GDPR — Regulation (EU) 2016/679

Identifier

CELEX

32016R0679

Identifier

EU 2016/679

Adopted

2016-04-27

In force

2016-05-24

Applies from

2018-05-25

Articles

99

Chapters

• I General provisions1–4
• II Principles5–11
• III Rights of the data subject12–23
• IV Controller and processor24–43
• V Transfers of personal data to third countries or international organisations44–50
• VI Independent supervisory authorities51–59
• VII Cooperation and consistency60–76
• VIII Remedies, liability and penalties77–84
• IX Provisions relating to specific processing situations85–91
• X Delegated acts and implementing acts92–93
• XI Final provisions94–99

Articles

99 articles are read into the register, one address each. Read on 2026-08-18.

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46
• 47
• 48
• 49
• 50
• 51
• 52
• 53
• 54
• 55
• 56
• 57
• 58
• 59
• 60
• 61
• 62
• 63
• 64
• 65
• 66
• 67
• 68
• 69
• 70
• 71
• 72
• 73
• 74
• 75
• 76
• 77
• 78
• 79
• 80
• 81
• 82
• 83
• 84
• 85
• 86
• 87
• 88
• 89
• 90
• 91
• 92
• 93
• 94
• 95
• 96
• 97
• 98
• 99

Judgments of the Court of Justice

40 decisions

• C-422/24Court of Justice of the European Union2025-12-18

  Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject.

• C-492/23Court of Justice of the European Union2025-12-02

  X v Russmedia Digital SRL and Inform Media Press SRL

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – Principle of accountability – Article 26 – Joint control with user advertisers – Article 9(1) and (2)(a) – Advertisements containing sensitive data – Lawfulness of processing – Consent – Articles 24, 25 and 32 – Obligations of the controller – Prior identification of the advertisements containing such data – Prior identification of the identity of the user advertiser – Refusal of publication of unlawful advertisements – Security measures such as to prevent the copying of advertisements and their publication on other websites – Electronic commerce – Directive 2000/31/EC – Articles 12 to 15 – Possibility for such an operator, with regard to an infringement of those obligations, to rely on the exemption from liability of an intermediary information society service provider.

• C-655/23Court of Justice of the European Union2025-09-04

  IP v Quirin Privatbank AG

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Rights of the data subject – Article 17 – Right to erasure of data – Article 18 – Right to restriction of processing – Article 79 – Right to an effective judicial remedy – Unlawful processing of personal data – Action seeking an order requiring the controller to refrain from any further unlawful processing in the future – Basis – Conditions – Article 82(1) – Right to compensation – Concept of ‘non-material damage’ – Assessment of the compensation – Possible consideration of the degree of fault on the part of the controller – Possible impact of the grant of a ‘prohibitory injunction’.

• 62023CJ0313Court of Justice of the European Union2025-04-30

  Inspektorat kam Visshia sadeben savet

  Joined Cases C-313/23, C-316/23 and C-332/23.

• C-710/23Court of Justice of the European Union2025-04-03

  L. H. v Ministerstvo zdravotnictví

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4 – Definitions – Article 6 – Lawfulness of processing – Article 86 – Public access to official documents – Data concerning the representative of a legal person – Case-law of a national court imposing an obligation to inform and consult the data subject prior to disclosure of official documents containing such data.

• C-247/23Court of Justice of the European Union2025-03-13

  VP v Országos Idegenrendészeti Főigazgatóság

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(d) – Principle of accuracy – Article 16 – Right to rectification – Article 23 – Restrictions – Data relating to gender identity – Data incorrect from the time of inclusion in a public register – Means of proof – Administrative practice of requesting proof of gender reassignment surgery.

• C-203/22Court of Justice of the European Union2025-02-27

  CK v Magistrat der Stadt Wien

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(h) – Automated decision-making, including profiling – Scoring – Assessment of the creditworthiness of a natural person – Access to meaningful information about the logic involved in profiling – Verification of the accuracy of the information provided – Directive (EU) 2016/943 – Point 1 of Article 2 – Trade secret – Personal data of third parties.

• C-638/23Court of Justice of the European Union2025-02-27

  Amt der Tiroler Landesregierung v Datenschutzbehörde

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Direct designation of the controller by national law – Auxiliary administrative entity in the service of a regional government – Lack of legal personality – Lack of legal capacity of the entity’s own – Determination of the purposes and means of the processing.

• C-383/23Court of Justice of the European Union2025-02-13

  Criminal proceedings against ILVA A/S

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 83(4) to (6) and (9) – Concept of an ‘undertaking’ – Parent company and subsidiary – Infringement of that regulation by a subsidiary – Calculation of the amount of the fine – Consideration of the total turnover of the group of which that subsidiary forms part.

• C-394/23Court of Justice of the European Union2025-01-09

  Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(c) – Data minimisation – Article 6(1) – Lawfulness of processing – Data relating to title and gender identity – Online sale of travel documents – Article 21 – Right to object.

• C-416/23Court of Justice of the European Union2025-01-09

  Österreichische Datenschutzbehörde v F R

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(f) and Article 57(4) – Tasks of the supervisory authority – Concepts of a ‘request’ and ‘excessive requests’ – Charging of a reasonable fee or refusal to act on requests in the event of manifestly unfounded or excessive requests – Criteria which may guide the supervisory authority in making its choice – Article 77(1) – Concept of a ‘complaint’.

