GDPR Art. 4 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Definitions

Personal Data Controllers Processing Processors Public Sector Public Authority Supervisory Authorities Supervision
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679

For the purposes of this Regulation:

  1. 1.

    ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

    Identification IP Address Personal Data 379
  2. 2.

    ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

    Processing Personal Data 212
  3. 3.

    ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;

    Personal Data Right to Restriction 71
  4. 4.

    ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

    Automated Decision-Making Personal Data Processing 32
  5. 5.

    ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

    Personal Data Processing Anonymization 36
  6. 6.

    ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

    Personal Data 7
  7. 7.

    ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

    Public Sector Personal Data Processing 174
  8. 8.

    ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

    Personal Data Data Processor Public Authority 14
  9. 9.

    ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

    Recipient Public Authority Public Sector 18
  10. 10.

    ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

    Controllers Public Authority Public Sector 16
  11. 11.

    ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

    Processing Consent Personal Data 64
  12. 12.

    ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

    Notification Obligation Personal Data Data Breaches 14
  13. 13.

    ‘genetic data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;

    Special Categories of Data Types of Special Categories of Personal Data Genetic Data 1
  14. 14.

    ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;

    Personal Data Special Categories of Data Identification 6
  15. 15.

    ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;

    Personal Data Health Data 10
  16. 16.

    ‘main establishment’ means:

    8
    1. a)
      as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment;
      Processing Controllers Personal Data
    2. b)
      as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;
      Processing Processors Controllers
  17. 17.

    ‘representative’ means a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation;

    Controllers Representatives Processors
  18. 18.

    ‘enterprise’ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;

    1
  19. 19.

    ‘group of undertakings’ means a controlling undertaking and its controlled undertakings;

    1
  20. 20.

    ‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity;

    Personal Data Codes of Conduct Processors
  21. 21.

    ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51;

    Public Authority Public Sector Supervisory Authorities 4
  22. 22.

    ‘supervisory authority concerned’ means a supervisory authority which is concerned by the processing of personal data because:

    Processing Personal Data Supervision 12
    1. a)
      the controller or processor is established on the territory of the Member State of that supervisory authority;
      Supervision Processors Supervisory Authorities
    2. b)
      data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing; or
      Supervision Supervisory Authorities
    3. c)
      a complaint has been lodged with that supervisory authority;
      Supervisory Authorities Supervision
  23. 23.

    ‘cross-border processing’ means either:

    13
    1. a)
      processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or
      Personal Data Processing Controllers
    2. b)
      processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.
      Controllers Processors Processing
  24. 24.

    ‘relevant and reasoned objection’ means an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union;

    Controllers Processors Personal Data 40
  25. 25.

    ‘information society service’ means a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 of the European Parliament and of the Council (19);

    5
  26. 26.

    ‘international organisation’ means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries.

    1

Enforcement

Cited in 22 fines totalling €3.1M

Top authority: 🇧🇪APD/GBA (Belgium) (4) · median fine €8,300 · see all enforcement for Art. 4 →

Connections by provision

4(1) 341 Case Law 31 Guidance 5 Literature 2 News .md
Case Law 341
Judgment of the Court (Eighth Chamber) of 19 December 2024.#MK v K GmbH.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing in the context of employment – Employees’ personal data – More specific rules provided for by a Member State pursuant to that Article 88 – Obligation to comply with Article 5, Article 6 X - BA-6S/221/2019 CJEU - C‑371/24 - Comdribus CJEU - Case C‑5/25 - Pilev EGAN & HACKETT V. EUROPEAN PARLIAMENT, 28.3.2012 (“EGAN & HACKETT”) OVG Saarlouis - 2 A 165/24 GC - T-318/24 GC - T-496/13 - McCullough v Cedefop +333 more
Guidance 31
Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models Guidelines 02/2021 on virtual voice assistants Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space EDPB Annual Report 2022 Guidelines 07/2020 on the concepts of controller and processor in the GDPR +23 more
Literature 5
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Can the GPC standard eliminate consent banners in the EU? Generative AI and data protection General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens? Perlindungan Hukum terhadap Inferred data dalam Automated Decision-Making: Studi Perbandingan GDPR dan UU PDP
News 2
BVwG - W254 2253353-1 Digital Omnibus - First Legal Analysis
4(2) 193 Case Law 16 Guidance 3 Literature .md
Case Law 193
GHARL - 200.256.426 Österreichische Datenschutzbehörde v CRIF Judgment of the Court (Third Chamber) of 28 November 2024.#Nemzeti Adatvédelmi és Információszabadság Hatóság v UC.#Request for a preliminary ruling from the Kúria.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data and the free movement of such data – Regulation (EU) 2016/679 – Data processed when drawing up a COVID-19 certificate – Data not collected from the data subject – Information to be provided – Exception to the obligation t CE - 439360 BVwG - W137 2327171-1 OLG München - 36 U 1054/25 e Privacy International v Secretary of State CJEU - C-526/24 - Brillen Rottler +185 more
Guidance 16
Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement Guidelines 04/2022 on the calculation of administrative fines under the GDPR Opinion 04/2024 on the notion of main establishment of a controller in the Union under Art. 4.16(a) GDPR EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space Guidelines 07/2020 on the concepts of controller and processor in the GDPR Guidelines 07/2022 on certification as a tool for transfers Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 EDPB contribution to the 6th round of consultations on the draft Second Additional Protocol to the Council of Europe Budapest Convention on Cybercrime +8 more
Literature 3
Perlindungan Hukum Data Pribadi di Era Globalisasi Digital: Studi Perbandingan General Data Protection Regulation Uni Eropa dengan Undang-Undang Perlindungan Data Pribadi Indonesia Can the GPC standard eliminate consent banners in the EU? Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)?
4(3) 61 Case Law 8 Guidance 2 Literature .md
Case Law 61
Judgment of the Court (Fifth Chamber) of 10 March 2016.#Safe Interenvios, SA v Liberbank, SA and Others.#Request for a preliminary ruling from the Audiencia Provincial de Barcelona.#Reference for a preliminary ruling — Prevention of the use of the financial system for the purpose of money laundering and terrorist financing — Directive 2005/60/EC — Customer due diligence measures — Directive 2007/64/EC — Payment services in the internal market.#Case C-235/14. Judgment of the Court (Grand Chamber) of 5 June 2023.#European Commission v Republic of Poland.#Failure of a Member State to fulfil obligations – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union ‐ Rule of law – Effective legal protection in the fields covered by EU law – Independence of judges – Article 267 TFEU – Possibility of making a reference to the Court for a preliminary ruling – Primacy of EU law – Jurisdiction in relation t Order of the Vice-President of the Court of 21 April 2023.#European Commission v Republic of Poland.#Interim relief – Article 163 of the Rules of Procedure of the Court of Justice – Application to cancel or vary an order for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Non-execution – Change in circumstances – Periodic penalty payment.#Case C-204/21 R- Judgment of the Court (First Chamber) of 12 January 2023.#BE v Nemzeti Adatvédelmi és Információszabadság Hatóság.#Request for a preliminary ruling from the Fővárosi Törvényszék.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Articles 77 to 79 – Remedies – Parallel exercise – Relationship – Procedural autonomy – Effectiveness of the protection rules established by that regulation – Consistent and homo Judgment of the Court (Grand Chamber) of 21 March 2024.#RL v Landeshauptstadt Wiesbaden.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Regulation (EU) 2019/1157 – Strengthening the security of identity cards of EU citizens – Validity – Legal basis – Article 21(2) TFEU – Article 77(3) TFEU – Regulation (EU) 2019/1157 – Article 3(5) – Obligation for Member States to include two fingerprints in interoperable digital formats in the stora Judgment of the Court (Grand Chamber) of 1 August 2022.#OT v Vyriausioji tarnybinės etikos komisija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 52(1) – Directive 95/46/EC – Article 7(c) – Article 8(1) – Regulation (EU) 2016/679 – Point (c) of the first subparagraph of Judgment of the General Court (Eighth Chamber, Extended Composition) of 27 April 2022.#Robert Roos and Others v European Parliament.#Public health – Requirement to present a valid EU digital COVID-19 certificate to access the Parliament’s buildings – Legal basis – Freedom and independence of Members of the European Parliament – Obligation to ensure the health of staff in the service of the European Union – Parliamentary immunity – Processing of personal data – Right to respect for private life – Order of the Vice-President of the Court of 27 October 2021.#European Commission v Republic of Poland.#Interim relief – Article 279 TFEU – Application for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Disciplinary regime for judges – Examination of questions of law concerning the lack of independence of judges – Periodic penalty payment.#Case C-204/21 R +53 more
Guidance 8
EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework Position paper on Interplay between data protection and competition law Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation EDPB Annual Report 2022 Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms ¶63 EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space
Literature 2
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Perspectives for Open Source AI
4(4) 17 Case Law 11 Guidance 3 Literature 1 News .md
Case Law 17
BVwG - W256 2227693-1 Judgment of the General Court (Tenth Chamber, Extended Composition) of 3 September 2025.#Philippe Latombe v European Commission.#Transfer of personal data to the United States – Commission Implementing Decision on the adequate level of protection of personal data ensured by the United States – Right to an effective remedy – Right to private and family life – Decisions based solely on the automated processing of personal data – Security of the processing of personal data.#Case T-553/23. Judgment of the Court (First Chamber) of 7 December 2023.#OQ v Land Hessen.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 22 – Automated individual decision-making – Credit information agencies – Automated establishment of a probability value concerning the ability of a person to meet payment commitments in the future (‘s Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment Judgment of the General Court (Eighth Chamber, Extended Composition) of 27 April 2022.#Robert Roos and Others v European Parliament.#Public health – Requirement to present a valid EU digital COVID-19 certificate to access the Parliament’s buildings – Legal basis – Freedom and independence of Members of the European Parliament – Obligation to ensure the health of staff in the service of the European Union – Parliamentary immunity – Processing of personal data – Right to respect for private life – ¶93 Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment ¶91 Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment ¶71 Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment +9 more
Guidance 11
EU - U.S. Privacy Shield - Third Annual Joint Review report – 12/11/2019 EU - U.S. Privacy Shield - Second Annual Joint Review report – 22/01/2019 Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement Guidelines 01/2023 on Article 37 Law Enforcement Directive Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Contribution of the EDPB to the European Commission’s evaluation of the Data Protection Law Enforcement Directive (LED) under Article 62 +3 more
Literature 3
Perlindungan Hukum terhadap Inferred data dalam Automated Decision-Making: Studi Perbandingan GDPR dan UU PDP HOW GDPR TREATS AUTOMATED DECISION-MAKING General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?
News 1
BVwG - W254 2253353-1
4(5) 26 Case Law 9 Guidance 1 Literature .md
Case Law 26
Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai Judgment of the Court (Grand Chamber) of 18 July 2017.#European Commission v Patrick Breyer.#Appeal — Access to documents of the institutions — Article 15(3) TFEU — Regulation (EC) No 1049/2001 — Scope — Application for access to written submissions filed by the Republic of Austria in the case in which judgment was given on 29 July 2010, Commission v Austria (C‑189/09, not published, EU:C:2010:455) — Documents in the possession of the European Commission — Protection of court proceedings.#Case C Judgment of the Court (Fourth Chamber) of 7 March 2024.#IAB Europe v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Standard-setting sectoral organisation proposing to its members rules on the processing of users’ consent – Article 4(1) – Concept of ‘personal data’ – String of letters and characters ca Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment Judgment of the Court (Grand Chamber) of 5 December 2023.#Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Arti Hoge Raad - ECLI:NL:PHR:2023:935 NSS - 1 As 183/2023-62 +18 more
Guidance 9
EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines 9/2022 on personal data breach notification under GDPR EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse Opinion 12/2024 on the draft decision of the French Supervisory Authority regarding the “Code of Conduct for Service Providers in Clinical Research” submitted by EUCROF EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro ¶44 EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research +1 more
Literature 1
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
4(6) 7 Case Law .md
Case Law 7
Judgment of the Court (Sixth Chamber) of 7 March 2024.#Endemol Shine Finland Oy.#Request for a preliminary ruling from the Itä-Suomen hovioikeus.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 2, 4, 6, 10 and 86 – Data held by a court relating to the criminal convictions of a natural person – Oral disclosure of such data to a commercial company on account of a competition organised by that company – Concept of ‘processing of personal data’ Judgment of the General Court (Fifth Chamber, Extended Composition) of 25 September 2018.#Maria Psara and Others v European Parliament.#Access to documents — Regulation (EC) No 1049/2001 — European Parliament — Expenditure by Members of the Parliament of their allowances — Refusal to grant access — Non-existent documents — Personal data — Regulation (EC) No 45/2001 — Need to transfer the data — Specific and individual examination — Partial access — Excessive administrative burden — Obligation to ¶121 Judgment of the General Court (Fifth Chamber, Extended Composition) of 25 September 2018.#Maria Psara and Others v European Parliament.#Access to documents — Regulation (EC) No 1049/2001 — European Parliament — Expenditure by Members of the Parliament of their allowances — Refusal to grant access — Non-existent documents — Personal data — Regulation (EC) No 45/2001 — Need to transfer the data — Specific and individual examination — Partial access — Excessive administrative burden — Obligation to ¶24 Judgment of the General Court (Fifth Chamber, Extended Composition) of 25 September 2018.#Maria Psara and Others v European Parliament.#Access to documents — Regulation (EC) No 1049/2001 — European Parliament — Expenditure by Members of the Parliament of their allowances — Refusal to grant access — Non-existent documents — Personal data — Regulation (EC) No 45/2001 — Need to transfer the data — Specific and individual examination — Partial access — Excessive administrative burden — Obligation to ¶36 Judgment of the Court (Sixth Chamber) of 7 March 2024.#Endemol Shine Finland Oy.#Request for a preliminary ruling from the Itä-Suomen hovioikeus.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 2, 4, 6, 10 and 86 – Data held by a court relating to the criminal convictions of a natural person – Oral disclosure of such data to a commercial company on account of a competition organised by that company – Concept of ‘processing of personal data’ ¶38 Judgment of the Court (Sixth Chamber) of 7 March 2024.#Endemol Shine Finland Oy.#Request for a preliminary ruling from the Itä-Suomen hovioikeus.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 2, 4, 6, 10 and 86 – Data held by a court relating to the criminal convictions of a natural person – Oral disclosure of such data to a commercial company on account of a competition organised by that company – Concept of ‘processing of personal data’ ¶37 Judgment of the Court (Sixth Chamber) of 7 March 2024.#Endemol Shine Finland Oy.#Request for a preliminary ruling from the Itä-Suomen hovioikeus.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 2, 4, 6, 10 and 86 – Data held by a court relating to the criminal convictions of a natural person – Oral disclosure of such data to a commercial company on account of a competition organised by that company – Concept of ‘processing of personal data’
4(7) 151 Case Law 2 Enforcement 18 Guidance 3 Literature .md
Case Law 151
LG Rostock - 3 O 762/19 Rb. Den Haag - C/09/689833 CJEU - C-136/17 - GC and Others (De-referencing of sensitive data) Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – LG Köln - 28 O 168/22 BGH awards non-material GDPR damages for erroneous disclosure of applicant salary data Judgment of the Court (Eighth Chamber) of 27 February 2025.#Amt der Tiroler Landesregierung v Datenschutzbehörde.#Request for a preliminary ruling from the Verwaltungsgerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Direct designation of the controller by national law – Auxiliary administrative entity in the service of a regional government – Lack of Judgment of the Court (Eighth Chamber) of 19 December 2024.#MK v K GmbH.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing in the context of employment – Employees’ personal data – More specific rules provided for by a Member State pursuant to that Article 88 – Obligation to comply with Article 5, Article 6 +143 more
Enforcement 2
DSB: Medical student fined for recording dementia patient video without Art 9 GDPR basis AKI (Estonia) - No. 2.1-1/24/397-890-38
Guidance 18
EDPB-EDPS Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Report of the work undertaken by the supervisory authorities within the 101 Taskforce Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation EDPB Annual Report 2018 Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria Guidelines on processing of personal data through blockchain technologies +10 more
Literature 3
Generative AI and data protection If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Can the GPC standard eliminate consent banners in the EU?
