GDPR Subject-Matter and Objectives

Legal Framework

The GDPR's subject-matter and objectives are established in Article 1, which sets out two interrelated goals: the protection of natural persons with regard to the processing of personal data and the free movement of such data within the Union. These twin objectives operate as a single regulatory bargain — data protection must not become a pretext for restricting cross-border data flows, and conversely, the internal market must not erode fundamental rights to privacy and data protection.

Article 44 reinforces this framework by establishing the general principle for international transfers: personal data may be transferred to third countries or international organisations only where the conditions in Chapter V are met, ensuring that the level of protection guaranteed by the Regulation is not undermined. Article 98 complements this by tasking the Commission with reviewing and, where appropriate, proposing amendments to other Union legal acts on data protection to achieve uniform and consistent protection across the EU institutional landscape.

The doctrinal commentary underscores that the Regulation's objectives are operationalised through the data protection principles in Article 5 — lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity. These principles are not aspirational; controllers must implement appropriate technical and organisational measures under Article 25 to ensure their effective application. The commentary also highlights that special categories of data under Article 9 now expressly include genetic and biometric data, reflecting the Regulation's evolving protective scope, while criminal data is separately governed under Article 10.

Key Developments

The CJEU's judgment in Digital Rights Ireland Ltd v. Ireland established that data retention obligations constituting interference with Article 7 CFR must satisfy strict necessity and proportionality requirements — a principle that directly shapes how the GDPR's objectives translate into Member State legislation. Blanket retention without targeted safeguards fails the proportionality test.

In Worten-Equipamentos para o Lar SA v. ACT, the CJEU confirmed that processing personal data for compliance with a legal obligation under what is now Article 6(1)(c) GDPR is lawful only where genuinely necessary, and access must be restricted to authorities with monitoring competence. This sets a practical threshold: necessity is not abstract but tied to the specific regulatory purpose pursued.

The EDPB has continued to develop guidance operationalising these objectives, including Guidelines 9/2020 on relevant and motivated objections, which clarify how data subjects can effectively exercise rights — a core objective of the Regulation. Recent EDPB attention to challenges in implementing the right to erasure signals ongoing enforcement focus on whether controllers are meeting the Regulation's protective aims in practice.

Practical Guidance

• Map all processing activities against the Article 5 principles and document how each is satisfied, treating this as the foundational compliance artefact rather than a tick-box exercise.
• Implement Article 25 data protection by design and by default at the system architecture level — build technical and organisational measures into processing systems before deployment, not as retrofit.
• For international transfers under Article 44, conduct transfer impact assessments that evaluate whether the third-country legal framework provides essentially equivalent protection, particularly post-Schrems II.
• Restrict access to special category data under Article 9 and criminal data under Article 10 to strictly necessary personnel, with documented justification for each access role.
• Establish a mechanism for monitoring regulatory developments under Article 98, as the Commission's ongoing review of Union legal acts may alter sector-specific obligations that interact with your processing operations.