GDPR, forordning (EU) 2016/679

Betegnelse

CELEX

32016R0679

Betegnelse

EU 2016/679

Vedtatt

2016-04-27

I kraft

2016-05-24

Gjelder fra

2018-05-25

Artikler

99

Kapitler

• I General provisions1-4
• II Principles5-11
• III Rights of the data subject12-23
• IV Controller and processor24-43
• V Transfers of personal data to third countries or international organisations44-50
• VI Independent supervisory authorities51-59
• VII Cooperation and consistency60-76
• VIII Remedies, liability and penalties77-84
• IX Provisions relating to specific processing situations85-91
• X Delegated acts and implementing acts92-93
• XI Final provisions94-99

Artikler

99 artikler er lest inn i registeret, med én adresse hver. Lest 2026-08-18.

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46
• 47
• 48
• 49
• 50
• 51
• 52
• 53
• 54
• 55
• 56
• 57
• 58
• 59
• 60
• 61
• 62
• 63
• 64
• 65
• 66
• 67
• 68
• 69
• 70
• 71
• 72
• 73
• 74
• 75
• 76
• 77
• 78
• 79
• 80
• 81
• 82
• 83
• 84
• 85
• 86
• 87
• 88
• 89
• 90
• 91
• 92
• 93
• 94
• 95
• 96
• 97
• 98
• 99

EU-domstolens avgjørelser

40 avgjørelser

• C-422/24EU-domstolen2025-12-18

  Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject.

  Spør NovaCopilot
• C-492/23EU-domstolen2025-12-02

  X v Russmedia Digital SRL and Inform Media Press SRL

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – Principle of accountability – Article 26 – Joint control with user advertisers – Article 9(1) and (2)(a) – Advertisements containing sensitive data – Lawfulness of processing – Consent – Articles 24, 25 and 32 – Obligations of the controller – Prior identification of the advertisements containing such data – Prior identification of the identity of the user advertiser – Refusal of publication of unlawful advertisements – Security measures such as to prevent the copying of advertisements and their publication on other websites – Electronic commerce – Directive 2000/31/EC – Articles 12 to 15 – Possibility for such an operator, with regard to an infringement of those obligations, to rely on the exemption from liability of an intermediary information society service provider.

  Spør NovaCopilot
• C-655/23EU-domstolen2025-09-04

  IP v Quirin Privatbank AG

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Rights of the data subject – Article 17 – Right to erasure of data – Article 18 – Right to restriction of processing – Article 79 – Right to an effective judicial remedy – Unlawful processing of personal data – Action seeking an order requiring the controller to refrain from any further unlawful processing in the future – Basis – Conditions – Article 82(1) – Right to compensation – Concept of ‘non-material damage’ – Assessment of the compensation – Possible consideration of the degree of fault on the part of the controller – Possible impact of the grant of a ‘prohibitory injunction’.

  Spør NovaCopilot
• 62023CJ0313EU-domstolen2025-04-30

  Inspektorat kam Visshia sadeben savet

  Joined Cases C-313/23, C-316/23 and C-332/23.

  Spør NovaCopilot
• C-710/23EU-domstolen2025-04-03

  L. H. v Ministerstvo zdravotnictví

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4 – Definitions – Article 6 – Lawfulness of processing – Article 86 – Public access to official documents – Data concerning the representative of a legal person – Case-law of a national court imposing an obligation to inform and consult the data subject prior to disclosure of official documents containing such data.

  Spør NovaCopilot
• C-247/23EU-domstolen2025-03-13

  VP v Országos Idegenrendészeti Főigazgatóság

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(d) – Principle of accuracy – Article 16 – Right to rectification – Article 23 – Restrictions – Data relating to gender identity – Data incorrect from the time of inclusion in a public register – Means of proof – Administrative practice of requesting proof of gender reassignment surgery.

  Spør NovaCopilot
• C-203/22EU-domstolen2025-02-27

  CK v Magistrat der Stadt Wien

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(h) – Automated decision-making, including profiling – Scoring – Assessment of the creditworthiness of a natural person – Access to meaningful information about the logic involved in profiling – Verification of the accuracy of the information provided – Directive (EU) 2016/943 – Point 1 of Article 2 – Trade secret – Personal data of third parties.

  Spør NovaCopilot
• C-638/23EU-domstolen2025-02-27

  Amt der Tiroler Landesregierung v Datenschutzbehörde

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Direct designation of the controller by national law – Auxiliary administrative entity in the service of a regional government – Lack of legal personality – Lack of legal capacity of the entity’s own – Determination of the purposes and means of the processing.

  Spør NovaCopilot
• C-383/23EU-domstolen2025-02-13

  Criminal proceedings against ILVA A/S

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 83(4) to (6) and (9) – Concept of an ‘undertaking’ – Parent company and subsidiary – Infringement of that regulation by a subsidiary – Calculation of the amount of the fine – Consideration of the total turnover of the group of which that subsidiary forms part.