4(8) 6 Case Law 6 Guidance 2 Literature .md
Case Law 6
LG Rostock - 3 O 762/19 Judgment of the General Court (Tenth Chamber, Extended Composition) of 3 September 2025.#Philippe Latombe v European Commission.#Transfer of personal data to the United States – Commission Implementing Decision on the adequate level of protection of personal data ensured by the United States – Right to an effective remedy – Right to private and family life – Decisions based solely on the automated processing of personal data – Security of the processing of personal data.#Case T-553/23. Judgment of the Court (Grand Chamber) of 5 December 2023.#Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Arti ¶22 Judgment of the Court (Grand Chamber) of 5 December 2023.#Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Arti ¶172 Judgment of the General Court (Tenth Chamber, Extended Composition) of 3 September 2025.#Philippe Latombe v European Commission.#Transfer of personal data to the United States – Commission Implementing Decision on the adequate level of protection of personal data ensured by the United States – Right to an effective remedy – Right to private and family life – Decisions based solely on the automated processing of personal data – Security of the processing of personal data.#Case T-553/23. ¶83 Judgment of the Court (Grand Chamber) of 5 December 2023.#Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(2) and (7) – Concepts of ‘processing’ and ‘controller’ – Development of a mobile IT application – Article 26 – Joint control – Arti
Guidance 6
Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) Guidelines on processing of personal data through blockchain technologies Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation ¶42 Guidelines on processing of personal data through blockchain technologies
Literature 2
Generative AI and data protection Can the GPC standard eliminate consent banners in the EU?
4(9) 8 Case Law 10 Guidance .md
Case Law 8
GC - T-318/24 Judgment of the Court (First Chamber) of 22 June 2023.#Proceedings brought by J.M.#Request for a preliminary ruling from the Itä-Suomen hallinto-oikeus.#Reference for a preliminary ruling – Processing of personal data – Regulation (EU) 2016/679 – Articles 4 and 15 – Scope of the right of access to information referred to in Article 15 – Information contained in log data – Article 4 – Definition of ‘personal data’ – Definition of ‘recipients’ – Temporal application.#Case C-579/21. Judgment of the Court (Fifth Chamber) of 17 June 2021.#Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA.#Request for a preliminary ruling from the Ondernemingsrechtbank Antwerpen.#Reference for a preliminary ruling – Intellectual property – Copyright and related rights – Directive 2001/29/EC – Article 3(1) and (2) – Concept of ‘making available to the public’ – Downloading of a file containing a protected work via a peer-to-peer network and the simultaneous Judgment of the Court (First Chamber) of 4 October 2024.#Agentsia po vpisvaniyata v OL.#Request for a preliminary ruling from the Varhoven administrativen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Publication in the commercial register of a company’s constitutive instrument containing personal data – Directive (EU) 2017/1132 – Non-compulsory personal data – Lack of consent of the data subjec ¶126 Judgment of the Court (Fifth Chamber) of 17 June 2021.#Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA.#Request for a preliminary ruling from the Ondernemingsrechtbank Antwerpen.#Reference for a preliminary ruling – Intellectual property – Copyright and related rights – Directive 2001/29/EC – Article 3(1) and (2) – Concept of ‘making available to the public’ – Downloading of a file containing a protected work via a peer-to-peer network and the simultaneous ¶47 Judgment of the Court (First Chamber) of 22 June 2023.#Proceedings brought by J.M.#Request for a preliminary ruling from the Itä-Suomen hallinto-oikeus.#Reference for a preliminary ruling – Processing of personal data – Regulation (EU) 2016/679 – Articles 4 and 15 – Scope of the right of access to information referred to in Article 15 – Information contained in log data – Article 4 – Definition of ‘personal data’ – Definition of ‘recipients’ – Temporal application.#Case C-579/21. ¶69 Judgment of the Court (First Chamber) of 4 October 2024.#Agentsia po vpisvaniyata v OL.#Request for a preliminary ruling from the Varhoven administrativen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Publication in the commercial register of a company’s constitutive instrument containing personal data – Directive (EU) 2017/1132 – Non-compulsory personal data – Lack of consent of the data subjec ¶70 Judgment of the Court (First Chamber) of 4 October 2024.#Agentsia po vpisvaniyata v OL.#Request for a preliminary ruling from the Varhoven administrativen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Publication in the commercial register of a company’s constitutive instrument containing personal data – Directive (EU) 2017/1132 – Non-compulsory personal data – Lack of consent of the data subjec
Guidance 10