• C-65/23Court of Justice of the European Union2024-12-19

  MK v K GmbH

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing in the context of employment – Employees’ personal data – More specific rules provided for by a Member State pursuant to that Article 88 – Obligation to comply with Article 5, Article 6(1) and Article 9(1) and (2) of that regulation – Processing on the basis of a collective agreement – Margin of discretion of the parties to the collective agreement as regards the necessity of the processing of personal data provided for by that agreement – Scope of judicial review.

Binding case law

40 judgments the Court itself has marked as interpreting this act.

• C-422/24Court of Justice of the European Union2025-12-18

  Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject.

  ECLI:EU:C:2025:980EUR-LexThe Court
• C-492/233ca6f0a7-954d-4b0b-8898-78c385afdf902025-12-02

  X v Russmedia Digital SRL and Inform Media Press SRL

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – Principle of accountability – Article 26 – Joint control with user advertisers – Article 9(1) and (2)(a) – Advertisements containing sensitive data – Lawfulness of processing – Consent – Articles 24, 25 and 32 – Obligations of the controller – Prior identification of the advertisements containing such data – Prior identification of the identity of the user advertiser – Refusal of publication of unlawful advertisements – Security measures such as to prevent the copying of advertisements and their publication on other websites – Electronic commerce – Directive 2000/31/EC – Articles 12 to 15 – Possibility for such an operator, with regard to an infringement of those obligations, to rely on the exemption from liability of an intermediary information society service provider.

  ECLI:EU:C:2025:935EUR-LexThe Court
• C-655/238e01d479-c04c-11e5-9e54-01aa75ed71a12025-09-04

  IP v Quirin Privatbank AG

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Rights of the data subject – Article 17 – Right to erasure of data – Article 18 – Right to restriction of processing – Article 79 – Right to an effective judicial remedy – Unlawful processing of personal data – Action seeking an order requiring the controller to refrain from any further unlawful processing in the future – Basis – Conditions – Article 82(1) – Right to compensation – Concept of ‘non-material damage’ – Assessment of the compensation – Possible consideration of the degree of fault on the part of the controller – Possible impact of the grant of a ‘prohibitory injunction’.

  ECLI:EU:C:2025:655EUR-LexThe Court
• 62023CJ0313eb8869f3-bbfe-402d-ba9e-141449ccf9892025-04-30

  Inspektorat kam Visshia sadeben savet

  Joined Cases C-313/23, C-316/23 and C-332/23.

  ECLI:EU:C:2025:303EUR-LexThe Court
• C-710/23957a16f7-c757-11ea-adf7-01aa75ed71a12025-04-03

  L. H. v Ministerstvo zdravotnictví

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4 – Definitions – Article 6 – Lawfulness of processing – Article 86 – Public access to official documents – Data concerning the representative of a legal person – Case-law of a national court imposing an obligation to inform and consult the data subject prior to disclosure of official documents containing such data.

  ECLI:EU:C:2025:231EUR-LexThe Court
• C-247/23Court of Justice of the European Union2025-03-13

  VP v Országos Idegenrendészeti Főigazgatóság

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(d) – Principle of accuracy – Article 16 – Right to rectification – Article 23 – Restrictions – Data relating to gender identity – Data incorrect from the time of inclusion in a public register – Means of proof – Administrative practice of requesting proof of gender reassignment surgery.

  ECLI:EU:C:2025:172EUR-LexThe Court
• C-203/22957a16f7-c757-11ea-adf7-01aa75ed71a12025-02-27

  CK v Magistrat der Stadt Wien

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(h) – Automated decision-making, including profiling – Scoring – Assessment of the creditworthiness of a natural person – Access to meaningful information about the logic involved in profiling – Verification of the accuracy of the information provided – Directive (EU) 2016/943 – Point 1 of Article 2 – Trade secret – Personal data of third parties.

  ECLI:EU:C:2025:117EUR-LexThe Court
• C-638/238e01d479-c04c-11e5-9e54-01aa75ed71a12025-02-27

  Amt der Tiroler Landesregierung v Datenschutzbehörde

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Direct designation of the controller by national law – Auxiliary administrative entity in the service of a regional government – Lack of legal personality – Lack of legal capacity of the entity’s own – Determination of the purposes and means of the processing.

  ECLI:EU:C:2025:127EUR-LexThe Court

Read from the Publications Office of the European Union on 2026-08-22.

Supervisory bodies

• IMY — Sweden
• Datatilsynet — Norway
• EDPB — European Data Protection Board

Official source

• EUR-Lex, CELEX 32016R0679
• All language versions
• Consolidated text
• National instruments, EUR-Lex NIM

National instruments

• SE Lag med kompletterande bestämmelser till EU:s dataskyddsförordning

  SFS 2018:218 · www.riksdagen.se

• NO Lov om behandling av personopplysninger (personopplysningsloven)

  LOV-2018-06-15-38 · lovdata.no

• DK Lov om supplerende bestemmelser til forordning om beskyttelse af fysiske personer (databeskyttelsesloven)

  LOV nr 502 af 23/05/2018 · www.retsinformation.dk

• FI Tietosuojalaki

  1050/2018 · www.finlex.fi

• DE Bundesdatenschutzgesetz

  BDSG · www.gesetze-im-internet.de

• UK Data Protection Act 2018

  2018 c. 12 · www.legislation.gov.uk