General Data Protection Regulation (GDPR)

Article 1 Subject-matter and objectives

The regulation protects fundamental rights and freedoms, particularly the right to personal data protection, for natural persons. It establishes rules on personal data processing and free movement of personal data. Data movement within the Union cannot be restricted or prohibited based on data protection reasons.

Article 2 Material scope

The regulation applies to processing of personal data by automated or non-automated means forming part of a filing system. It does not apply to processing outside Union law scope, by Member States in security matters, in purely personal household activities, or by authorities handling criminal offences or public security. Union institutions follow separate rules adapted to align with this regulation.

Article 3 Territorial scope

The regulation applies to processing by Union-established controllers or processors regardless of where processing occurs. It also applies to processing of Union residents by non-Union-based entities offering goods or services or monitoring their behaviour within the Union, and to processing by non-Union controllers where Member State law applies by public international law.

Article 4 Definitions

Article 4 defines personal data as information identifying or identifying natural persons, and processing as operations including collection, recording, storage and deletion; restriction of processing, profiling, pseudonymisation, filing systems, controllers determining purposes and means, and processors acting on controllers' behalf. It defines consent as freely given, specific, informed, unambiguous agreement by statement or clear affirmative action; personal data breaches as security breaches causing accidental or unlawful destruction, loss, alteration or unauthorised disclosure; genetic data, biometric data, and health data as special data types; main establishment as the primary decision-making location; and representative, enterprise, group of undertakings, binding corporate rules, and supervisory authority. It further defines supervisory authority concerned as the authority involved where controller or processor is established, data subjects in its territory substantially affected, or complaints lodged; cross-border processing as processing across multiple Member States or substantially affecting residents in multiple Member States; relevant and reasoned objection as objection demonstrating significant fundamental rights risks; information society service per EU directive; and international organisation as entities governed by public international law.

Article 5 Principles relating to processing of personal data

Processing must be lawful, fair and transparent; collected for specified purposes and not repurposed incompatibly except for archiving, research or statistics; adequate and limited to necessity; accurate and kept current with prompt correction of errors; stored no longer than necessary except for archive, research or statistical purposes; secured against unauthorised, unlawful or accidental processing or damage. Controllers must demonstrate compliance with these principles.

Article 6 Lawfulness of processing

Processing is lawful only if at least one applies: data subject consent, contract performance, legal obligation, vital interest protection, public task performance, or legitimate interests not overridden by data subject rights, particularly for children; legitimate interests do not apply to public authorities performing tasks. When assessing compatibility of further processing not based on consent or necessary Union or Member State law, controllers must consider the link between original and new purposes, collection context and data subject relationship, special data categories or criminal data, consequences for data subjects, and safeguards like encryption or pseudonymisation.

Article 7 Conditions for consent

Controllers must demonstrate consent. Consent requests within documents covering other matters must be clearly distinguished, intelligible and plain. Data subjects may withdraw consent at any time without affecting prior lawful processing, and must be informed before giving consent.

Article 8 Conditions applicable to child's consent in relation to information society services

Processing children's personal data when offering information society services is lawful if the child is 16 or older, or if the child is under 16 and parental consent is obtained (member states may lower the age threshold to no less than 13). Controllers must make reasonable efforts to verify parental consent using available technology.

Article 9 Processing of special categories of personal data

Processing of personal data revealing race, ethnicity, political opinions, religion, philosophical beliefs, trade union membership, genetic data, biometric identification data, health data or sexual orientation is prohibited unless one of ten exceptions applies: explicit consent, employment and social protection, vital interest protection, legitimate activities of certain organisations, manifestly public data, legal claims, substantial public interest, preventive or occupational medicine, or public health, all with required safeguards and legal basis. The prohibition also does not apply to archiving, research or statistical purposes under Union or Member State law with proportionate safeguards, and health data may be processed by professionals subject to professional secrecy obligations. Member States may impose further conditions or limitations on genetic, biometric and health data processing.

Article 10 Processing of personal data relating to criminal convictions and offences

Processing criminal convictions, offences or related security measures is lawful only under official authority control or where Union or Member State law authorises it with appropriate safeguards. Comprehensive criminal conviction registers must be kept only under official authority control.

