European UnionGeneral Data Protection Regulation (GDPR), Comprehensive Regime
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Consent, Disclosure, DPIA, Data subject rights, Transfer, Breach notice, Security, Governance
- Audit expectation
- on_request
- Who audits it
- Self, Independent third party
- Where the report goes
- Produced on request
What it requires
- Establish and document a lawful basis under Article 6 before processing any personal data of a person in the EU.NIST Privacy FrameworkCT.PO-P1
- Allocate and document controller and processor responsibilities in a written agreement wherever a third party processes personal data on your behalf, and appoint a Data Protection Officer where your core activities involve large scale monitoring or large scale special category processing.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkGV.PO-P3
These lines are LexLint's reading of the law's text. Also read by: DPC Guidance: AI, Large Language Models and Data Protection (guidance from the Irish Data Protection Commission, issued ); European Data Protection Board (guidance, recorded ); Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens, judgment of (Ninth Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
1 more
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for infringements of the basic principles for processing (Articles 5, 6, 7 and 9), the data subjects' rights (Articles 12 to 22), cross-border transfer conditions (Articles 44 to 49), Member State law obligations under Chapter IX, and non-compliance with a supervisory authority order under Article 58. A separate, lower tier under Article 83(4) caps the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43 (which include the Article 33 and 34 breach notification duties) at EUR 10,000,000 or 2 percent of worldwide annual turnover, whichever is higher; that lower tier is recorded on the instrument covering Articles 33 and 34.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The data protection supervisory authority designated by each EU Member State under Article 51, coordinated on cross-border cases through the one stop shop mechanism, which does not apply to processing by public authorities or by private bodies acting under Article 6(1)(c) or (e) (Article 55(2)), and through the European Data Protection Board (Articles 68-76).
Enforcement record
Counts the fines that national data protection authorities imposed in calendar year 2025 (2,161): the sum of the number-of-fines column in the European Data Protection Board's Annual Report 2025, which gives for each of 30 authorities (the 27 Member States, Iceland, Liechtenstein and Norway) the number and the total amount of the fines it issued that year. The report's own total of those amounts is EUR 1,145,760,374. Fines only: the table does not count the reprimands, warnings, compliance orders or processing bans the authorities may also impose. Enforcement of the GDPR is national, and this table is the Board's Union-level count of it.
- As of
- Currency
- EUR
- Source link
- https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf
- Fines per year
- 1,145,760,374
- Actions per year
- 2,161
Settledness
The Board's guidelines on processing based on Article 6(1)(f), Guidelines 1/2024, are published only as version 1.0 for public consultation, with a feedback period from 9 October to .
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0621
- Guidance link
- https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf
- Case citation
- Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens, judgment of (Ninth Chamber)
- Guidance body
- European Data Protection Board
- Open questions
- Which commercial interests of a controller can be 'legitimate interests' under Article 6(1)(f), and when is a disclosure of personal data for consideration 'strictly necessary' for one, as Case C-621/22 requires, while the Board's guidelines on Article 6(1)(f) remain a consultation draft?
- Which threshold of 'large scale' makes an activity 'regular and systematic monitoring of data subjects on a large scale' under Article 37(1)(b), which obliges a controller or processor to appoint a data protection officer, when the Article names no figure?
What it makes you log
Who may demand the log
Counterparty
Logging duty
The controller must implement measures to ensure, and to be able to demonstrate, that processing complies with the Regulation (Article 24(1)). Article 24 names no log or record, but compliance cannot be demonstrated without one. Where a processor acts for a controller, the processor must make available to the controller all information needed to demonstrate compliance and allow audits by the controller or an auditor the controller mandates (Article 28(3), point (h)).
- Kind
- Implicit
- As of
- Provision
- Article 24(1), with Article 28(3), point (h)
- Trigger
- personal_data_processing
Why the legislator wanted it
Recital 74 gives the purpose of the controller measures as demonstrating compliance with the Regulation, including the effectiveness of the measures.
- As of
- Quote
- In particular, the controller should be obliged to implement appropriate and effective measures and be able to demonstrate the compliance of processing activities with this Regulation, including the effectiveness of the measures.
- Source link
- https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- Source kind
- Recital
- Purpose
- accountability_demonstration
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- Joint committee decision number
- 154/2018
- Source link
- https://www.efta.int/eea-lex/32016r0679
- Decision date
What this law does
Establishes the lawful basis, purpose limitation, and controller and processor accountability framework for processing personal data of people in the EU. Article 6(1) requires one of six lawful bases for any processing, Articles 24-28 allocate duties between controllers, joint controllers and processors, and the Regulation applies extraterritorially to any controller or processor offering goods or services to, or monitoring, people in the EU (Article 3).
It binds public authorities as well as private sector controllers, though Article 83(7) lets Member States decide whether administrative fines apply to their own public bodies.
How courts have read itPremium data
Our analysis of this law draws on 43 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- DPC Guidance: AI, Large Language Models and Data Protection, the Irish Data Protection Commission
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .