uniquely identifying a person as special category data, even where the underlying image or audio was lawfully public.

Regulation (EU) 2016/679, Arts. 12-21 · Read the law's page

• Honor a data subject's request to access, rectify, erase, restrict, port, or object to processing of their personal data within one month of receipt, a period that can be extended by two further months where necessary given the complexity and number of requests (Article 12(3)).controller

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify the competent supervisory authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting EU personal data, unless the breach is unlikely to risk individuals' rights and freedoms.controller
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).processor
• Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.controller

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on a Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data covered by the Regulation outside the EEA.

Regulation (EU) 2016/679, Arts. 51-59, 68-76, 77-84 · Read the law's page

• Where you process personal data in the context of an establishment in the Union, or from outside it offer goods or services to people in the Union or monitor their behaviour there, provide the supervisory authority with any information it orders you to provide for the performance of its tasks, and give it access to all personal data and information necessary for those tasks and to your premises and data-processing equipment (Article 58(1), points (a), (e) and (f)).

Commission Implementing Decision (EU) 2019/419 · Read the law's page

• A transfer of personal data from the European Union to a personal information handling business operator in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules in Annex I may take place on the basis of Article 1(1) of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).
• The finding does not cover a transfer to a broadcasting institution, newspaper publisher, communication agency or other press organization, a person engaged in professional writing, a university or other academic organization, a religious body or a political body, to the extent the purposes of processing correspond to the purpose listed for that category (Article 1(2)).

Commission Implementing Decision (EU) 2021/914 · Read the law's page

• A transfer by a controller or processor to a controller or (sub-)processor whose processing of the data is not subject to Regulation (EU) 2016/679 is treated as having appropriate safeguards under Article 46(1) and (2)(c) where the Clauses in the Annex are used (Article 1(1)); the Clauses may not be modified, except to select the appropriate Module or to add or update information in the Appendix (Clause 2(a)).
• The data exporter and the data importer warrant that they have no reason to believe that the laws and practices of the third country of destination prevent the importer from fulfilling its obligations under the Clauses, having taken due account of the circumstances of the transfer, the laws and practices of the destination and any supplementary safeguards (Clause 14(a) and (b)).
• The Parties document the assessment under Clause 14(b) and make it available to the competent supervisory authority on request (Clause 14(d)).
• The data importer notifies the data exporter promptly if it has reason to believe that it is or has become subject to laws or practices not in line with Clause 14(a); the data exporter then promptly identifies appropriate measures and suspends the transfer if it considers that no appropriate safeguards can be ensured, or if instructed to do so by the competent supervisory authority (Clause 14(e) and (f)).
• The data importer notifies the data exporter and, where possible, the data subject promptly of a legally binding request from a public authority for disclosure of the transferred data or of any direct access by public authorities, and reviews the legality of the request and challenges it where there are reasonable grounds to consider it unlawful (Clauses 15.1(a) and 15.2(a)).
• Each Party is able to demonstrate compliance with the Clauses, and the data importer keeps appropriate documentation of its processing and makes it available to the competent supervisory authority on request (Clause 8.9 in Modules One to Three).
• For Modules One to Three, the Clauses are governed by the law of an EU Member State that allows third-party beneficiary rights and disputes are resolved by the courts of an EU Member State, and a data subject may also bring proceedings in the courts of the Member State of habitual residence (Clauses 17 and 18).

Commission Implementing Decision (EU) 2021/1772 · Read the law's page

• A transfer of personal data within the scope of Regulation (EU) 2016/679 from the Union to the United Kingdom may take place on the basis of Article 1(1) of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).

Commission Implementing Decision (EU) 2022/254 · Read the law's page

• A transfer of personal data from the European Union to an entity in the Republic of Korea subject to the Personal Information Protection Act as complemented by the additional safeguards in Annex I may take place on the basis of Article 1(1) of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).
• The finding does not cover a transfer to a religious organization, to the extent it processes the data for its missionary activities, to a political party, to the extent it processes the data in the context of the nomination of candidates, or to an entity subject to oversight by the Financial Services Commission for the processing of personal credit information pursuant to the Credit Information Act, to the extent it processes such information (Article 1(2)).

Directive (EU) 2020/1828, Arts. 2(1), 4, 7-9 and Annex I point (56) · Read the law's page

• This Directive is addressed to the Member States (Article 26), which had to adopt and publish the measures necessary to comply with it by 25 December 2022 and apply them from 25 June 2023 (Article 24(1)), so a trader meets these rules through each Member State's national law.
• Member States must ensure that a qualified entity they have designated can bring a representative action for an injunctive measure or a redress measure against a trader whose infringement of Regulation (EU) 2016/679, listed in Annex I at point (56), harms or may harm the collective interests of consumers (Articles 2(1), 4(1) and 7(4)).
• Cease, or refrain from, a practice that a provisional or definitive injunctive measure orders to cease or prohibits (Article 8(1)).
• Provide the consumers concerned with the remedies a redress measure requires, such as compensation, repair, replacement, price reduction, contract termination or reimbursement of the price paid, as appropriate and as available under Union or national law (Article 9(1)). A redress measure entitles those consumers to benefit from the remedies without bringing a separate action (Article 9(6)).

Commission Implementing Decision (EU) 2023/1795 · Read the law's page

• A transfer of personal data from the Union to an organization in the United States that is included in the Data Privacy Framework List may take place on the basis of Article 1 of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).
• A transfer to an organization in the United States that is not included in the Data Privacy Framework List is outside the finding in Article 1.

Commission Implementing Decision (EU) 2025/1382 · Read the law's page

• A transfer of personal data from the Union to the European Patent Organisation may take place on the basis of Article 1 of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).

Commission Implementing Decision (EU) 2026/179 · Read the law's page

• A transfer of personal data from the European Union to a controller or processor in Brazil subject to the General Data Protection Law (LGPD) may take place on the basis of Article 1 of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).
• A transfer to a controller or processor in Brazil that is not subject to the General Data Protection Law (LGPD) is outside the finding in Article 1.

COM(2025) 837 final · Read the law's page

• If the Commission's text is adopted as proposed, the GDPR would fold in cookie consent, breach notification to the supervisory authority would be limited to breaches likely to result in a high risk, impact assessment lists, a template and a methodology would be set at EU level, and a solely automated decision under Article 22 would be allowed only on three stated conditions, including contract necessity assessed regardless of whether the decision could be taken otherwise than by solely automated means.
• If the Commission's text is adopted as proposed, information would not be personal data for an entity that cannot identify the natural person to whom it relates, taking into account the means reasonably likely to be used by that entity, and would not become personal for that entity merely because a potential subsequent recipient has such means, and the Commission could specify by implementing act the means and criteria for deciding whether data resulting from pseudonymisation is still personal data for certain entities (Article 3, point 1(a), and new Article 41a of the GDPR).

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).

Regulation (EU) 2025/2518 of the European Parliament and of the Council of 26 November 2025 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679 · Read the law's page

• This Regulation sets rules for supervisory authorities and places no duty on a controller or processor; if you are a party under investigation in a case concerning cross-border processing, the lead supervisory authority must give you preliminary findings setting out the facts, the evidence relied upon and the legal assessment against you before it submits a draft decision (Article 19).