Legal sources with official primary sources

Printed ·

SMLM Previewerrors, bugs and incomplete coverage may occurThe model is production-ready during Q4-26

Skip to main content
Skip to the answer
NovaCopilotA service from ExploreWorldAI

Source status and reading dates are reported separately. A reading date is not source verification.

Back to the act

EU regulatory register · GDPR

Article 24Responsibility of the controller

CELEX 32016R0679 · Read on 2026-08-18 · Chapter IV

Share this page

Short answer

1. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this …

Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/gdpr-2016-679/artikel-24 · Short answer as data · Official text

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

1. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.

2. Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.

3. Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller.

Open the article on EUR-Lex

Follow-up questions

Other articles in this chapter

Knowledge card

Applies
controller: Implement and demonstrate measures that make processing compliant.
Risk if ignored
medium
What to do
Implement and demonstrate measures that make processing compliant.
Deadline
No fixed deadline in the register

card:eu:article:gdpr--art-24 · sha256 557d2e96ca24 · Source: NovaCopilot

Risk, sanction and outcome

  • Art. 24 · controller

    Risk: medium · Sanction: corrective_order · Authority: Competent supervisory authority

    Decisions applying the provision: none in the register

    Full chain (JSON)

Outcomes are counted from stored judgments that cite the provision verbatim. Source: NovaCopilot

Judgments of the Court of Justice

2 decisions

  • C-687/21Court of Justice of the European Union

    BL v MediaMarktSaturn Hagen-Iserlohn GmbH

    Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Interpretation of Articles 5, 24, 32 and 82 – Assessment of the validity of Article 82 – Inadmissibility of the request for an assessment of validity – Right to compensation for damage caused by data processing which infringes that regulation – Transmission of data to an unauthorised third party on account of an error made by the employees of the controller – Assessment of the appropriateness of the protection measures implemented by the controller – Compensatory function fulfilled by the right to compensation – Effect of the severity of the infringement – Whether necessary to establish the existence of damage caused by that infringement – Concept of ‘non-material damage’.

    Ask NovaCopilot
  • C-340/21Court of Justice of the European Union

    VB v Natsionalna agentsia za prihodite

    Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5 – Principles relating to that processing – Article 24 – Accountability of the controller – Article 32 – Measures implemented to ensure security of processing – Assessment of the appropriateness of such measures – Scope of judicial review – Taking of evidence – Article 82 – Right to compensation and liability – Possible exemption from liability of the controller in the event of infringement by third parties – Claim for compensation for non-material damage based on fear of potential misuse of personal data.

    Ask NovaCopilot

Judgments applying this article

10 judgments in the register cite the article in their text. EU 6 · DE 4

Source: NovaCopilot

Guidance and secondary law

Authority guidance and the delegated or implementing acts that fill the article, with the primary source at the issuing body. Read 2026-08-31.

The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.

Verifiable trust signals

  • Source-linked answers and explicit evidence gaps
  • Obligations, controls, risks and consequences
  • Stable objects and verifiable checksums
  • Rule-based objects, optional source-linked reasoning
  • Model card, source status and audit

Model cardAudit