Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means.

The person, authority, agency, or other body that alone or jointly with others determines the purposes and means of processing.

The person, authority, agency, or other body that processes personal data on behalf of the controller.

Processing so data cannot be attributed to a specific data subject without additional information, provided that information is kept separately and protected by technical and organisational measures.

Any freely given, specific, informed and unambiguous indication of the data subject's wishes, expressed by a statement or clear affirmative action.

The actor that processes personal data on behalf of the controller.

Automated processing using personal data to evaluate certain personal aspects relating to a natural person.

From the Recitals to the Operative Core — The General Data Protection Regulation: A Section-by-Section Deep Dive into Regulation (EU) 2016/679

Q: Which additional condition does Recital (169) require before the Commission should adopt immediately applicable implementing acts?

Imperative grounds of urgency. Recital (169) requires available evidence that the country, territory, sector, or international organisation does not ensure an adequate level of protection and that imperative grounds of urgency so require.

1. Crossing the Threshold: Recitals to Binding Articles

A change in legal voice

Recitals (166)-(173) explain legislative choices and commonly use should. Articles 1-4 set out operative rules using terms such as applies, does not apply, and shall.

Read each label carefully

Keep the Regulation's level of obligation intact. A recital's should remains non-mandatory in this lesson; an Article's shall remains mandatory.

The route ahead

The sequence is: institutional mechanisms and transition, then Article 1 objectives, Article 2 material scope, Article 3 territorial scope, and Article 4 definitions.

2. Recitals (166)-(169): Union-Level Tools

Delegated acts

Recital (166) says "the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission." It highlights certification and standardised icons.

Preparation safeguards

The Commission should conduct appropriate consultations, including at expert level, and should transmit relevant documents simultaneously, timely, and appropriately to Parliament and the Council.

Implementing powers

Recital (167) says implementing powers should be conferred where the Regulation provides for them, exercised under Regulation (EU) No 182/2011, while considering specific measures for micro, small, and medium-sized enterprises.

Urgency has two triggers

Under Recital (169), immediately applicable acts should follow only where evidence shows inadequate protection and imperative grounds of urgency so require.

3. Thought Exercise: Which Union Tool Fits?

Sort the scenario

For each scenario, decide which recital is the closest match. Then check your reasoning.

The Commission is preparing detailed criteria for a certification mechanism and consults specialists.
A uniform electronic format is needed for information exchange between supervisory authorities and the Board.
Available evidence shows that a third country does not ensure adequate protection, and delay would create imperative urgency.

Check yourself

Recital (166): delegated acts; certification criteria and expert consultation are expressly mentioned.
Recital (168): the examination procedure should be used for implementing acts concerning electronic information-exchange arrangements between supervisory authorities and the Board.
Recital (169): immediately applicable implementing acts should be adopted where inadequate protection is evidenced and imperative grounds of urgency so require.

Why this distinction matters

These recitals do not use one generic "Commission power." They distinguish delegated acts, implementing powers under Regulation (EU) No 182/2011, the examination procedure for listed implementing acts, and urgent immediately applicable implementing acts.

Which additional condition does Recital (169) require before the Commission should adopt immediately applicable implementing acts?

A complaint from a data subject
Imperative grounds of urgency
A certification mechanism
An establishment in more than one Member State

Show Answer

Answer: B) Imperative grounds of urgency

Recital (169) requires available evidence that the country, territory, sector, or international organisation does not ensure an adequate level of protection and that imperative grounds of urgency so require.

4. Recitals (170)-(173): Level of Action, Transition, and Legislative Relationships

Why Union action?

Recital (170) invokes subsidiarity: Member States cannot sufficiently achieve equivalent protection and free data flow throughout the Union, while Union action can better achieve it because of its scale or effects.

The transition sentence

For existing processing, Recital (171) says "Processing already under way on the date of application of this Regulation should be brought into conformity with this Regulation within the period of two years after which this Regulation enters into force."

Existing consent

Recital (171) says "it is not necessary for the data subject to give his or her consent again if the manner in which the consent has been given is in line with the conditions of this Regulation".

ePrivacy relationship

Recital (173) addresses matters not subject to specific obligations with the same objective under Directive 2002/58/EC. It says "Directive 2002/58/EC should be reviewed in particular in order to ensure consistency with this Regulation".

5. Article 1: What the Regulation Does

Two linked objectives

Article 1(1) lays down rules about personal-data protection and rules about the free movement of personal data. The Regulation presents both together.

Rights-based objective

Article 1(2): "This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data."

A mandatory rule

Article 1(3): "The free movement of personal data within the Union shall be neither restricted nor prohibited" for the specified data-protection reasons.

6. Article 2: Does the Material Scope Cover This Processing?

Automated and organised manual processing

Article 2(1) covers automated processing and non-automated processing where personal data form part of, or are intended to form part of, a filing system.

Four exclusions

Article 2(2) excludes four categories, including purely personal or household activity by a natural person and specified criminal-law activities by competent authorities.

Keep the qualifiers

A personal contact list is not automatically excluded: Article 2(2)(c) requires processing by a natural person in the course of a purely personal or household activity.

Current reference point

Article 2(3) names Regulation (EC) No 45/2001, but that instrument was repealed from 11 December 2018; references are construed as references to Regulation (EU) 2018/1725.

7. Article 3: Territorial Scope Through Three Gateways

Gateway 1: Establishment

Article 3(1) applies to processing in the context of activities of a controller's or processor's Union establishment, regardless of whether the processing takes place in the Union.

Gateway 2: Offering

For a non-Union controller or processor, Article 3(2)(a) covers "the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union".

Gateway 2: Monitoring

Article 3(2)(b) also covers monitoring data subjects' behaviour, but only as far as their behaviour takes place within the Union.

Gateway 3

Article 3(3) reaches a controller not established in the Union where that controller is in a place where Member State law applies by virtue of public international law.

8. Article 4, Part I: Data, Processing, and Key Actors

Personal data

Article 4(1): "‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’)". Identification may be direct or indirect.

Processing is broad

Article 4(2) covers any operation on personal data, whether automated or not: from collection and storage to use, disclosure, restriction, erasure, and destruction.

Controller and processor

The controller determines purposes and means. The processor processes personal data on the controller's behalf. These roles are distinct in Article 4(7)-(8).

Consent and breach

"‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes". Article 4(12) separately defines a personal data breach.

9. Article 4, Part II: Special Data, Structures, and Cross-Border Terms

Special kinds of data

Article 4(13)-(15) separately defines genetic data, biometric data, and data concerning health. Each definition specifies the link to the person and the relevant identifying or health information.

Main establishment is conditional

For controllers, Article 4(16) can shift the main establishment from central administration where another Union establishment takes and can implement decisions on purposes and means.

Cross-border processing

Article 4(23) covers multi-establishment processing and single-establishment processing that substantially affects, or is likely substantially to affect, data subjects in more than one Member State.

External currency note

The two proposed 2025 amendments affecting Article 4 are not in force as of 25 July 2026. The Regulation's original Article 4 definitions remain applicable today.

10. Flashcards: Operative Core Vocabulary

Flip each card, then explain the term aloud using the wording of Article 4 where possible.

Personal data: Any information relating to an identified or identifiable natural person, called the data subject.
Processing: Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means.
Controller: The person, authority, agency, or other body that alone or jointly with others determines the purposes and means of processing.
Processor: The person, authority, agency, or other body that processes personal data on behalf of the controller.
Pseudonymisation: Processing so data cannot be attributed to a specific data subject without additional information, provided that information is kept separately and protected by technical and organisational measures.
Cross-border processing: Either processing in the context of establishments in more than one Member State, or single-establishment processing that substantially affects or is likely substantially to affect data subjects in more than one Member State.

11. Final Check: Scope, Territory, and Consent

Choose the answer that follows the wording and conditions of the Regulation.

A controller not established in the Union offers a free digital service to data subjects in the Union. Which statement best matches Article 3(2)(a)?

The Regulation cannot apply because no payment is required.
The Regulation applies only if the controller has a processor in the Union.
The Regulation applies where the processing is related to offering goods or services to such data subjects in the Union, irrespective of whether payment is required.
The Regulation applies only after a personal data breach.