Article 11 Processing which does not require identification

Where identification is unnecessary for controller purposes, controllers need not maintain or acquire additional information for identification to comply with this Regulation. When unable to identify a data subject, controllers must inform them if possible. Data subjects' rights under Articles 15 to 20 do not apply unless they provide additional identifying information.

Article 12 Transparent information, communication and modalities for the exercise of the rights of the data subject

Controllers must provide information about processing in concise, transparent, plain language, in writing or by other means, and must facilitate rights exercise. Responses to rights requests must be provided free of charge within one month, extendable by two further months for complexity. Controllers may charge reasonable fees or refuse manifestly unfounded or excessive requests.

Article 13 Information to be provided where personal data are collected from the data subject

When collecting personal data directly, controllers must provide identity, contact details, processing purposes, legal basis, recipients, data retention periods, details of data subject rights, withdrawal rights, automated decision-making information, and whether provision is mandatory.

Article 14 Information to be provided where personal data have not been obtained from the data subject

When data are obtained indirectly, controllers must provide similar information as above, plus data categories and source. This must be provided within one month or when first communicating with the data subject, unless exceptions apply under Article 14(5). Exceptions apply where the data subject has the information, provision would be disproportionate for archiving or research purposes, provision is required by law with appropriate safeguards, or data must remain confidential under professional secrecy obligations.

Article 15 Right of access by the data subject

Data subjects have the right to confirmation of processing and access to their data, including purposes, categories, recipients, retention period, and information about automated decision-making. Controllers must provide a copy free of charge, or charge reasonable fees for further copies.

Article 16 Right to rectification

Data subjects have the right to obtain correction of inaccurate personal data from controllers without undue delay. They also have the right to request completion of incomplete personal data, including by providing additional statements.

Article 17 Right to erasure (‘right to be forgotten’)

Data subjects may request erasure where data are no longer necessary for collection purposes; consent is withdrawn with no alternative legal ground; they object to processing under article 21; data were processed unlawfully; erasure is legally required; or data were collected for child information society services. Controllers must inform other data handlers about erasure requests. Exceptions apply for freedom of expression, legal obligations, public health, archiving, research, statistics, and legal defence.

Article 18 Right to restriction of processing

Data subjects may restrict processing where data accuracy is contested, processing is unlawful but they oppose erasure, data are no longer needed but required for legal claims, or they have objected to processing pending verification of controller's legitimate grounds. Restricted data may only be processed with consent, for legal claims, to protect others' rights, or for important public interest.

Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing

Controllers must communicate any corrections, erasures or processing restrictions to all recipients who received the data, unless impossible or disproportionately burdensome. Controllers must inform data subjects about recipients on request.

Article 20 Right to data portability

Data subjects have the right to receive their personal data in structured, commonly used, machine-readable format and transmit it to another controller without hindrance, where processing is based on consent or contract and carried out by automated means. Direct transmission between controllers is allowed if technically feasible. This right does not apply to processing necessary for public interest tasks or official authority.

Article 21 Right to object

Data subjects may object at any time on personal grounds to processing based on article 6(1)(e) or (f), unless the controller has compelling legitimate grounds. For direct marketing, they have an unconditional right to object; data shall not be processed for such marketing once they do. Controllers must explicitly inform data subjects of this right at first contact.

Article 22 Automated individual decision-making, including profiling

Data subjects have a right not to be subject to decisions based solely on automated processing, including profiling, with legal effects or significant impact. Exceptions apply if the decision is necessary for contract performance, authorized by law with safeguards, or based on explicit consent. Decisions under these exceptions must enable human intervention, expression of views, and contestation, and must not use special personal data unless specific conditions are met.

Article 23 Restrictions

Union or Member State law may restrict the scope of obligations and rights in Articles 12-22 and 34 (and Article 5 to the extent it corresponds to them) when necessary and proportionate to safeguard national security, defence, public security, criminal offences, objectives of general public interest, judicial independence, breaches of professional ethics, regulatory functions, data subject protection, or enforcement of civil claims. Any such legislative measure must specify: purposes or processing categories, personal data categories, scope of restrictions, safeguards against abuse, controller categories, storage periods and safeguards, risks to rights and freedoms, and whether data subjects have a right to be informed.

Article 24 Responsibility of the controller

Controllers must establish and maintain suitable technical and organizational measures aligned with processing nature, scope, context and risks, ensuring compliance with this regulation and demonstrating it. Measures must include data protection policies where proportionate. Compliance with approved codes of conduct or certification mechanisms can demonstrate adherence to these obligations.

Article 25 Data protection by design and by default

Controllers must implement technical and organizational measures (such as pseudonymization) at processing planning and execution stages to embed data protection principles like minimization into operations. By default, only necessary personal data for each purpose are processed, and personal data are not made accessible to unidentified third parties without individual action. Approved certification mechanisms may evidence compliance.

Article 26 Joint controllers

Where two or more controllers jointly determine processing purposes and means, they are joint controllers. They must transparently determine their respective compliance responsibilities, including exercising data subject rights and providing required information, unless Union or Member State law determines otherwise. Data subjects may exercise rights against each controller regardless of the arrangement.

Article 27 Representatives of controllers or processors not established in the Union

Controllers or processors subject to Article 3(2) must designate a written representative in the Union, unless processing is occasional, does not include large-scale processing of special categories or criminal data, and is unlikely to risk data subject rights, or the entity is a public authority. The representative, established where data subjects are located, must be mandated to engage with supervisory authorities and data subjects on compliance matters.

Article 28 Processor

Controllers must use only processors providing sufficient guarantees for appropriate protective measures, with a written contract or legal act setting out subject-matter, duration, nature, purpose, data types, data subject categories, and processor obligations: processing only on documented instructions, ensuring staff confidentiality, implementing Article 32 security measures, obtaining prior written authorisation before engaging sub-processors, assisting with data subject rights, ensuring compliance with Articles 32-36, deleting or returning data post-processing, and providing compliance information. Processors must make available information demonstrating compliance and enable audits, and immediately inform controllers if instructions appear to infringe GDPR or data protection law. Sub-processors must be bound by equivalent obligations through contract or legal act; if they fail, the initial processor remains fully liable to the controller.

Article 29 Processing under the authority of the controller or processor

Processors and persons acting under controller or processor authority with personal data access may only process data following controller instructions, unless union or member state law requires otherwise.

Article 30 Records of processing activities

Controllers and processors must maintain written records including contact details of responsible parties, processing purposes, data subject and personal data categories, recipient categories, third-country transfers, erasure timelines, and security measures. These records must be available to supervisory authorities on request. Enterprises with fewer than 250 employees are exempt unless processing poses risks to rights and freedoms, is non-occasional, or involves special or criminal data.

Article 31 Cooperation with the supervisory authority

Controllers, processors, and their representatives must cooperate with the supervisory authority when requested in performing its tasks.

Article 32 Security of processing

Controllers and processors must implement appropriate technical and organisational security measures proportionate to risks, considering state of the art, implementation costs, and processing context. These must ensure confidentiality, integrity, availability and resilience, enable timely recovery from incidents, and include regular testing. Staff processing personal data must do so only on controller instructions unless required by law.

Article 33 Notification of a personal data breach to the supervisory authority

Controllers must notify the competent supervisory authority without undue delay and within 72 hours of becoming aware of a breach unless it poses no risk to rights and freedoms, including delay reasons if notification is late. Notifications must describe the breach nature, affected data categories and approximate numbers, contact details for further information, likely consequences, and remedial measures. Processors must notify controllers promptly.

Article 34 Communication of a personal data breach to the data subject

Controllers must communicate high-risk breaches to data subjects without undue delay in clear language, including details and measures from Article 33. Communication is not required if the controller applied protective measures rendering data unintelligible, took subsequent measures ensuring the risk no longer materialises, or would require disproportionate effort; in the last case, public communication must substitute. The supervisory authority may require notification or verify conditions for exemption are met.

Article 35 Data protection impact assessment

Controllers must conduct data protection impact assessments before processing likely to create high risk to rights and freedoms, particularly involving new technologies, consulting the designated data protection officer; assessments are specifically required for automated decision-making with legal or significant effects, large-scale processing of special or criminal data, and large-scale monitoring of public areas. Assessments must systematically describe processing operations and purposes, assess necessity and proportionality, analyse risks to rights and freedoms, and identify measures including safeguards and compliance mechanisms, with approval of codes of conduct to be considered. Supervisory authorities must publish lists of processing requiring and exempted from assessments, applying consistency mechanisms for multi-state activities, and controllers may seek data subject views on intended processing.

Article 36 Prior consultation

Controllers must consult the supervisory authority before processing if a data protection impact assessment indicates high risk absent mitigation measures. The authority must respond in writing within eight weeks (extendable by six weeks), advising whether processing violates the regulation and stating reasons for extensions within one month. Consultations may be suspended pending information requests.

Article 37 Designation of the data protection officer

Controllers and processors must appoint a data protection officer when they are public authorities (except courts in judicial capacity), conduct large-scale systematic monitoring, or process large-scale special categories or criminal conviction data. Others may or must appoint one if union or member state law requires. Officers must have data protection expertise and may be staff or external.

Article 38 Position of the data protection officer

Controllers and processors must involve the data protection officer properly and timely in all personal data protection matters, provide resources and access for their tasks, ensure they receive no instructions regarding those tasks, and prevent dismissal or penalty for performing them. Officers report directly to top management. Data subjects may contact officers about data processing and rights.

Article 39 Tasks of the data protection officer

Data protection officers must inform and advise controllers, processors and staff of their obligations; monitor compliance with the regulation, other data protection provisions and controller policies including staff training and audits; advise on and monitor data protection impact assessments; cooperate with the supervisory authority; and act as the contact point for prior consultations. Officers must consider risks associated with processing operations in their work.

Article 40 Codes of conduct

Member States, supervisory authorities, Board and Commission shall encourage codes of conduct prepared by associations and other bodies addressing topics such as fair processing, legitimate interests, data collection, pseudonymisation, rights exercise, children's protection, security, breach notification, transfers and dispute resolution, and all codes must include compliance monitoring mechanisms. Single Member State codes are registered and published by the supervisory authority, while multi-state codes are submitted to the Board for opinion on compliance and then to the Commission, which may decide they have general union validity through implementing acts and ensure their publicity.

Article 41 Monitoring of approved codes of conduct

Supervisory authorities may accredit bodies to monitor code compliance if they demonstrate independence and expertise, establish procedures to assess eligibility and handle complaints transparently, and have no conflicts of interest. These bodies may suspend or exclude non-compliant controllers or processors and must inform the authority of their actions. This does not apply to processing by public authorities.

Article 42 Certification

Member states, supervisory authorities, the Board and Commission shall encourage data protection certification mechanisms and seals. Such certification is voluntary and may be issued by bodies in Article 43 or competent authorities, does not reduce controller or processor responsibility, and lasts up to three years with possible renewal. The Board maintains a public register of all certification mechanisms and seals.

Article 43 Certification bodies

Supervisory authorities or national accreditation bodies must accredit certification bodies with data protection expertise that demonstrate independence, comply with approved criteria, establish procedures for issuing and withdrawing certifications, handle complaints transparently, and have no conflicts of interest. Accreditation lasts up to five years with possible renewal if requirements are met, and certification bodies must explain reasons for granting or withdrawing certification and are responsible for proper assessment without reducing controller or processor compliance responsibility. Competent authorities revoke accreditation where conditions are no longer met or the body infringes this Regulation.

Article 44 General principle for transfers

Any transfer of personal data to a third country or international organisation, or onward transfers between such recipients, must comply with Chapter conditions to ensure protection levels under this Regulation are not undermined.

Article 45 Transfers on the basis of an adequacy decision

Personal data may be transferred to a third country or international organisation where the Commission decides it ensures adequate protection by examining the rule of law, human rights, data protection rules, independent supervisory authorities, enforcement powers, and international commitments, subject to periodic review at least every four years. The Commission may repeal, amend or suspend adequacy decisions if a third country no longer ensures adequate protection, using standard procedures or immediate implementing acts for urgent circumstances, and may consult with the third country to remedy deficiencies. Suspensions do not prevent transfers under alternative mechanisms, and prior Commission decisions remain valid until amended or repealed.

Article 46 Transfers subject to appropriate safeguards

Without adequacy decisions, controllers or processors may transfer personal data to third countries only with appropriate safeguards ensuring enforceable data subject rights and remedies. Safeguards include binding instruments between authorities, binding corporate rules, standard protection clauses, approved codes or certification mechanisms with binding commitments, or contractual clauses or administrative arrangements with supervisory authorization. Prior authorizations under the prior directive remain valid unless amended.

Article 47 Binding corporate rules

Supervisory authorities shall approve binding corporate rules that are legally binding on all group members and employees, confer enforceable data subject rights, and specify: group structure; categories and types of data transfers and processing; legal binding effect; general data protection principles; data subject rights including rights to refuse decisions based solely on automated processing and to lodge complaints; liability acceptance by Union controllers; provisions on informing data subjects; monitoring roles; complaint procedures; and compliance verification mechanisms. Rules must include mechanisms for verifying compliance through audits and corrective actions with results reported to designated personnel and supervisory authorities; mechanisms for recording and reporting rule changes; cooperation with supervisory authorities; reporting of third-country legal requirements likely to undermine guarantees; and appropriate data protection training for personnel accessing personal data.

Article 48 Transfers or disclosures not authorised by Union law

Court judgments or administrative decisions from third countries requiring controllers or processors to transfer or disclose personal data are recognized only if based on international agreements like mutual legal assistance treaties between the requesting country and the EU or a member state.

Article 49 Derogations for specific situations

Without adequacy findings or safeguards, transfers to third countries require explicit consent, performance of contracts, public interest grounds recognized in union or member state law, legal claims, vital interests protection, or public register access; non-repetitive transfers affecting few subjects may proceed if the controller assessed circumstances, provided suitable safeguards, informed the supervisory authority and data subject, and compelling legitimate interests are not overridden by data subject rights. Public authorities cannot rely on consent, contract, or compelling interest grounds. Member states may restrict specific personal data categories' transfers for important public interest reasons and must notify the commission.

Article 50 International cooperation for the protection of personal data

The Commission and supervisory authorities must take steps to create mechanisms facilitating enforcement of data protection laws across borders, provide mutual assistance in investigations and sharing information, involve stakeholders in cooperation efforts, and promote sharing of laws and practices including those addressing jurisdictional conflicts.

Article 51 Supervisory authority

Each member state must establish one or more independent public authorities to monitor regulation compliance and protect fundamental rights in data processing. Multiple authorities within a state must designate one representative to the board. Member states must notify the commission of relevant legal provisions by 25 May 2018 and of subsequent amendments.

Article 52 Independence

Supervisory authority members must act independently, free from external influence or instructions, refrain from incompatible actions or occupations during their term, and be subject to exclusive direction by their authority leadership. Member states must provide sufficient resources, ensure staff answer only to the authority leadership, and maintain financial control that does not compromise independence.

Article 53 General conditions for the members of the supervisory authority

Member state parliaments, governments, heads of state, or independent bodies shall appoint supervisory authority members through transparent procedures. Members need qualifications and experience in data protection. Membership ends upon term expiry, resignation, or retirement under national law.

Article 54 Rules on the establishment of the supervisory authority

Member states must legally establish appointment qualifications, procedures, and term conditions for supervisory authorities. Terms last at least four years except the first post-24 May 2016 appointment, which may be shorter for staggered procedures. Members and staff must maintain professional secrecy during and after service regarding confidential information and reported regulation infringements.

Article 55 Competence

Each supervisory authority has competence to perform its tasks on its Member State's territory. The supervisory authority concerned is competent where processing occurs via public authorities or bodies acting under Article 6(1)(c) or (e). Supervisory authorities cannot supervise courts acting in their judicial capacity.

Article 56 Competence of the lead supervisory authority

The supervisory authority where a controller or processor has its main or single establishment acts as lead authority for cross-border processing. Other authorities may handle complaints or alleged infringements affecting only their Member State, and must inform the lead authority, which decides within three weeks whether to handle the case under Article 60 or let the other authority proceed under Articles 61 and 62. The lead authority is the sole contact for the controller or processor on cross-border processing.

Article 57 Tasks

Supervisory authorities must monitor and enforce the Regulation, promote awareness of rights and risks especially for children, advise national institutions on protective measures, support controllers and processors' compliance, respond to data subject requests, investigate complaints, cooperate with other authorities, conduct investigations, monitor technology developments, adopt standard contractual clauses, maintain lists for data protection impact assessments, give advice on certain processing, and encourage codes of conduct and certification mechanisms. Supervisory authorities must fulfil other data protection tasks and facilitate complaints through accessible submission forms without excluding other communication means. Services are free for data subjects and data protection officers, though authorities may charge reasonable fees or refuse manifestly unfounded or excessive requests, bearing the burden of proving this character.

Article 58 Powers

Supervisory authorities have investigative powers to demand information, conduct audits and certification reviews, notify alleged infringements, and access premises and data; corrective powers including issuing warnings and reprimands, ordering compliance with data subject rights, limiting or banning processing, ordering data rectification or erasure, withdrawing certifications, imposing administrative fines, and suspending data flows to third countries; and authorisation powers including advising on prior consultation, issuing opinions, authorising processing requiring prior consent, accrediting bodies, and issuing certifications. They may also approve data protection clauses and contractual terms for international transfers and authorize corporate rules. Their powers are subject to protections including judicial recourse and procedural fairness, and Member States must allow authorities to refer violations to courts and bring proceedings to enforce the regulation.

Article 59 Activity reports

Each supervisory authority must produce an annual activity report listing types of infringements notified and measures taken, transmit it to national parliament, government and designated authorities, and make it available to the public, Commission and the Board.

Article 60 Cooperation between the lead supervisory authority and the other supervisory authorities concerned

The lead supervisory authority shall cooperate with other authorities to reach agreement, exchange information, and request mutual assistance; it must share draft decisions with them and consider their views within four weeks, and if they object with reasoning and the lead authority disagrees, it submits the matter to the consistency mechanism; if objections are received, a revised draft goes to a two-week opinion period, and if no objections are raised, all parties are bound by the draft decision. The lead authority adopts and notifies decisions; when a complaint is split between dismissal and action, each authority adopts its part. Controllers and processors must implement decisions across all their Union establishments and notify the lead authority of measures taken; an urgent procedure applies in exceptional circumstances requiring immediate action to protect data subjects.

Article 61 Mutual assistance

Supervisory authorities must provide relevant information and assistance to implement this Regulation consistently, including information requests and supervisory measures such as investigations. A requested authority must reply within one month unless it lacks competence or compliance would breach this Regulation or national law; it shall not charge fees. Authorities communicate electronically using standardised formats.

Article 62 Joint operations of supervisory authorities

Supervisory authorities may conduct joint investigations and enforcement where a controller or processor has establishments in multiple Member States or affects data subjects across borders; each relevant authority has the right to participate. A seconding authority's members may exercise investigative powers under the host authority's guidance and law; the host Member State is responsible for their actions and any damage caused. A failure to respond within one month to a joint operation invitation triggers the urgency procedure.

Article 63 Consistency mechanism

Supervisory authorities must cooperate with each other and the Commission through a consistency mechanism to ensure the regulation is applied uniformly throughout the Union.

Article 64 Opinion of the Board

Supervisory authorities must submit draft measures on lists requiring data protection impact assessment, codes of conduct, accreditation criteria, standard contractual clauses, or binding corporate rules to the Board for an opinion; any supervisory authority, the Board Chair, or the Commission may request the Board examine matters of general application or affecting multiple Member States. The Board issues opinions within eight weeks, extendable by six weeks, by simple majority, and supervisory authorities cannot adopt their draft decision during this period but must communicate within two weeks whether they will follow the opinion. If supervisory authorities reject the opinion in whole or part, Article 65 applies and the matter becomes binding.

Article 65 Dispute resolution by the Board

The Board adopts binding decisions when supervisory authorities raise relevant objections to a lead authority's draft, when they conflict over competence for main establishment, or when a supervisory authority disregards the Board's opinion request or decision. Decisions require two-thirds majority within one month, extendable by another month; if still unresolved, simple majority applies within two weeks.

Article 66 Urgency procedure

When urgent action is needed to protect data subjects, a supervisory authority may adopt provisional measures for up to three months without following normal procedures, immediately notifying other authorities, the Board, and the Commission. It may request an urgent Board opinion or binding decision. Any authority may request urgent Board decisions if a competent authority has not acted appropriately.

Article 67 Exchange of information

The Commission may adopt implementing acts specifying arrangements for electronic information exchange between supervisory authorities and the Board, including standardised formats for such communications.

Article 68 European Data Protection Board

The Board is a Union body composed of heads of each Member State's supervisory authority and the European Data Protection Supervisor, with their representatives allowed. Where a Member State has multiple supervisory authorities, a joint representative is appointed. The Commission participates without voting rights, except the European Data Protection Supervisor votes only on decisions affecting Union institutions' corresponding rules.

Article 69 Independence

The Board acts independently, neither seeking nor taking instructions from others when performing its tasks, except it may accept Commission requests under specified provisions.

Article 70 Tasks of the Board

The Data Protection Board shall monitor correct application of this Regulation, advise the Commission on data protection matters, and issue guidelines and recommendations on specific topics including data erasure, profiling decisions, breach notifications, binding corporate rules, and supervisory authority measures and fines. The Board shall encourage data protection codes of conduct and certification mechanisms, accredit certification bodies, provide opinions to the Commission on certifications and third-country data protection adequacy, issue binding decisions through the consistency mechanism, promote cooperation between supervisory authorities, and maintain a public register of decisions on consistency matters.

Article 71 Reports

The Board shall produce and publicly release an annual report to the European Parliament, Council and Commission covering protection of natural persons in the Union and third countries, including review of practical application of guidelines and binding decisions.

Article 72 Procedure

The Board decides by simple majority vote unless otherwise specified in this Regulation. It adopts its own rules of procedure and operational arrangements by a two-thirds majority vote.

Article 73 Chair

The Board elects a chair and two deputy chairs from its members by simple majority. Their five-year terms are renewable once.

Article 74 Tasks of the Chair

The Chair convenes Board meetings, prepares the agenda, notifies supervisory authorities of Board decisions, and ensures timely performance of Board tasks particularly regarding the consistency mechanism. The Board's rules of procedure specify task allocation between the Chair and deputy chairs.

Article 75 Secretariat

The European Data Protection Supervisor provides the Board's secretariat, which operates under the Chair's instructions with separate reporting lines from other Supervisor staff. The secretariat provides analytical, administrative and logistical support including day-to-day business, communications, translation, and preparation of Board meetings and publications.

Article 76 Confidentiality

Board discussions are confidential where the Board deems necessary according to its rules of procedure. Access to Board documents is governed by Regulation (EC) No 1049/2001.

Article 77 Right to lodge a complaint with a supervisory authority

Every data subject may lodge a complaint with a supervisory authority, particularly in their Member State of habitual residence, work or where the alleged infringement occurred, if they believe processing infringes the Regulation, and the supervisory authority must inform the complainant of progress, outcome and judicial remedy options.

Article 78 Right to an effective judicial remedy against a supervisory authority

All natural and legal persons have the right to effective judicial remedy against binding decisions of supervisory authorities. Data subjects can seek judicial remedy where the supervisory authority fails to handle a complaint or inform them within three months. Proceedings must be brought before courts where the supervisory authority is established.

Article 79 Right to an effective judicial remedy against a controller or processor

Data subjects may pursue judicial relief where a controller or processor has breached this Regulation in processing their personal data. Proceedings may be filed where the controller or processor is located, or where the data subject lives, except when the respondent is a government body exercising official powers, in which case only the courts where that authority operates have jurisdiction.

Article 80 Representation of data subjects

Data subjects may mandate not-for-profit bodies with statutory public interest objectives and active in data protection to lodge complaints and exercise their rights on their behalf. Member States may allow such bodies to independently lodge complaints and exercise rights if they consider the regulation has been infringed.

Article 81 Suspension of proceedings

Courts must contact other courts where parallel proceedings on the same processing matter are pending. Competent courts may suspend their proceedings or, at first instance, decline jurisdiction if another court was seized first and consolidation is permitted under that state's law.

Article 82 Right to compensation and liability

Anyone suffering material or non-material damage from regulation breaches has the right to compensation from controllers or processors. Controllers are liable for damage from non-compliant processing; processors are liable only where they breached obligations specifically directed to them or acted contrary to controller instructions. Controllers or processors proving non-responsibility are exempt from liability.

Article 83 General conditions for imposing administrative fines

Supervisory authorities must impose fines that are effective, proportionate and dissuasive, considering factors including infringement nature, gravity and duration, intentionality, damage mitigation, responsibility, prior breaches, authority cooperation, and data categories affected. Fines for articles 8, 11, 25-39, 42-43 reach up to 10 million euros or 2 percent annual turnover (whichever higher); fines for articles 5-7, 9, 12-22, 44-49 and non-compliance with supervisory authority orders reach up to 20 million euros or 4 percent annual turnover (whichever higher). Multiple infringements of different provisions do not exceed the gravest infringement's maximum fine, and Member States may impose fines on public authorities differently or through courts instead.

Article 84 Penalties

Member States must establish rules on penalties for regulation infringements not subject to administrative fines, ensuring they are effective, proportionate and dissuasive. Member States must notify the Commission of adopted penalty provisions by 25 May 2018 and any subsequent amendments.

Article 85 Processing and freedom of expression and information

Member States must by law balance data protection with freedom of expression and information rights. They may provide exemptions or derogations from specified chapters for journalistic, academic, artistic or literary purposes if necessary to reconcile these rights. Member States must notify the Commission of adopted provisions and any amendments.

Article 86 Processing and public access to official documents

Public authorities or bodies, or private bodies performing public interest tasks, may disclose personal data in official documents according to Union or Member State law, balancing public access rights with data protection requirements under the regulation.

Article 87 Processing of the national identification number

Member States may set specific conditions for processing national identification numbers or other general identifiers, provided they use appropriate safeguards to protect data subjects' rights and freedoms.

Article 88 Processing in the context of employment

Member States may adopt more detailed rules on employees' personal data processing for recruitment, employment contracts, work management, health and safety, and other employment-related purposes, with safeguards for dignity, transparency, and monitoring. Notifications to the Commission were required by 25 May 2018.

Article 89 Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

Processing for archiving, research, or statistics must have technical and organisational safeguards including data minimisation and pseudonymisation. Union or Member State law may allow derogations from rights to access, rectification, objection, and data portability if necessary to achieve these purposes and not otherwise feasible.

Article 90 Obligations of secrecy

Member States may set specific rules on supervisory authority powers for controllers or processors bound by professional secrecy, if necessary and proportionate to reconcile data protection with confidentiality obligations. Notifications to the Commission were required by 25 May 2018.

Article 91 Existing data protection rules of churches and religious associations

Churches and religious associations applying comprehensive data protection rules at the Regulation's entry into force may continue, provided they align with it and remain subject to independent supervision meeting Chapter VI requirements.

Article 92 Exercise of the delegation

The Commission may adopt delegated acts under Articles 12(8) and 43(8) indefinitely from 24 May 2016, subject to revocation by Parliament or Council. Delegated acts enter into force unless objected within three months, extendable to six months.

Article 93 Committee procedure

The Commission is assisted by a committee operating under Regulation (EU) No 182/2011, applying its procedures for delegated act adoption.

Article 94 Repeal of Directive 95/46/EC

The previous data protection directive ceased being effective on 25 May 2018 and is replaced by this regulation. All references to the old directive now apply to this regulation, and the Working Party established under the former directive is replaced by the European Data Protection Board.

Article 95 Relationship with Directive 2002/58/EC

This regulation does not add obligations on persons providing publicly available electronic communications services on public networks for matters already subject to equivalent obligations under Directive 2002/58/EC.

Article 96 Relationship with previously concluded Agreements

International agreements on personal data transfers to third countries or international organisations concluded by Member States before 24 May 2016 and compliant with prior Union law continue in force until amended, replaced or revoked.

Article 97 Commission reports

The Commission must report to Parliament and Council by 25 May 2020 and subsequently at four-year intervals, evaluating and reviewing the regulation's implementation, with specific focus on cross-border data transfers and supervisory cooperation. Reports must be publicly released, and the Commission may seek information from member states and supervisory authorities, considering their input when proposing amendments to reflect technological changes and societal progress.

Article 98 Review of other Union legal acts on data protection

The Commission may submit legislative proposals to amend other Union legal acts on data protection to ensure consistent protection, particularly regarding rules for Union institutions, bodies, offices and agencies and free movement of such data.

Article 99 Entry into force and application

This Regulation enters into force twenty days after official publication and applies from 25 May 2018, binding entirely and directly in all Member States.