The General Data Protection Regulation: A Section-by-Section Deep Dive into Regulation (EU) 2016/679

Recital (1): What is the starting proposition?

"The protection of natural persons in relation to the processing of personal data is a fundamental right."

Recital (4): Is data protection absolute?

No. It must be considered in relation to its function in society and balanced against other fundamental rights in accordance with proportionality.

Recital (7): What individual-centred objective is stated?

"Natural persons should have control of their own personal data." The recital uses should, not shall.

Recital (13): What is the internal-market rule?

Free movement of personal data within the Union must not be restricted or prohibited for reasons connected with protecting natural persons regarding processing.

Recital (15): What does technological neutrality mean here?

Protection should not depend on the techniques used; it addresses automated processing and qualifying manual filing-system processing.

Recital (18): What limits the household exemption?

The activity must be purely personal or household and thus have no connection to professional or commercial activity.

Identifiable natural person

Under Recital (26), assess all means reasonably likely to be used for direct or indirect identification, including singling out, costs, time, available technology, and technological developments.

Pseudonymisation

Pseudonymised data that can be attributed to a natural person through additional information should be considered information on an identifiable natural person.

Anonymous information

Information not relating to an identified or identifiable person, or anonymised so the data subject is not or no longer identifiable; Recital (26) says GDPR principles should not apply to it.

Consent

A clear affirmative act establishing a freely given, specific, informed and unambiguous indication of agreement. Silence, pre-ticked boxes, and inactivity should not constitute consent.

Freely given

Consent should not be regarded as freely given where the data subject lacks genuine or free choice or cannot refuse or withdraw without detriment.

Transparency

Information and communication should be easily accessible and easy to understand, using clear and plain language.

Special categories and photographs

Recital (51) says sensitive data merit specific protection. Photographs should not systematically be special-category data; they are biometric data only when processed through specific technical means allowing unique identification or authentication.

No compelled identification

Where processed data do not permit identification, the controller should not be obliged to acquire additional information solely to identify the person for GDPR compliance. It should not refuse additional information supplied to support rights.

Transparency

Information should be concise, easily accessible, easy to understand, and use clear and plain language; visualisation may be appropriate. Child-directed information should be understandable to a child.

Request response

Recital (59) says the controller should respond without undue delay and at the latest within one month, and give reasons when it does not intend to comply.

Access

Access enables a person to know about collected data and verify lawfulness. It includes, in particular, purposes, possible retention period, recipients, automatic-processing logic, and certain profiling consequences.

Erasure and restriction

Erasure may apply in Recital (65)'s listed circumstances but has listed lawful-retention limits. Restriction may involve making data unavailable or technically preventing further processing and change.

Accountability in Recital (74)

The controller should implement appropriate and effective measures and be able to demonstrate compliance, considering nature, scope, context, purposes, and risk.

Objective risk evaluation

Recital (76): assess whether processing involves a risk or a high risk by reference to its nature, scope, context, and purposes.

Data protection by design and by default

Recital (78): the controller should adopt internal policies and implement measures meeting these principles; examples include minimisation and pseudonymisation as soon as possible.

DPIA

Recital (84): for processing likely to result in high risk, the controller should carry out a DPIA evaluating the origin, nature, particularity, and severity of risk.

Large-scale public monitoring

Recital (91): a DPIA is equally required for monitoring publicly accessible areas on a large scale, especially with optic-electronic devices.

Breach notification

Recital (85): notify without undue delay and, where feasible, no later than 72 hours after awareness, unless the breach is unlikely to result in a risk.

Transfer baseline

Recital (101): "the level of protection of natural persons ensured in the Union by this Regulation should not be undermined", including in cases of onward transfers.

Adequacy decision

Recital (103): the Commission may decide that a third country, territory, specified sector, or international organisation offers an adequate level of protection. Transfers may then take place without further authorisation.

Essential equivalence

Recital (104): "The third country should offer guarantees ensuring an adequate level of protection essentially equivalent to that ensured within the Union".

Appropriate safeguards

Recital (108): in the absence of adequacy, the controller or processor should take measures to compensate through appropriate safeguards for the data subject.

Binding corporate rules

Recital (110): approved rules usable by a group for transfers to organisations within the same group, provided they contain essential principles and enforceable rights.

Residual compelling legitimate interests

Recital (113): a possible route for not repetitive transfers concerning only a limited number of data subjects, and only in residual cases where no other transfer ground applies.

Complete independence

Recital (117) treats supervisory authorities empowered to perform tasks and exercise powers with complete independence as essential to protecting natural persons.

Supervisory authority concerned

Under Recital (124), an authority may be concerned because an establishment is on its territory, residents there are substantially affected, or a complaint was lodged with it.

Lead authority

For the Recital (124) cross-border conditions, the authority for the main establishment or single establishment should act as lead authority.

One-stop-shop local case

Recital (127) allows a non-lead authority to handle a case confined to one Member State and its data subjects, after informing the lead authority without delay.

Mutual-assistance non-response

If no response is received within one month of receipt of the request, Recital (133) says the requesting authority may adopt a provisional measure.

Urgent provisional-measure limit

Recital (137): a specified period of validity which should not exceed three months.

Complaint right in Recital (141)

Every data subject should have the right to lodge a complaint with a single supervisory authority, particularly in the Member State of habitual residence.

Representative body conditions

It is not-for-profit, constituted under Member State law, has public-interest statutory objectives, and is active in personal-data protection.

Board annulment timing

A concerned supervisory authority has two months from notification. A directly and individually concerned controller, processor, or complainant has two months from publication on the Board website.

Compensation standard

Data subjects should receive full and effective compensation for the damage they have suffered.

Alternative to a fine

For a minor infringement, or where a likely fine is a disproportionate burden to a natural person, a reprimand may be issued instead of a fine.

Fine effectiveness formula

The fines imposed should be effective, proportionate and dissuasive.

Personal data

Any information relating to an identified or identifiable natural person, called the data subject.

Processing

Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means.

Controller

The person, authority, agency, or other body that alone or jointly with others determines the purposes and means of processing.

Processor

The person, authority, agency, or other body that processes personal data on behalf of the controller.

Pseudonymisation

Processing so data cannot be attributed to a specific data subject without additional information, provided that information is kept separately and protected by technical and organisational measures.

Cross-border processing

Either processing in the context of establishments in more than one Member State, or single-establishment processing that substantially affects or is likely substantially to affect data subjects in more than one Member State.

Article 5(2): What is accountability?

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability').

Article 6(1): What is the lawfulness threshold?

Processing shall be lawful only if and to the extent that at least one of the following applies.

Article 7(3): What is the withdrawal usability rule?

It shall be as easy to withdraw as to give consent.

Article 8(1): What is the default child-consent age for direct information society services?

The processing of the personal data of a child shall be lawful where the child is at least 16 years old. A Member State lower age may not be below 13.

Article 12(3): What is the normal request deadline?

Without undue delay and in any event within one month of receipt of the request.

Article 14(3)(a): What is the general indirect-collection deadline?

Within a reasonable period after obtaining the personal data, but at the latest within one month.

Article 16: What can the data subject obtain?

Without undue delay, **the rectification of inaccurate personal data concerning him or her.** Incomplete data may also be completed, including by a supplementary statement, taking account of processing purposes.

Article 17: When does the controller's erasure duty arise?

Where one Article 17(1) ground applies: no longer necessary, qualifying consent withdrawal, qualifying objection, unlawful processing, legal obligation, or specified Article 8(1) collection.

Article 18: Does restriction mean no processing whatsoever?

No. Storage is excepted. Other processing is limited to consent, legal claims, protection of another person's rights, or important Union or Member State public interest.

Article 20: What two conditions are required for portability?

Processing must be based on the specified consent or contract grounds, and it must be carried out by automated means. The data also concern the person and were provided by that person.

Article 21: What follows from an objection to direct marketing?

**Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.**

Article 22: Name the minimum safeguards in contract and explicit-consent cases.

At least human intervention by the controller, an opportunity to express a point of view, and an opportunity to contest the decision.

Article 29 instruction rule

A processor and a person acting under controller or processor authority with access to personal data **"shall not process those data except on instructions from the controller"**, unless Union or Member State law requires it.

