# Responsibility of the controller 24(1) — GDPR — provision context

> Focused context for a single provision (24(1)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-24#par-1
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Responsibility of the controller** (GDPR, full article: https://overview.legal/laws/gdpr/art-24).

## Provision text

### 24(1)

Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.


## Topics on this provision

- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing

## Cited by (exact-provision citations)

- **Judgment of the Court (Third Chamber) of 28 April 2022.#Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV.#Request for a preliminary ruling from the Bundesgerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 80 – Representation of the data subjects by a not-for-profit association – Representative action** (case-law) — https://overview.legal/posts/132312
- **VG Stuttgart - 1 K 12737/25** (case-law) — https://overview.legal/posts/184726
- **Judgment of the Court (First Chamber) of 26 September 2024.#TR v Land Hessen.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(a) and (f) – Tasks of the supervisory authority – Article 58(2) – Corrective powers – Administrative fine – Discretion of the supervisory authority – Limits.#Case C-768/21.** (case-law) — https://overview.legal/posts/132245
- **Judgment of the General Court (Fifth Chamber, Extended Composition) of 24 May 2023.#Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd v European Commission.#Competition – Data market – Administrative procedure – Article 18(3) and Article 24(1)(d) of Regulation (EC) No 1/2003 – Request for information – Virtual data room – Obligation to state reasons – Legal certainty – Rights of the defence – Necessity of the information requested – Misuse of powers – Right to privacy – Proportionality –** (case-law) — https://overview.legal/posts/132287
- **Judgment of the Court (Third Chamber) of 16 January 2019.#Deutsche Post AG v Hauptzollamt Köln.#Request for a preliminary ruling from the Finanzgericht Düsseldorf.#Reference for a preliminary ruling — Customs union — The Union Customs Code — Article 39 — Status of authorised economic operator — Implementing Regulation (EU) 2015/2447 — The second subparagraph of Article 24(1) — Applicant not a natural person — Questionnaire — Collection of personal data — Directive 95/46/EC — Articles 6 and 7 — R** (case-law) — https://overview.legal/posts/132339
- **X - BA-6S/221/2019** (case-law) — https://overview.legal/posts/132105
- **VB v Natsionalna agentsia za prihodite** (case-law) — https://overview.legal/posts/51485
- **German Supreme Court: No GDPR basis for debt transmission to credit agency; €500 damages** (case-law) — https://overview.legal/posts/53895
- **Judgment of the Court (Fourth Chamber) of 7 March 2024.#IAB Europe v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Standard-setting sectoral organisation proposing to its members rules on the processing of users’ consent – Article 4(1) – Concept of ‘personal data’ – String of letters and characters ca** (case-law) — https://overview.legal/posts/132270
- **Judgment of the Court (First Chamber) of 22 June 2023.#Proceedings brought by J.M.#Request for a preliminary ruling from the Itä-Suomen hallinto-oikeus.#Reference for a preliminary ruling – Processing of personal data – Regulation (EU) 2016/679 – Articles 4 and 15 – Scope of the right of access to information referred to in Article 15 – Information contained in log data – Article 4 – Definition of ‘personal data’ – Definition of ‘recipients’ – Temporal application.#Case C-579/21.** (case-law) — https://overview.legal/posts/132284
- **LG Rostock - 3 O 762/19** (case-law) — https://overview.legal/posts/122848
- **VB v Natsionalna agentsia za prihodite** ¶62 (case-law, CJEU) — https://overview.legal/posts/51485

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-24#par-1 · 2026-08-22