Guidelines 4/2018 on the accreditation of certification bodies under Article 43 of the General Data Protection Regulation (2016/679) Guidelines 01/2022 on data subject rights - Right of access Guidelines 8/2020 on the targeting of social media users EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) ¶39 EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space +2 more
4(10) 7 Case Law 7 Guidance 2 Literature .md
Case Law 7
VB v Natsionalna agentsia za prihodite SG Nürnberg - S 5 SF 65/24 DS Judgment of the Court (Fifth Chamber) of 17 June 2021.#Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA.#Request for a preliminary ruling from the Ondernemingsrechtbank Antwerpen.#Reference for a preliminary ruling – Intellectual property – Copyright and related rights – Directive 2001/29/EC – Article 3(1) and (2) – Concept of ‘making available to the public’ – Downloading of a file containing a protected work via a peer-to-peer network and the simultaneous ¶126 Judgment of the Court (Fifth Chamber) of 17 June 2021.#Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA.#Request for a preliminary ruling from the Ondernemingsrechtbank Antwerpen.#Reference for a preliminary ruling – Intellectual property – Copyright and related rights – Directive 2001/29/EC – Article 3(1) and (2) – Concept of ‘making available to the public’ – Downloading of a file containing a protected work via a peer-to-peer network and the simultaneous ¶22 VB v Natsionalna agentsia za prihodite ¶28 Judgment of the Court (Fourth Chamber) of 4 September 2025.#IP v Quirin Privatbank AG.#Request for a preliminary ruling from the Bundesgerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Rights of the data subject – Article 17 – Right to erasure of data – Article 18 – Right to restriction of processing – Article 79 – Right to an effective judicial remedy – Unlawful processing of personal data ¶39 VB v Natsionalna agentsia za prihodite
Guidance 7
Guidelines 01/2022 on data subject rights - Right of access Guidelines 9/2022 on personal data breach notification under GDPR Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Guidelines 07/2020 on the concepts of controller and processor in the GDPR ¶114 Guidelines 9/2022 on personal data breach notification under GDPR ¶53 Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications
Literature 2
Generative AI and data protection Can the GPC standard eliminate consent banners in the EU?
4(11) 35 Case Law 24 Guidance 5 Literature .md
Case Law 35
Bundesverband der Verbraucherzentralen v Planet49 GmbH BVwG - W256 2227693-1 Meta Platforms v noyb GC and Others v CNIL CJEU - C-61/19 - Orange Romania HvJ EU 9 januari 2025, C‑394/23 (Mousse). Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – BGH - I ZR 7/16 +27 more
Guidance 24
Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Response of the EDPB to the European Commission's targeted consultation on a digital euro Opinion 27/2025 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data by the United Kingdom Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data +16 more
Literature 5
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Can the GPC standard eliminate consent banners in the EU? Pay or Consent Models in Europe: Already Outdated or an Overlooked Crisis in Freely Given Consent? Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)? Understanding the GDPR from a requirements engineering perspective—a systematic mapping study on regulatory data protection requirements
4(12) 5 Case Law 9 Guidance .md
Case Law 5
Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment VB v Natsionalna agentsia za prihodite SG Nürnberg - S 5 SF 65/24 DS ¶13 VB v Natsionalna agentsia za prihodite ¶130 Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment
Guidance 9
Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria Guidelines 9/2022 on personal data breach notification under GDPR Guidelines 01/2021 EDPB Annual Report 2021 Guidelines 01/2022 on data subject rights - Right of access ¶15 Guidelines 9/2022 on personal data breach notification under GDPR ¶13 Guidelines 9/2022 on personal data breach notification under GDPR ¶4 Guidelines 01/2021 +1 more
4(13) 1 Guidance .md
Guidance 1
Opinion 04/2024 on the notion of main establishment of a controller in the Union under Art. 4.16(a) GDPR
4(14) 4 Guidance 1 Literature 1 News .md
Guidance 4
Opinion 26/2018 on the draft list of the competent supervisory authority of Luxembourg regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR) Guidelines 02/2021 on virtual voice assistants ¶31 Guidelines 02/2021 on virtual voice assistants
Literature 1
Generative AI and data protection
News 1
Greek SA fines Clearview AI for EUR 20M
4(15) 9 Case Law 1 News .md
Case Law 9