Article 30 controller record

Each controller and, where applicable, its representative **"shall maintain a record of processing activities under its responsibility."**

Article 30 small-organisation condition

The limitation concerns **"an enterprise or an organisation employing fewer than 250 persons"**, but does not apply where listed risk, non-occasional-processing, or sensitive/criminal-data conditions are present.

Article 32 security standard

Controllers and processors shall implement **"appropriate technical and organisational measures to ensure a level of security appropriate to the risk."**

Article 33 deadline

A controller notifies the authority **"without undue delay and, where feasible, not later than 72 hours after having become aware of it"**, unless the breach is unlikely to result in a risk.

Article 34 individual communication trigger

Where a breach is likely to result in high risk, **"the controller shall communicate the personal data breach to the data subject without undue delay."**

Article 40(1): What is the stated purpose of codes?

They are "codes of conduct intended to contribute to the proper application of this Regulation".

Article 40(4): What must a code contain?

Mechanisms enabling the Article 41(1) body to carry out the mandatory monitoring of compliance.

Article 42(3): Is certification compulsory?

No. "The certification shall be voluntary and available via a process that is transparent."

How long can Article 42 certification last?

A maximum period of three years, renewable under the same conditions if requirements continue to be met.

How long can Article 43 accreditation last?

A maximum period of five years, renewable on the same conditions if Article 43 requirements are met.

Article 45: How often must adequacy review occur?

The implementing act must provide for a periodic review at least every four years.

Article 48 foreign order rule

A foreign judgment or administrative decision "may only be recognised or enforceable in any manner if based on an international agreement" in force between the requesting third country and the Union or a Member State.

Article 49 explicit-consent condition

The data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks arising from the absence of adequacy and appropriate safeguards.

Residual Article 49 transfer

It is available only after Articles 45 and 46 and the listed Article 49 derogations cannot support the transfer; it must be non-repetitive, concern limited data subjects, and satisfy the other cumulative conditions.

Independence rule

Each supervisory authority shall act with complete independence. Its members shall neither seek nor take instructions from anybody.

Court boundary

Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.

Two Article 58 corrective powers

An authority may impose a temporary or definitive limitation including a ban on processing, and may order suspension of data flows to a recipient in a third country or international organisation.

Article 60 consensus duty

The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus.

Article 60 objection deadline

A concerned authority may express a relevant and reasoned objection within a period of four weeks after having been consulted.

Revised Article 60 draft

Where the lead authority intends to follow an objection, the revised draft is subject to the Article 60(4) procedure within a period of two weeks.

Union-wide compliance

The controller or processor shall take necessary measures to ensure compliance across processing activities in the context of all its establishments in the Union.

Mutual-assistance deadline

A requested authority shall take all appropriate measures to reply without undue delay and no later than one month after receiving the request.

Article 62 participation right

Where the stated multi-establishment or substantial multi-state-impact conditions apply, a supervisory authority of each relevant Member State shall have the right to participate in joint operations.

What is the Board's core Article 70 task?

The Board shall ensure the consistent application of this Regulation.

How does the Board ordinarily take decisions?

The Board shall take decisions by a simple majority of its members, unless otherwise provided for in the GDPR.

What majority is required for the Board's rules of procedure?

A two-thirds majority of its members.

What is the Article 78 information-inaction trigger?

The competent supervisory authority does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint.

What two kinds of damage can Article 82 compensate?

Material and non-material damage, where suffered as a result of an infringement of the GDPR.

What are Article 83's two undertaking turnover percentages?

Up to 2% for the Article 83(4) tier and up to 4% for the Article 83(5) and 83(6) tiers, in each case with the stated EUR maximum and whichever-is-higher rule.

Article 85(1): What must Member States do?

They shall by law reconcile personal-data protection under the GDPR with freedom of expression and information, including journalism and academic, artistic, or literary expression.

Article 88(2): What must employment rules include?

Suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights.

Article 89(1): What is the safeguard baseline?

Processing shall be subject to appropriate safeguards for rights and freedoms, including technical and organisational measures for data minimisation.

Article 91(1): When may comprehensive church rules continue?

They may continue to apply provided that they are brought into line with the GDPR.

Article 92: What is the objection period?

Three months from notification of the delegated act, extendable by three months at Parliament's or the Council's initiative.

Article 94: What happened on 25 May 2018?

Directive 95/46/EC was repealed with effect from that date.