European UnionGDPR Articles 51-59, 68-76 and 77-84, Supervisory Authorities, Penalties and Remedies
Regulation (EU) 2016/679, Arts. 51-59, 68-76, 77-84
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Where you process personal data in the context of an establishment in the Union, or from outside it offer goods or services to people in the Union or monitor their behaviour there, provide the supervisory authority with any information it orders you to provide for the performance of its tasks, and give it access to all personal data and information necessary for those tasks and to your premises and data-processing equipment (Article 58(1), points (a), (e) and (f)).
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post, judgment of (Third Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for the provisions listed in (a) to (e), including non-compliance with a supervisory-authority order under Article 58. Article 83(4) sets a lower tier, up to EUR 10,000,000 or 2 percent, for the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43, which include the Article 33 and 34 breach notification duties; that lower tier is recorded on the instrument covering Articles 33 and 34.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The data protection supervisory authority designated by each EU Member State under Article 51, coordinated on cross-border cases through the one stop shop mechanism, which does not apply to processing by public authorities or by private bodies acting under Article 6(1)(c) or (e) (Article 55(2)), and through the European Data Protection Board (Articles 68-76).
Enforcement record
Counts the fines that national data protection authorities imposed in calendar year 2025 (2,161): the sum of the number-of-fines column in the European Data Protection Board's Annual Report 2025, which gives for each of 30 authorities (the 27 Member States, Iceland, Liechtenstein and Norway) the number and the total amount of the fines it issued that year. The report's own total of those amounts is EUR 1,145,760,374. Fines only: the table does not count the reprimands, warnings, compliance orders or processing bans the authorities may also impose. Enforcement of the GDPR is national, and this table is the Board's Union-level count of it. The figures describe enforcement of the GDPR as a whole, not enforcement of these provisions alone.
- As of
- Currency
- EUR
- Source link
- https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf
- Fines per year
- 1,145,760,374
- Actions per year
- 2,161
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300
- Case citation
- Case C-300/21 UI v Österreichische Post, judgment of (Third Chamber)
- Open questions
- How can a supervisory authority enforce an Article 58(1)(a) order to provide information against a controller outside the Union that has not designated a representative under Article 27, when the Article names only the controller, the processor and their representative as addressees?
- Which national rule fixes the amount of compensation under Article 82 for non-material damage, given the Court's ruling that national courts apply the domestic rules on the extent of financial compensation, subject to the principles of equivalence and effectiveness?
What it makes you log
Who may demand the log
Regulator
Logging duty
The supervisory authority may order a controller or processor to provide any information it requires, carry out data protection audits, and obtain access to all personal data and information and to premises and processing equipment (Article 58(1), points (a), (b), (e) and (f)). The articles name no log, but an audit and access power in the authority's favour can only be answered from records the controller keeps.
- Kind
- Implicit
- As of
- Provision
- Article 58(1), points (a), (b), (e) and (f)
- Trigger
- personal_data_processing
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- Joint committee decision number
- 154/2018
- Source link
- https://www.efta.int/eea-lex/32016r0679
- Decision date
What this law does
Each Member State designates an independent supervisory authority (Article 51) with investigative and corrective powers, including orders and bans on processing (Article 58); cross border cases route through a lead authority under the one stop shop mechanism (Articles 56, 60-63), coordinated by the European Data Protection Board (Articles 68-76).
Article 83 sets administrative fines up to the higher of EUR 20,000,000 or 4 percent of global annual turnover for infringements of the basic processing principles, data subjects' rights, transfer rules and supervisory authority orders (Article 83(5)), and up to the higher of EUR 10,000,000 or 2 percent for the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43 (Article 83(4)).
Article 82(1) arms a direct private right of action, letting any person who suffered material or non-material damage claim compensation from the controller or processor, though the Court of Justice held actual, if not necessarily serious, damage must be shown rather than the mere fact of infringement (UI v Österreichische Post, Case C-300/21, ). Article 80 lets a not for profit body pursue a complaint or judicial remedy on a data subject's behalf.
The Representative Actions Directive (EU) 2020/1828 separately lists Regulation (EU) 2016/679 in its Annex I, letting a qualified entity bring a representative action for collective consumer redress over a General Data Protection Regulation (GDPR) infringement. The Dutch, Italian and French data protection authorities each took enforcement action against Clearview AI over the same underlying conduct, the Netherlands imposing EUR 30.5 million in a decision dated .
The Hellenic Data Protection Authority separately fined Clearview EUR 20,000,000 on for infringing the principles of lawfulness and transparency (Articles 5, 6 and 9) and Articles 12, 14, 15 and 27 in connection with its facial recognition service.
How courts have read itPremium data
Our analysis of this law draws on 31 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .