GDPR: Regulation (EU) 2016/679

Identifier

CELEX

32016R0679

Identifier

EU 2016/679

Adopted

2016-04-27

In force

2016-05-24

Applies from

2018-05-25

Articles

99

Chapters

• I General provisions1-4
• II Principles5-11
• III Rights of the data subject12-23
• IV Controller and processor24-43
• V Transfers of personal data to third countries or international organisations44-50
• VI Independent supervisory authorities51-59
• VII Cooperation and consistency60-76
• VIII Remedies, liability and penalties77-84
• IX Provisions relating to specific processing situations85-91
• X Delegated acts and implementing acts92-93
• XI Final provisions94-99

Articles

99 articles are read into the register, one address each. Read on 2026-08-18.

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46
• 47
• 48
• 49
• 50
• 51
• 52
• 53
• 54
• 55
• 56
• 57
• 58
• 59
• 60
• 61
• 62
• 63
• 64
• 65
• 66
• 67
• 68
• 69
• 70
• 71
• 72
• 73
• 74
• 75
• 76
• 77
• 78
• 79
• 80
• 81
• 82
• 83
• 84
• 85
• 86
• 87
• 88
• 89
• 90
• 91
• 92
• 93
• 94
• 95
• 96
• 97
• 98
• 99

Judgments of the Court of Justice

40 decisions

• C-422/24Court of Justice of the European Union2025-12-18

  Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject.

  Ask NovaCopilot
• C-492/23Court of Justice of the European Union2025-12-02

  X v Russmedia Digital SRL and Inform Media Press SRL

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – Principle of accountability – Article 26 – Joint control with user advertisers – Article 9(1) and (2)(a) – Advertisements containing sensitive data – Lawfulness of processing – Consent – Articles 24, 25 and 32 – Obligations of the controller – Prior identification of the advertisements containing such data – Prior identification of the identity of the user advertiser – Refusal of publication of unlawful advertisements – Security measures such as to prevent the copying of advertisements and their publication on other websites – Electronic commerce – Directive 2000/31/EC – Articles 12 to 15 – Possibility for such an operator, with regard to an infringement of those obligations, to rely on the exemption from liability of an intermediary information society service provider.

  Ask NovaCopilot
• C-655/23Court of Justice of the European Union2025-09-04

  IP v Quirin Privatbank AG

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Rights of the data subject – Article 17 – Right to erasure of data – Article 18 – Right to restriction of processing – Article 79 – Right to an effective judicial remedy – Unlawful processing of personal data – Action seeking an order requiring the controller to refrain from any further unlawful processing in the future – Basis – Conditions – Article 82(1) – Right to compensation – Concept of ‘non-material damage’ – Assessment of the compensation – Possible consideration of the degree of fault on the part of the controller – Possible impact of the grant of a ‘prohibitory injunction’.

  Ask NovaCopilot
• 62023CJ0313Court of Justice of the European Union2025-04-30

  Inspektorat kam Visshia sadeben savet

  Joined Cases C-313/23, C-316/23 and C-332/23.

  Ask NovaCopilot
• C-710/23Court of Justice of the European Union2025-04-03

  L. H. v Ministerstvo zdravotnictví

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4 – Definitions – Article 6 – Lawfulness of processing – Article 86 – Public access to official documents – Data concerning the representative of a legal person – Case-law of a national court imposing an obligation to inform and consult the data subject prior to disclosure of official documents containing such data.

  Ask NovaCopilot
• C-247/23Court of Justice of the European Union2025-03-13

  VP v Országos Idegenrendészeti Főigazgatóság

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(d) – Principle of accuracy – Article 16 – Right to rectification – Article 23 – Restrictions – Data relating to gender identity – Data incorrect from the time of inclusion in a public register – Means of proof – Administrative practice of requesting proof of gender reassignment surgery.

  Ask NovaCopilot
• C-203/22Court of Justice of the European Union2025-02-27

  CK v Magistrat der Stadt Wien

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(h) – Automated decision-making, including profiling – Scoring – Assessment of the creditworthiness of a natural person – Access to meaningful information about the logic involved in profiling – Verification of the accuracy of the information provided – Directive (EU) 2016/943 – Point 1 of Article 2 – Trade secret – Personal data of third parties.

  Ask NovaCopilot
• C-638/23Court of Justice of the European Union2025-02-27

  Amt der Tiroler Landesregierung v Datenschutzbehörde

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Direct designation of the controller by national law – Auxiliary administrative entity in the service of a regional government – Lack of legal personality – Lack of legal capacity of the entity’s own – Determination of the purposes and means of the processing.

  Ask NovaCopilot
• C-383/23Court of Justice of the European Union2025-02-13

  Criminal proceedings against ILVA A/S

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 83(4) to (6) and (9) – Concept of an ‘undertaking’ – Parent company and subsidiary – Infringement of that regulation by a subsidiary – Calculation of the amount of the fine – Consideration of the total turnover of the group of which that subsidiary forms part.

  Ask NovaCopilot
• C-394/23Court of Justice of the European Union2025-01-09

  Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(c) – Data minimisation – Article 6(1) – Lawfulness of processing – Data relating to title and gender identity – Online sale of travel documents – Article 21 – Right to object.

  Ask NovaCopilot
• C-416/23Court of Justice of the European Union2025-01-09

  Österreichische Datenschutzbehörde v F R

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(f) and Article 57(4) – Tasks of the supervisory authority – Concepts of a ‘request’ and ‘excessive requests’ – Charging of a reasonable fee or refusal to act on requests in the event of manifestly unfounded or excessive requests – Criteria which may guide the supervisory authority in making its choice – Article 77(1) – Concept of a ‘complaint’.

  Ask NovaCopilot
• C-65/23Court of Justice of the European Union2024-12-19

  MK v K GmbH

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing in the context of employment – Employees’ personal data – More specific rules provided for by a Member State pursuant to that Article 88 – Obligation to comply with Article 5, Article 6(1) and Article 9(1) and (2) of that regulation – Processing on the basis of a collective agreement – Margin of discretion of the parties to the collective agreement as regards the necessity of the processing of personal data provided for by that agreement – Scope of judicial review.

  Ask NovaCopilot

Binding case law

40 judgments the Court itself has marked as interpreting this act.

• C-422/24Court of Justice of the European Union2025-12-18

  Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject.

  ECLI:EU:C:2025:980EUR-LexThe Court
• C-492/233ca6f0a7-954d-4b0b-8898-78c385afdf902025-12-02

  X v Russmedia Digital SRL and Inform Media Press SRL

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – Principle of accountability – Article 26 – Joint control with user advertisers – Article 9(1) and (2)(a) – Advertisements containing sensitive data – Lawfulness of processing – Consent – Articles 24, 25 and 32 – Obligations of the controller – Prior identification of the advertisements containing such data – Prior identification of the identity of the user advertiser – Refusal of publication of unlawful advertisements – Security measures such as to prevent the copying of advertisements and their publication on other websites – Electronic commerce – Directive 2000/31/EC – Articles 12 to 15 – Possibility for such an operator, with regard to an infringement of those obligations, to rely on the exemption from liability of an intermediary information society service provider.

  ECLI:EU:C:2025:935EUR-LexThe Court
• C-655/238e01d479-c04c-11e5-9e54-01aa75ed71a12025-09-04

  IP v Quirin Privatbank AG

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Rights of the data subject – Article 17 – Right to erasure of data – Article 18 – Right to restriction of processing – Article 79 – Right to an effective judicial remedy – Unlawful processing of personal data – Action seeking an order requiring the controller to refrain from any further unlawful processing in the future – Basis – Conditions – Article 82(1) – Right to compensation – Concept of ‘non-material damage’ – Assessment of the compensation – Possible consideration of the degree of fault on the part of the controller – Possible impact of the grant of a ‘prohibitory injunction’.

  ECLI:EU:C:2025:655EUR-LexThe Court
• 62023CJ0313eb8869f3-bbfe-402d-ba9e-141449ccf9892025-04-30

  Inspektorat kam Visshia sadeben savet

  Joined Cases C-313/23, C-316/23 and C-332/23.

  ECLI:EU:C:2025:303EUR-LexThe Court
• C-710/23957a16f7-c757-11ea-adf7-01aa75ed71a12025-04-03

  L. H. v Ministerstvo zdravotnictví

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4 – Definitions – Article 6 – Lawfulness of processing – Article 86 – Public access to official documents – Data concerning the representative of a legal person – Case-law of a national court imposing an obligation to inform and consult the data subject prior to disclosure of official documents containing such data.

  ECLI:EU:C:2025:231EUR-LexThe Court
• C-247/23Court of Justice of the European Union2025-03-13

  VP v Országos Idegenrendészeti Főigazgatóság

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(d) – Principle of accuracy – Article 16 – Right to rectification – Article 23 – Restrictions – Data relating to gender identity – Data incorrect from the time of inclusion in a public register – Means of proof – Administrative practice of requesting proof of gender reassignment surgery.

  ECLI:EU:C:2025:172EUR-LexThe Court
• C-203/22957a16f7-c757-11ea-adf7-01aa75ed71a12025-02-27

  CK v Magistrat der Stadt Wien

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(h) – Automated decision-making, including profiling – Scoring – Assessment of the creditworthiness of a natural person – Access to meaningful information about the logic involved in profiling – Verification of the accuracy of the information provided – Directive (EU) 2016/943 – Point 1 of Article 2 – Trade secret – Personal data of third parties.

  ECLI:EU:C:2025:117EUR-LexThe Court
• C-638/238e01d479-c04c-11e5-9e54-01aa75ed71a12025-02-27

  Amt der Tiroler Landesregierung v Datenschutzbehörde

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Direct designation of the controller by national law – Auxiliary administrative entity in the service of a regional government – Lack of legal personality – Lack of legal capacity of the entity’s own – Determination of the purposes and means of the processing.

  ECLI:EU:C:2025:127EUR-LexThe Court

Read from the Publications Office of the European Union on 2026-08-22.

Recitals that carry the interpretation

The recitals in the preamble have no legal force of their own but often decide how the article is read. The links are curated against the official text. Read 2026-08-31.

• Skäl 39 · Article 5

  The Article 5 principles made concrete: lawfulness, transparency and that the data subject knows of the processing.

• Skäl 42 · Article 7

  The burden of proving valid consent rests on the controller.

• Skäl 47 · Article 6

  Legitimate interest can carry direct marketing and security processing, but always requires balancing.

• Skäl 60 · Article 13

  The information duty must be clear and accessible, adapted in particular to children.

• Skäl 71 · Article 22

  Automated decisions: a right to human intervention, to express a point of view and to contest; profiling of children should not occur.

• Skäl 83 · Article 32

  The security level is tested against the risk: pseudonymisation and encryption are named as measures.

• Skäl 85 · Article 33

  What a personal data breach is and when it is likely to result in risk, the basis of the 72-hour duty.

• Skäl 90 · Article 35

  When an impact assessment is required: systematic monitoring, sensitive data at scale and new technology.

• Skäl 108 · Article 46

  Safeguards for third-country transfers: standard contractual clauses and binding corporate rules.

• Skäl 148 · Article 83

  Fines must be effective, proportionate and dissuasive in each individual case.

Guidance and secondary law

Authority guidance and the delegated or implementing acts that fill the article, with the primary source at the issuing body. Read 2026-08-31.

• Opinion · EDPB2024-12-18
  Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models

  When AI models process personal data: anonymity, legitimate interest and the consequences of unlawfully trained models.

  Article 4, 5, 6

• Guideline · EDPB2024-10-08
  Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR

  The balancing test in Article 6(1)(f): when legitimate interest carries the processing.

  Article 6

• Guideline · EDPB2023-02-14
  Guidelines 03/2022 on deceptive design patterns in social media interfaces

  Deceptive design patterns in interfaces, read against Articles 5, 12, 13 and 25.

  Article 5, 12, 13, 25

• Guideline · EDPB2021-07-07
  Guidelines 07/2020 on the concepts of controller and processor

  The controller-processor line, with consequences for Articles 24, 26 and 28.

  Article 24, 26, 28

• Guideline · EDPB2020-05-04
  Guidelines 05/2020 on consent under Regulation 2016/679

  When consent is valid: freedom, information duties and withdrawal under Articles 4(11) and 7.

  Article 4, 6, 7, 8

Amendment history

The amending acts that affect the base act, so the question of what applied on a given date can be answered against the register. Read 2026-08-31.

• Regulation (EU) 2018/1725, Article 98(2)2018-12-11

  Adjusts Article 91 so that church rules may remain provided they are aligned with the Regulation.

  CELEX 32018R1725

Supervisory bodies

• IMY: Sweden
• Datatilsynet: Norway
• EDPB: European Data Protection Board

Official source

• EUR-Lex, CELEX 32016R0679
• All language versions
• Consolidated text
• National instruments, EUR-Lex NIM

National instruments

• SE Lag med kompletterande bestämmelser till EU:s dataskyddsförordning

  SFS 2018:218 · www.riksdagen.se

• NO Lov om behandling av personopplysninger (personopplysningsloven)

  LOV-2018-06-15-38 · lovdata.no

• DK Lov om supplerende bestemmelser til forordning om beskyttelse af fysiske personer (databeskyttelsesloven)

  LOV nr 502 af 23/05/2018 · www.retsinformation.dk

• FI Tietosuojalaki

  1050/2018 · www.finlex.fi

• DE Bundesdatenschutzgesetz

  BDSG · www.gesetze-im-internet.de

• UK Data Protection Act 2018

  2018 c. 12 · www.legislation.gov.uk