Judgment of the Court (Grand Chamber) of 4 October 2024.#ND v DR.#Request for a preliminary ruling from the Bundesgerichtshof.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Chapter VIII – Remedies – Medicinal products marketed by a pharmacist on an online platform – Action brought before the national civil courts by a competitor of that pharmacist on the basis of the prohibition of unfair commercial practices for infringement by the pharmacist of t Judgment of the Court (Grand Chamber) of 1 August 2022.#OT v Vyriausioji tarnybinės etikos komisija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 52(1) – Directive 95/46/EC – Article 7(c) – Article 8(1) – Regulation (EU) 2016/679 – Point (c) of the first subparagraph of Judgment of the Court (Third Chamber) of 21 December 2023.#ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts.#Request for a preliminary ruling from the Bundesarbeitsgericht.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 6(1) – Conditions for lawful processing – Article 9(1) to (3) – Processing of special categories of data – Data concerning heal ¶80 Judgment of the Court (Grand Chamber) of 4 October 2024.#ND v DR.#Request for a preliminary ruling from the Bundesgerichtshof.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Chapter VIII – Remedies – Medicinal products marketed by a pharmacist on an online platform – Action brought before the national civil courts by a competitor of that pharmacist on the basis of the prohibition of unfair commercial practices for infringement by the pharmacist of t ¶42 Judgment of the Court (Grand Chamber) of 4 October 2024.#ND v DR.#Request for a preliminary ruling from the Bundesgerichtshof.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Chapter VIII – Remedies – Medicinal products marketed by a pharmacist on an online platform – Action brought before the national civil courts by a competitor of that pharmacist on the basis of the prohibition of unfair commercial practices for infringement by the pharmacist of t ¶76 Judgment of the Court (Grand Chamber) of 4 October 2024.#ND v DR.#Request for a preliminary ruling from the Bundesgerichtshof.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Chapter VIII – Remedies – Medicinal products marketed by a pharmacist on an online platform – Action brought before the national civil courts by a competitor of that pharmacist on the basis of the prohibition of unfair commercial practices for infringement by the pharmacist of t ¶78 Judgment of the Court (Grand Chamber) of 4 October 2024.#ND v DR.#Request for a preliminary ruling from the Bundesgerichtshof.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Chapter VIII – Remedies – Medicinal products marketed by a pharmacist on an online platform – Action brought before the national civil courts by a competitor of that pharmacist on the basis of the prohibition of unfair commercial practices for infringement by the pharmacist of t ¶124 Judgment of the Court (Grand Chamber) of 1 August 2022.#OT v Vyriausioji tarnybinės etikos komisija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 52(1) – Directive 95/46/EC – Article 7(c) – Article 8(1) – Regulation (EU) 2016/679 – Point (c) of the first subparagraph of +1 more
News 1
CJEU: processing personal data liable to disclose indirectly sexual orientation constitutes processing of special categories of personal data
4(16) 8 Guidance .md
Guidance 8
Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority EDPB Annual Report 2021 Statement on the end of the Brexit transition period Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) Statement on the end of the Brexit transition period - update 13/01/2021 Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation ¶17 Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority ¶22 Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority
4(16)(a) 1 Guidance .md
Guidance 1
Opinion 04/2024 on the notion of main establishment of a controller in the Union under Art. 4.16(a) GDPR
4(16)(b) 3 Guidance .md
Guidance 3
Opinion 04/2024 on the notion of main establishment of a controller in the Union under Art. 4.16(a) GDPR Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority ¶40 Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority
4(18) 1 Guidance .md
Guidance 1
Guidelines 04/2022 on the calculation of administrative fines under the GDPR
4(19) 1 Guidance .md
Guidance 1
Guidelines 04/2022 on the calculation of administrative fines under the GDPR
4(21) 2 Case Law 2 Guidance .md
Case Law 2
Judgment of the Court (First Chamber) of 22 June 2023.#Proceedings brought by J.M.#Request for a preliminary ruling from the Itä-Suomen hallinto-oikeus.#Reference for a preliminary ruling – Processing of personal data – Regulation (EU) 2016/679 – Articles 4 and 15 – Scope of the right of access to information referred to in Article 15 – Information contained in log data – Article 4 – Definition of ‘personal data’ – Definition of ‘recipients’ – Temporal application.#Case C-579/21. ¶24 Judgment of the Court (First Chamber) of 22 June 2023.#Proceedings brought by J.M.#Request for a preliminary ruling from the Itä-Suomen hallinto-oikeus.#Reference for a preliminary ruling – Processing of personal data – Regulation (EU) 2016/679 – Articles 4 and 15 – Scope of the right of access to information referred to in Article 15 – Information contained in log data – Article 4 – Definition of ‘personal data’ – Definition of ‘recipients’ – Temporal application.#Case C-579/21.
Guidance 2
Guidelines 9/2022 on personal data breach notification under GDPR ¶4 Guidelines 9/2022 on personal data breach notification under GDPR
4(22) 12 Guidance .md
Guidance 12
Guidelines 03/2021 on the application of Article 65(1)(a) GDPR Guidelines 02/2022 on the application of Article 60 GDPR Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority Opinion 8/2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 ¶42 Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority ¶34 Opinion 8/2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment ¶31 Opinion 8/2019 on the competence of a supervisory authority in case of a change in circumstances relating to the main or single establishment +4 more