  Spør NovaCopilot
• C-394/23EU-domstolen2025-01-09

  Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(c) – Data minimisation – Article 6(1) – Lawfulness of processing – Data relating to title and gender identity – Online sale of travel documents – Article 21 – Right to object.

  Spør NovaCopilot
• C-416/23EU-domstolen2025-01-09

  Österreichische Datenschutzbehörde v F R

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(f) and Article 57(4) – Tasks of the supervisory authority – Concepts of a ‘request’ and ‘excessive requests’ – Charging of a reasonable fee or refusal to act on requests in the event of manifestly unfounded or excessive requests – Criteria which may guide the supervisory authority in making its choice – Article 77(1) – Concept of a ‘complaint’.

  Spør NovaCopilot
• C-65/23EU-domstolen2024-12-19

  MK v K GmbH

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing in the context of employment – Employees’ personal data – More specific rules provided for by a Member State pursuant to that Article 88 – Obligation to comply with Article 5, Article 6(1) and Article 9(1) and (2) of that regulation – Processing on the basis of a collective agreement – Margin of discretion of the parties to the collective agreement as regards the necessity of the processing of personal data provided for by that agreement – Scope of judicial review.

  Spør NovaCopilot

Veiledende avgjørelser

40 avgjørelser domstolen selv har merket som tolkning av rettsakten.

• C-422/24EU-domstolen2025-12-18

  Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 13 and 14 – Scope – Personal data collected by means of body cameras worn by ticket inspectors on public transport – Legal basis for the obligation on the data controller to provide information to the data subject.

  ECLI:EU:C:2025:980EUR-LexDomstolen
• C-492/233ca6f0a7-954d-4b0b-8898-78c385afdf902025-12-02

  X v Russmedia Digital SRL and Inform Media Press SRL

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – Principle of accountability – Article 26 – Joint control with user advertisers – Article 9(1) and (2)(a) – Advertisements containing sensitive data – Lawfulness of processing – Consent – Articles 24, 25 and 32 – Obligations of the controller – Prior identification of the advertisements containing such data – Prior identification of the identity of the user advertiser – Refusal of publication of unlawful advertisements – Security measures such as to prevent the copying of advertisements and their publication on other websites – Electronic commerce – Directive 2000/31/EC – Articles 12 to 15 – Possibility for such an operator, with regard to an infringement of those obligations, to rely on the exemption from liability of an intermediary information society service provider.

  ECLI:EU:C:2025:935EUR-LexDomstolen
• C-655/238e01d479-c04c-11e5-9e54-01aa75ed71a12025-09-04

  IP v Quirin Privatbank AG

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Rights of the data subject – Article 17 – Right to erasure of data – Article 18 – Right to restriction of processing – Article 79 – Right to an effective judicial remedy – Unlawful processing of personal data – Action seeking an order requiring the controller to refrain from any further unlawful processing in the future – Basis – Conditions – Article 82(1) – Right to compensation – Concept of ‘non-material damage’ – Assessment of the compensation – Possible consideration of the degree of fault on the part of the controller – Possible impact of the grant of a ‘prohibitory injunction’.

  ECLI:EU:C:2025:655EUR-LexDomstolen
• 62023CJ0313eb8869f3-bbfe-402d-ba9e-141449ccf9892025-04-30

  Inspektorat kam Visshia sadeben savet

  Joined Cases C-313/23, C-316/23 and C-332/23.

  ECLI:EU:C:2025:303EUR-LexDomstolen
• C-710/23957a16f7-c757-11ea-adf7-01aa75ed71a12025-04-03

  L. H. v Ministerstvo zdravotnictví

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4 – Definitions – Article 6 – Lawfulness of processing – Article 86 – Public access to official documents – Data concerning the representative of a legal person – Case-law of a national court imposing an obligation to inform and consult the data subject prior to disclosure of official documents containing such data.

  ECLI:EU:C:2025:231EUR-LexDomstolen
• C-247/23EU-domstolen2025-03-13

  VP v Országos Idegenrendészeti Főigazgatóság

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(d) – Principle of accuracy – Article 16 – Right to rectification – Article 23 – Restrictions – Data relating to gender identity – Data incorrect from the time of inclusion in a public register – Means of proof – Administrative practice of requesting proof of gender reassignment surgery.

  ECLI:EU:C:2025:172EUR-LexDomstolen
• C-203/22957a16f7-c757-11ea-adf7-01aa75ed71a12025-02-27

  CK v Magistrat der Stadt Wien

  Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(h) – Automated decision-making, including profiling – Scoring – Assessment of the creditworthiness of a natural person – Access to meaningful information about the logic involved in profiling – Verification of the accuracy of the information provided – Directive (EU) 2016/943 – Point 1 of Article 2 – Trade secret – Personal data of third parties.

  ECLI:EU:C:2025:117EUR-LexDomstolen
• C-638/238e01d479-c04c-11e5-9e54-01aa75ed71a12025-02-27

  Amt der Tiroler Landesregierung v Datenschutzbehörde

  Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Direct designation of the controller by national law – Auxiliary administrative entity in the service of a regional government – Lack of legal personality – Lack of legal capacity of the entity’s own – Determination of the purposes and means of the processing.

  ECLI:EU:C:2025:127EUR-LexDomstolen

Lest hos EUs publikasjonskontor den 2026-08-22.

Betraktninger som bærer tolkningen

Betraktningene i ingressen har ingen egen rettskraft, men avgjør ofte hvordan artikkelen leses. Koblingene er kuratert mot den offisielle teksten. Lest 2026-08-31.

• Skäl 39 · artikkel 5

  Prinsippene i artikkel 5 konkretisert: lovlighet, åpenhet og at den registrerte kjenner til behandlingen.

• Skäl 42 · artikkel 7

  Bevisbyrden for gyldig samtykke ligger hos den behandlingsansvarlige.

• Skäl 47 · artikkel 6

  Berettiget interesse kan bære direkte markedsføring og sikkerhetsbehandling, men krever alltid avveining.

• Skäl 60 · artikkel 13

  Informasjonsplikten skal være klar og tilgjengelig, særlig tilpasset barn.

• Skäl 71 · artikkel 22

  Automatiserte vedtak: rett til menneskelig inngripen, til å fremme sitt syn og til å bestride; profilering av barn skal ikke forekomme.

• Skäl 83 · artikkel 32

  Sikkerhetsnivået prøves mot risikoen: pseudonymisering og kryptering nevnes som tiltak.

• Skäl 85 · artikkel 33

  Hva et brudd på personopplysningssikkerheten er og når det sannsynligvis fører til risiko, grunnlaget for 72-timersplikten.

• Skäl 90 · artikkel 35

  Når konsekvensvurdering kreves: systematisk overvåking, sensitive data i stor skala og ny teknologi.

• Skäl 108 · artikkel 46

  Garantier ved tredjelandsoverføring: standard kontraktsklausuler og bindende virksomhetsregler.

• Skäl 148 · artikkel 83

  Gebyr skal være effektive, proporsjonale og avskrekkende i hvert enkelt tilfelle.

Veiledning og sekundærrett

Myndighetenes veiledning og de delegerte eller gjennomføringsaktene som fyller artikkelen, med primærkilde hos organet selv. Lest 2026-08-31.

• Uttalelse · EDPB2024-12-18
  Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models

  Når KI-modeller behandler personopplysninger: anonymitet, berettiget interesse og konsekvenser av ulovlig treningsdata.

  artikkel 4, 5, 6

• Veiledning · EDPB2024-10-08
  Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR

  Interesseavveiningen i artikkel 6(1)(f): når berettiget interesse bærer behandlingen.

  artikkel 6

• Veiledning · EDPB2023-02-14
  Guidelines 03/2022 on deceptive design patterns in social media interfaces

  Villedende designmønstre i grensesnitt, lest mot artikkel 5, 12, 13 og 25.

  artikkel 5, 12, 13, 25

• Veiledning · EDPB2021-07-07
  Guidelines 07/2020 on the concepts of controller and processor

  Grensen mellom behandlingsansvarlig og databehandler, med konsekvenser for artikkel 24, 26 og 28.

  artikkel 24, 26, 28

• Veiledning · EDPB2020-05-04
  Guidelines 05/2020 on consent under Regulation 2016/679

  Når samtykke er gyldig: frivillighet, informasjonskrav og tilbaketrekking etter artikkel 4(11) og 7.

  artikkel 4, 6, 7, 8

Endringshistorikk

Endringsaktene som påvirker grunnakten, slik at spørsmålet om hva som gjaldt en gitt dato kan besvares mot registeret. Lest 2026-08-31.

• Regulation (EU) 2018/1725, Article 98(2)2018-12-11

  Justerer artikkel 91 slik at kirkelige regler kan bestå forutsatt at de tilpasses forordningen.

  CELEX 32018R1725

Tilsynsorganer

• IMY: Sverige
• Datatilsynet: Norge
• EDPB: Det europeiske personvernrådet

Offisiell kilde

• EUR-Lex, CELEX 32016R0679
• Alle språkversjoner
• Konsolidert tekst
• Nasjonale rettsakter, EUR-Lex NIM

Nasjonale rettsakter

• SE Lag med kompletterande bestämmelser till EU:s dataskyddsförordning

  SFS 2018:218 · www.riksdagen.se

• NO Lov om behandling av personopplysninger (personopplysningsloven)

  LOV-2018-06-15-38 · lovdata.no

• DK Lov om supplerende bestemmelser til forordning om beskyttelse af fysiske personer (databeskyttelsesloven)

  LOV nr 502 af 23/05/2018 · www.retsinformation.dk

• FI Tietosuojalaki

  1050/2018 · www.finlex.fi

• DE Bundesdatenschutzgesetz

  BDSG · www.gesetze-im-internet.de

• UK Data Protection Act 2018

  2018 c. 12 · www.legislation.gov.uk