GDPR Art. 24 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Responsibility of the controller

Controllers
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.

    Controllers 189
  2. 2.

    Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.

    Controllers Processing 50
  3. 3.

    Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller.

    Controllers Certification Accountability 24

Enforcement

Cited in 155 fines totalling €924.0M

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (52) · median fine €27,750 · see all enforcement for Art. 24 →

Connections by provision

24(1) 33 Case Law 97 Enforcement 58 Guidance 1 Literature .md
Case Law 33
Proceedings brought by J.M Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd v European Commission IAB Europe v Gegevensbeschermingsautoriteit Court upholds €50,000 fine on Sociálna poisťovňa for sending sensitive data by ordinary Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV LG Rostock: Pre-ticked cookie consent boxes invalid under Art 6(1)(a) GDPR BGH - VI ZR 375/2 Deutsche Post AG v Hauptzollamt Köln +25 more
Enforcement 97
TikTok Limited: Non-compliance with general data processing principles Employment Service under the Ministry of Social Security and Labor of the Republic of Lithuania: Insufficient technical and organisational measures to ensure information security City of Reykjavik: Non-compliance with general data processing principles Housing Finance Corporation: Insufficient legal basis for data processing Telenor ASA.: Non-compliance with general data processing principles Polskie Radio Szczecin: Insufficient technical and organisational measures to ensure information security Company: Non-compliance with general data processing principles AEPD (Spain) - PS-00140-2025 +89 more
Guidance 58
Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision EDPB Annual Report 2021 Report of the work undertaken by the supervisory authorities within the 101 Taskforce EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB Annual Report 2023 Report of the work undertaken by the ChatGPT Taskforce Guidelines 01/2023 on Article 37 Law Enforcement Directive Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) +50 more
Literature 1
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
24(2) 29 Case Law 6 Enforcement 14 Guidance 1 Literature .md
Case Law 29
Zalando SE v European Commission European Commission v Hungary ¶72 Zalando SE v European Commission ¶73 Zalando SE v European Commission ¶74 Zalando SE v European Commission ¶105 Zalando SE v European Commission ¶107 Zalando SE v European Commission ¶108 Zalando SE v European Commission +21 more
Enforcement 6
UODO fines accounting firm €2,760 for email breach security failures MALTA DPA: Insufficient fulfilment of data subjects rights Axpo Italia Spa: Non-compliance with general data processing principles MALTA DPA: Insufficient technical and organisational measures to ensure information security DPC (Ireland) - 06/SIU/2018 ¶18 UODO fines accounting firm €2,760 for email breach security failures
Guidance 14
EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR Statement 1/2025 on Age Assurance Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision ¶121 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 ¶53 Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR +6 more
Literature 1
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
24(3) 8 Case Law 16 Guidance .md
Case Law 8
VB v Natsionalna agentsia za prihodite Tiktok Technology Ltd v European Commission Meta Platforms Ireland Ltd v European Commission ¶24 Meta Platforms Ireland Ltd v European Commission ¶23 Meta Platforms Ireland Ltd v European Commission ¶26 Tiktok Technology Ltd v European Commission ¶27 Tiktok Technology Ltd v European Commission ¶28 VB v Natsionalna agentsia za prihodite
Guidance 16
Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( Guidelines 01/2023 on Article 37 Law Enforcement Directive Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Opinion 15/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR Guidelines 07/2022 on certification as a tool for transfers ¶99 Guidelines 01/2023 on Article 37 Law Enforcement Directive +8 more