4(22)(a) 1 Guidance .md
Guidance 1
EDPB Document Setting Forth a Co-Operation procedure for the approval of Binding Corporate Rules for controllers and processors
4(23) 4 Case Law 9 Guidance .md
Case Law 4
Google LLC v CNIL Meta Platforms v noyb ¶40 Meta Platforms v noyb ¶15 Google LLC, venant aux droits de Google Inc. v Commission nationale de l’informatique et des libertés (CNIL)
Guidance 9
Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority Guidelines 9/2022 on personal data breach notification under GDPR Opinion 04/2024 on the notion of main establishment of a controller in the Union under Art. 4.16(a) GDPR EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Guidelines 02/2022 on the application of Article 60 GDPR ¶8 Guidelines 02/2022 on the application of Article 60 GDPR ¶4 Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority +1 more
4(23)(a) 2 Guidance .md
Guidance 2
Guidelines 02/2022 on the application of Article 60 GDPR ¶8 Guidelines 02/2022 on the application of Article 60 GDPR
4(23)(b) 1 Enforcement 4 Guidance .md
Enforcement 1
ANSPDCP (Romania) - Fine against Ascendex Technology SRL
Guidance 4
Guidelines 02/2022 on the application of Article 60 GDPR Report of the work undertaken by the Cookie Banner Taskforce ¶8 Guidelines 02/2022 on the application of Article 60 GDPR ¶5 Report of the work undertaken by the Cookie Banner Taskforce
4(24) 16 Case Law 24 Guidance .md
Case Law 16
CJEU - T‑183/23 - Ballmann v European Data Protection Board Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – Judgment of the General Court (Tenth Chamber, Extended Composition) of 29 January 2025 (Extracts).#Data Protection Commission v European Data Protection Board.#Protection of personal data – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision instructing a lead supervisory authority to broaden the scope of its investigation and issue a new draft decision – Competence of the European Data Protection Board.#Joined Cases T-70/23, T-84/23 and T-111/23. ¶30 Judgment of the General Court (Tenth Chamber, Extended Composition) of 29 January 2025 (Extracts).#Data Protection Commission v European Data Protection Board.#Protection of personal data – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision instructing a lead supervisory authority to broaden the scope of its investigation and issue a new draft decision – Competence of the European Data Protection Board.#Joined Cases T-70/23, T-84/23 and T-111/23. ¶73 Judgment of the General Court (Tenth Chamber, Extended Composition) of 29 January 2025 (Extracts).#Data Protection Commission v European Data Protection Board.#Protection of personal data – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision instructing a lead supervisory authority to broaden the scope of its investigation and issue a new draft decision – Competence of the European Data Protection Board.#Joined Cases T-70/23, T-84/23 and T-111/23. ¶71 Judgment of the General Court (Tenth Chamber, Extended Composition) of 29 January 2025 (Extracts).#Data Protection Commission v European Data Protection Board.#Protection of personal data – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision instructing a lead supervisory authority to broaden the scope of its investigation and issue a new draft decision – Competence of the European Data Protection Board.#Joined Cases T-70/23, T-84/23 and T-111/23. ¶69 Judgment of the General Court (Tenth Chamber, Extended Composition) of 29 January 2025 (Extracts).#Data Protection Commission v European Data Protection Board.#Protection of personal data – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision instructing a lead supervisory authority to broaden the scope of its investigation and issue a new draft decision – Competence of the European Data Protection Board.#Joined Cases T-70/23, T-84/23 and T-111/23. ¶62 Judgment of the General Court (Tenth Chamber, Extended Composition) of 29 January 2025 (Extracts).#Data Protection Commission v European Data Protection Board.#Protection of personal data – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision instructing a lead supervisory authority to broaden the scope of its investigation and issue a new draft decision – Competence of the European Data Protection Board.#Joined Cases T-70/23, T-84/23 and T-111/23. +8 more
Guidance 24
EDPB Annual Report 2022 Guidelines 02/2022 on the application of Article 60 GDPR EDPB Annual Report 2021 Guidelines 03/2021 on the application of Article 65(1)(a) GDPR EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679 Statement 4/2024 on the recent legislative developments on the Draft Regulation laying down additional procedural rules for the enforcement of the GDPR ¶142 Guidelines 02/2022 on the application of Article 60 GDPR +16 more
4(25) 3 Guidance 2 Literature .md
Guidance 3
Guidelines 05/2020 on consent under Regulation 2016/679 ¶171 Guidelines 05/2020 on consent under Regulation 2016/679 ¶128 Guidelines 05/2020 on consent under Regulation 2016/679
Literature 2
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?
4(26) 1 Guidance .md
Guidance 1
Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation