GDPR Art. 10 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Processing of personal data relating to criminal convictions and offences

Security Special Categories of Data Criminal Data Types of Special Categories of Personal Data Personal Data Processing
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679

Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority.

Enforcement

Cited in 15 fines totalling €2.3M

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (8) · median fine €10,000 · see all enforcement for Art. 10 →

Related across sources

Enforcement Italian DPA: Enna Health Authority violated GDPR by publishing judicial data Enforcement AEPD investigates University of Navarra over student COVID-19 vaccination status requests Case Law Audiencia Nacional upholds €2M AEPD fine against Amazon Flex for criminal-record checks Case Law Supreme Court upholds €300,000 fine against INPS for GDPR violations in COVID bonus data Enforcement HDPA (Greece) examines deletion request from National Registry of Undesirable Aliens Guidance Opinion 34/2025 on the draft decision of the Greek Supervisory Authority regarding C.E.C.L certification criteria