# Personal Data — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/personal-data > Sources are cited per item. Verify against the official texts before relying on them. Information relating to identified or identifiable natural persons ## Overview ## Legal Framework The right to protection of personal data is constitutionally anchored in [Article 16](/laws/eu/art-16-38435) of the EU Charter, which empowers the EU legislature to lay down rules on the processing of personal data and its free movement. The operational core of this framework is the GDPR, whose [Article 4(1)](/laws/gdpr/art-4#par-1) defines the material scope of protection: This definition is deliberately broad, encompassing both directly identified individuals and those identifiable through identifiers such as names, location data, online identifiers, or factors specific to physical, economic, cultural, or social identity. Pseudonymised data remains personal data under [Article 4(5)](/laws/gdpr/art-4#par-5), since re-identification is possible with additional information. Once information qualifies as personal data, the processing principles in [Article 5(1)](/laws/gdpr/art-5#par-1) apply in full: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and security. Processing must additionally rest on at least one lawful basis under [Article 6(1)](/laws/gdpr/art-6#par-4-pnt-a), whether consent, contractual necessity, legal obligation, vital interests, public task, or legitimate interests. ## Key Developments Enforcement decisions have sharpened the practical boundaries of what constitutes lawful processing of personal data. The Swedish DPA's decision against a school in Skellefteå illustrates the threshold for valid consent in sensitive-data contexts: > "consent can not be applied since students and their guardians cannot freely decide if they/their children want to be monitored for attendance purposes" > — [Skellefteå school decision](/posts/46182#seg-1) The case involved facial recognition for attendance monitoring — biometric data triggering Article 9 — and the DPA found the measure disproportionate even though attendance monitoring itself can be lawful. The Baden-Wuerttemberg DPA similarly sanctioned a police officer who queried licence plate owner data without official cause, confirming that a valid legal basis for access does not authorise processing for unrelated personal purposes. The Danish DPA's enforcement against IDdesign addressed storage limitation under [Article 5(1)(e)](/laws/gdpr/art-5#par-1), where the company retained approximately 385,000 customers' data beyond the period necessary for the original purpose. The court reduced the fine based on the company's own turnover and mitigating factors, but confirmed the underlying violation. ## Status of the Debate The definition of personal data is settled in its core: any information relating to an identified or identifiable natural person falls within scope. What remains actively contested is the outer boundary — specifically, whether certain categories of data (dynamic IP addresses, hashed identifiers, device fingerprints) qualify as personal data in contexts where re-identification requires disproportionate effort. The CJEU's line of reasoning from *Breyer* through *Schrems II* suggests a context-dependent, risk-based approach, but courts diverge on how to weigh the means reasonably likely to be used for identification. No single post-GDPR ruling has definitively resolved this threshold question. A future CJEU reference on whether pseudonymised data in a specific technical configuration remains identifiable would provide needed clarity. ## Practical Guidance - **Classify data at the point of collection.** Determine whether each data element, alone or combined with others, can identify a natural person under [Article 4(1)](/laws/gdpr/art-4#par-1). When in doubt, treat it as personal data. - **Anchor every processing operation in a specific lawful basis** under [Article 6(1)](/laws/gdpr/art-6#par-4-pnt-a). Document the basis at the time of collection and reassess it when purposes change. - **Apply data minimisation rigorously.** The Skellefteå and AEPD CCTV cases confirm that even a valid purpose does not justify disproportionate data collection; choose the least intrusive means. - **Set and enforce retention deadlines.** The IDdesign decision demonstrates that failing to establish deletion timelines — and failing to execute them — constitutes a standalone violation of [Article 5(1)(e)](/laws/gdpr/art-5#par-1). - **Verify consent quality, not just existence.** Consent must be freely given, specific, and revocable. In contexts of power imbalance (schools, employment), consent will likely fail as a lawful basis, as the Skellefteå decision confirms. ## Legislation (full text of key provisions) ### Notification obligation regarding rectification or erasure of personal data or restriction of processing *Source: GDPR, gdpr-art-19-en, 2016-04-27 — https://overview.legal/posts/90457* The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. ### Principles relating to processing of personal data *Source: GDPR, gdpr-art-5-en, 2016-04-27 — https://overview.legal/posts/90243* ### Information to be provided where personal data have not been obtained from the data subject *Source: GDPR, gdpr-art-14-en, 2016-04-27 — https://overview.legal/posts/90374* ### Transparent information, communication and modalities for the exercise of the rights of the data subject *Source: GDPR, gdpr-art-12-en, 2016-04-27 — https://overview.legal/posts/90330* ### Information to be provided where personal data are collected from the data subject *Source: GDPR, gdpr-art-13-en, 2016-04-27 — https://overview.legal/posts/90352* ### Communication of a personal data breach to the data subject *Source: GDPR, gdpr-art-34-en, 2016-04-27 — https://overview.legal/posts/90649* ### Representation of data subjects *Source: GDPR, gdpr-art-80-en, 2016-04-27 — https://overview.legal/posts/91350* ### Right of access by the data subject *Source: GDPR, gdpr-art-15-en, 2016-04-27 — https://overview.legal/posts/90406* ### Processing of personal data relating to criminal convictions and offences *Source: GDPR, gdpr-art-10-en, 2016-04-27 — https://overview.legal/posts/90322* Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. ### Infringements entailing a personal data breach *Source: NIS2, nis2-art-35-en, 2022-12-14 — https://overview.legal/posts/96467* ## Case law ### CJEU Bara: national law cannot excuse controller's duty to inform data subjects of *Source: CJEU, 2015-10-01 — https://overview.legal/posts/5957 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0201* Right to be informed: National law that does not require the specific transfer involved in the case cannot constitute “prior information” under Article 10 of Directive 95/46 (information requirement where data is collected from the data subject), enabling the controller to dispense with his obligation to inform the data subject of the recipients of the data. (¶¶ 34–38). Article 11 (information requirement where data is not collected from data subject) requires that specified information be provi ### Tribunal of Bologna orders Comet s.p.a. to fulfil data subject's Art. 15 GDPR access *Source: Tribunal of Bologna, 2022-07-30 — https://overview.legal/posts/125653 — original: https://gdprhub.eu/index.php?title=Trib._of_Bologna_-_RG_12124/2020* Facts — A data subject made an access request to Comet s.p.a., the controller, to verify the lawfulness of the processing of her personal data for marketing purposes. In particular, she requested the information provided for in Article 15(1)(a) and (h) GDPR, and a copy of the personal data in possession of the controller. The controller did not respond to the request. Therefore, the data subject appealed to the Tribunal of Bologna, requesting an order for the fulfilment of her right under Article 15 GDPR. She stated that the controller must (have) processed her personal data, since she had a 'loyalty card' from the controller and documentation relating to the purchase of a smart TV (receipt and financing contract). Holding — The Court held that it was becoming increasingly crucial to protect people's rights when it comes to the processing of their personal data, especially from an economic standpoint. In doing so, it is necessary to remember that protecting people's fundamental rights cannot be sacrificed in favour of the interests of the market alone. The Court recalled that the GDPR, although known as the Privacy Regulation, actually has a far wider scope of application that extends beyond and individual's right to privacy, which is historically linked to their most private sphere. While the liberal concept of privacy requires essentially refraining from something for its protection, the current conception of privacy has an interactive and dynamic nature. It particularly concerns personal data and their circulation. The right to data protection is the cornerstone of the (positive) freedom to fully control the flow of an individual's own data. It is distinct from the (negative) freedom not to be interfered with in an individual's own private sphere. This is also, and above all, in the logic of market regulation covered by the GDPR. The Court added that it was sufficient to say that the Economist ' described personal data as the new 'most valuable resource', i.e. the new oil. The Court considered that the controller failed to act within the time limit, whereas the applicant had exercised her right correctly. Therefore, the Court held that, with reference to Article 12(1), (2), (3) and (4), and Article 15 GDPR, the data subject's right to access must be fulfilled by the controller. Consequently, the Court ordered the controller to provide the data subject with all the personal data, and documents relating to the data subject in possession. ### Judgment of the Court (Third Chamber), 22 November 2012.#Josef Probst v mr.nexnet GmbH.#Reference for a preliminary ruling from the Bundesgerichtshof.#Electronic communications — Directive 2002/58/EC — Article 6(2) and (5) — Processing of personal data — Traffic data necessary for billing and debt collection — Debt collection by a third company — Persons acting under the authority of the providers of public communications networks and electronic communications services.#Case C‑119/12. *Source: Court of Justice of the European Union, C-119/12, 2012-11-22 — https://overview.legal/posts/132376 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0119* In Case C-119/12, the Court of Justice of the European Union interpreted Article 6(2) and (5) of Directive 2002/58/EC (the ePrivacy Directive) in proceedings between Josef Probst and mr.nexnet GmbH, arising from a reference for a preliminary ruling by the German Federal Court of Justice (Bundesgerichtshof). The core issue was whether a telecommunications provider may transfer traffic data to a third-party debt collection company that has acquired the debt through assignment, and whether such a third party qualifies as a person "acting under the authority" of the provider under Article 6(5). The Court held that traffic data necessary for billing may be processed for debt collection purposes, including by an assignee third party, provided that the third party acts under the authority of the provider and the processing is limited to what is necessary for that purpose, with the data subject to the safeguards of Directive 95/46/EC. No fine was imposed. ### Judgment of the Court (Third Chamber), 7 November 2013.#Institut professionnel des agents immobiliers (IPI) v Geoffrey Englebert and Others.#Request for a preliminary ruling from the Cour constitutionnelle (Belgium).#Processing of personal data — Directive 95/46/EC — Articles 10 and 11 — Obligation to inform — Article 13(1)(d) and (g) — Exceptions — Scope of exceptions — Private detectives acting for the supervisory body of a regulated profession — Directive 2002/58/EC — Article 15(1).#Case C‑47 *Source: Court of Justice of the European Union, C-473/12, 2013-11-07 — https://overview.legal/posts/132373 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0473* The Court of Justice of the European Union (Third Chamber) issued a preliminary ruling in response to a request from the Belgian Cour constitutionnelle in proceedings between the Institut professionnel des agents immobiliers (IPI) and Geoffrey Englebert, Immo 9 SPRL, and Grégory Francotte. The case concerned the interpretation of Article 13(1)(d) and (g) of Directive 95/46/EC, specifically whether the obligation to inform data subjects under Articles 10 and 11 may be restricted when private detectives process personal data on behalf of a regulated profession's supervisory body to investigate breaches of professional ethics. The Court held that the exceptions in Article 13(1)(d) and (g) must be interpreted strictly and that data processing by private detectives acting for such a supervisory body falls within the scope of these exceptions only to the extent that it constitutes a necessary measure to safeguard the prevention, investigation, detection, and prosecution of breaches of ethics for regulated professions. ### Judgment of the Court (Eighth Chamber), 12 December 2013.#X.#Request for a preliminary ruling from the Gerechtshof te ’s-Hertogenbosch.#Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Conditions for exercising a right of access — Levying of excessive fees.#Case C‑486/12. *Source: Court of Justice of the European Union, C-486/12, 2013-12-12 — https://overview.legal/posts/132372 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0486* In Case C-486/12, the Court of Justice of the European Union interpreted Article 12(a) of Directive 95/46/EC in response to a preliminary ruling from the Gerechtshof te 's-Hertogenbosch concerning whether a Dutch municipality could levy a fee for providing a data subject with a certified transcript of personal data. The core issue was whether the directive's guarantee of access "without excessive delay or expense" permits controllers to charge fees, or whether the term "expense" should be read disjunctively from "delay," potentially allowing reasonable fees. The Court held that while Article 12(a) does not categorically prohibit fees for access to personal data, any fee charged must not be excessive, meaning it must not pose a deterrent to the exercise of the right of access, and that a fee is likely excessive if it exceeds the cost of reproducing and communicating the data. ### VG Düsseldorf: data subjects challenge district's sharing of personal data in water-law *Source: Administrative Court Düsseldorf, 2026-06-22 — https://overview.legal/posts/108992 — original: https://gdprhub.eu/index.php?title=VG_Düsseldorf_-_29_K_3490/24* Facts — A district (the controller), acting as the lower water authority, initiated administrative proceedings after identifying unauthorised riverbank works and a private jetty on two riverside properties. One property belonged to a water utility company, while the other belonged to a municipality and was leased to the data subjects. During those proceedings, the controller shared the data subjects' personal data with various participants, including the owners of the affected properties, other public authorities and a lawyer who claimed to represent the data subjects. The data subjects lodged a complaint with the competent supervisory authority (LDI NRW), alleging that the controller had unlawfully processed and disclosed their personal data. They argued that their personal data had been shared with uninvolved third parties, that the controller had communicated with a lawyer whom they had not authorised, recorded a telephone conversation with an unknown person, and transmitted personal data by unencrypted email. The controller's data protection officer addressed each allegation and provided additional factual information concerning the disputed processing operations. The DPA initially informed the data subjects that no GDPR infringement was apparent, invited them to provide any additional factual information, and explained that it would obtain extracts from the controller's administrative file if there were concrete indications that it contained relevant facts not already available. The data subjects did not identify any additional facts and instead reiterated their legal position that the controller had breached its GDPR accountability obligations. The DPA rejected the complaint, concluding that no GDPR infringement could be established. The data subjects then brought an action before the Verwaltungsgericht Düsseldorf (Administrative Court Düsseldorf), seeking a fresh decision on their complaint on the basis that the DPA had failed to adequately investigate the complaint because it had not obtained the controller's administrative file before reaching its decision. Holding — The court held that Articles 57(1)(f) and 77(1) GDPR give rise to an enforceable right requiring a supervisory authority to investigate a complaint to the extent appropriate in the circumstances before determining whether a GDPR infringement has occurred. Recital 141 GDPR requires the investigation to extend as far as is appropriate in light of the circumstances of the individual case, including the significance of the complaint and the seriousness of the alleged infringement. Applying these principles, the court held that the DPA had adequately investigated the complaint. It had considered each allegation together with the detailed response provided by the controller's data protection officer, invited the data subjects to provide any additional factual information, and explained that it would obtain extracts from the administrative file if concrete indications emerged that further relevant facts required clarification. As the data subjects did not provide any additional facts and there were no objective indications that the information already available was inaccurate or incomplete, the court held that the DPA was not required to obtain the controller's administrative file or undertake further investigations in the absence of concrete indications that additional factual clarification was necessary. The court further held that the DPA had correctly concluded that no GDPR infringement had occurred. The court held that the disputed processing was lawful under Article 6(1)(e) GDPR, read together with Article 6(3) GDPR and § 88 of the German Water Resources Act (WHG), which provided the legal basis for the processing. The court also held that the transmission of personal data by email did not infringe Article 5(1)(f) GDPR because, in the circumstances of the case, transport encryption provided an appropriate level of security. ### CJEU Google Spain: data subject may require search engine to remove links to outdated *Source: CJEU, 2014-05-13 — https://overview.legal/posts/6158 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0131&ref=6158* Legitimate interest balancing test: Legitimate interest requires balancing of the interest of the controller and third party with the interest of the data subject. In this particular case, having regard to the sensitivity for data subject’s private life of information contained in announcements and the fact that the initial publication occurred 16 years earlier, the data subject has established that the links should be removed. (¶¶ 70–75, 80-81, 98) ### Council of State: Tax Administration may process personal data from FIOD criminal *Source: Council of State, 2024-11-13 — https://overview.legal/posts/125586 — original: https://gdprhub.eu/index.php?title=RvS_-_202203653/1/A3* Facts — The data subject’s personal data was processed by the Tax Administration because it suspected him of not fulfilling his tax obligations. This suspicion was raised after the Fiscal Information and Investigation Service (FIOD) had carried out a criminal investigation into the data subject’s tax advisor. During the investigation, the FIOD drew on the assistance of three employees of the Tax Administration and data on the customer's of the tax advisor under investigation, including the personal data of the data subject, were analysed during the proceedings. The data subject requested the erasure of their data under Article 17 GDPR but the request was rejected by the controller, the Minister of Finance. In the Netherlands, the Tax Administration forms part of the Ministry of Finance. The data subject argued that the Tax Administration is processing his personal data for a purpose other than the purpose for which the FIOD initially collected the data. The data subject appealed the Minister's decision to the District Court of Central Netherlands (Rb. Midden-Nederlands) which held that the controller had complied with both the requirements of the GDPR as well as the Law Enforcement Directive. The data subject appealed this decision to the Administrative Jurisdiction Division of the Council of State (Afdeling Bestuursrechtspraak van de Raad van State – ABRvS). Holding — The court determined that since the data had been collected for the purpose of the detection of criminal offences, it had to consider whether the disclosure of data by the FIOD to the Tax Administration was permissible. It stated that under Article 9 Law Enforcement Directive 2016/680, further processing of personal data is permissible if authorised by EU law. The court held that the further processing of data fell under the remit of the GDPR as the Tax Administration fulfills a task which is in the public interest. The court reiterated the District Court’s position in that the provision of the personal data by the FIOD to the Tax Administration was necessary for the performance of a task of public interest as referred to in Article 6(1)(e) GDPR. The court highlighted that the task cannot be performed in a less invasive way and that the data subject did not establish what alternatives could have been drawn upon. Further, the court stated that the data had been limited to what was necessary and that the involved employees were bound to secrecy. Therefore, the court dismissed the appeal as being unfounded and held that the Minister correctly rejected the data subjects request for erasure of data. ### Judgment of the Court (Third Chamber), 30 May 2013.#Worten — Equipamentos para o Lar SA v Autoridade para as Condições de Trabalho (ACT).#Request for a preliminary ruling from the Tribunal do Trabalho de Viseu.#Processing of personal data — Directive 95/46/EC — Article 2 — Concept of ‘personal data’ — Articles 6 and 7 — Principles relating to data quality and criteria for making data processing legitimate — Article 17 — Security of processing — Working time — Record of working time — Access by t *Source: Court of Justice of the European Union, C-342/12, 2013-05-30 — https://overview.legal/posts/132375 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0342* The Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from a Portuguese labor court in proceedings between Worten—Equipamentos para o Lar SA and the Autoridade para as Condições de Trabalho (ACT) concerning whether employer working time records constitute personal data under Directive 95/46/EC and must be made available to labor authorities. The Court held that working time records containing information identifying individual workers constitute personal data within the meaning of Article 2 of Directive 95/46/EC, and that employers must maintain such records in a form allowing immediate consultation by competent national authorities responsible for monitoring working conditions, as this processing is necessary for compliance with legal obligations and the performance of tasks carried out in the public interest under Articles 7(c) and 7(e). ### CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is *Source: CJEU, 2010-06-29 — https://overview.legal/posts/6182 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62008CJ0028&ref=6182* Processing: Communication of personal data in response to a request for access to documents constitutes processing. (¶69) ### CJEU C-312/24 Darashev: Data subject's right to erasure of criminal investigation data *Source: Court of Justice of the European Union, C-312/24, 2025-09-04 — https://overview.legal/posts/158443 — original: https://gdprhub.eu/index.php?title=CJEU_-_Case_C_312/24_-_Darashev* Facts — The data subject is a police officer, holding various positions at the Internal Security directorate-general of the Bulgarian Ministry of the Interior (controller). In March 2016, investigative proceedings were commenced concerning an unknown offender in connection with an offence of theft. A few days later, the data subject was arrested and after being detained in police custody for 24 hours, he was released. Subsequently, he was neither placed under formal investigation nor charged, but he was the subject of several investigative measures, which in the course of 2016, were suspended without the offender having been identified. The controller stored the data about the criminal investigation on his personnel file, as provided by the ministerial instruction relating to personnel files, issued as a regulatory act pursuant to the statutory authorisation provided for in the Law on the Ministry of the Interior (ZMVR). The data subject continued his duties as a police officer and took part in selection procedures for promotion to other posts within the Ministry but he was rejected. The data subject brought an action before the Sofia District Court (Sofiyski rayonen sad) seeking compensation for non-material damage for the fact that he has not been promoted or transferred to other duties on account of his having been a suspect in the investigation. In addition, he asked that his name be erased from the database kept by the controller, in which he is mentioned as a suspect. In this context the court decided to stay the proceedings and to refer some questions to the CJEU for a preliminary ruling, regarding the interplay of the GDPR with the Law Enforcement Directive (LED), and more specifically regarding the storage of data concerning the official in his personnel file. The questions were combined and reformulated by the AG as follows: whether Article 2(1) GDPR and Article 9(1) LED are to be interpreted as meaning that the GDPR applies to the storing, by a public authority in the personnel file of one of its officials, of data regarding that official’s status as a suspect in a criminal investigation, where the data have been collected by an organisational unit within that public authority in the performance of its duties as a competent authority within the meaning of LED. whether Article 17(3) GDPR, read in conjunction with Article 6(1)(c) and Article 6(3) thereof, is to be interpreted as meaning that the storage, in a police officer’s personnel file, of personal data relating to a criminal investigation in which that officer was the subject of investigative measures, as a suspect, and which was discontinued, may be considered lawful for the purposes of compliance with a legal obligation to which the public authority that is his employer is subject under national law, as controller, merely on account of the nature of the duties which that officer is required to perform. Holding — Regarding the first question about the scope of the GDPR, the AG responded positively, that the GDPR does apply in this case, provided that the storage of that data pursues purposes other than those set out in Article 1(1) LED, purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Regarding the second question, the AG responded negatively, that the storage of the data subject’s data in this case was not lawful. First, he clarified that within the meaning of Article 6(3) GDPR, the storage of personal data could be based on a legal obligation being defined in a national law other that a law stricto sensu, though in accordance with national constitutional law. Therefore, in this case, the ministerial instruction was considered an appropriate legal basis. Nevertheless, the AG expressed doubts as to the foreseeability of the purposes of the processing, which, in accordance with Article 6(3) GDPR must be determined by the legal basis of the processing. As laid down in the ministerial instruction, the purpose of the storage was for reasons of ‘change of duties’. The AG considered that this, did not appear to meet an objective of public interest, for the purposes of Article 6(3) GDPR. Furthermore, he failed to see how the nature of the duties of maintaining public order, which fall to the data subject, could justify the storage of the data at issue in his personnel file. In conclusion, the AG opined that the storage of the data at issue was not lawful and that the data subject had the right to have them erased, pursuant to Article 17(1)(d) GDPR. ### CJEU: Dynamic IP addresses are personal data when identity can be determined *Source: Court of Justice of the European Union, 2016-10-19 — https://overview.legal/posts/125655 — original: https://gdprhub.eu/index.php?title=CJEU_-_C-582/14_-_Breyer* Facts — Mr. Breyer accessed several websites, which provided topical information, operated by German Federal Institutions which were accessible to the public. To prevent attacks, the sites stored information on all access operations in log files. Information stored include name of the web page, terms entered in the search fields, time of access, quantity of data transferred, an indication of whether the access was successful and the IP address of the computer that accessed the website. Mr. Breyer brought an action before the German Administrative Court seeking an order to restrain the Federal Republic of Germany from storing his access information of his visit to the website. This first action was dismissed. He appealed to the Court of Appeal. The court granted the injunction but only in part. The court ordered the Federal Republic of Germany to refrain from storing or arranging with third parties to store, at the end of each consultation period, information relating to Mr. Breyer's access including his IP address and any information that could result in revealing his identity. The court further stated that a dynamic IP address together with the date on which the website was accessed, where the user had revealed his identity during that consultation period, amounts to personal data since the user’s identity is tied to that particular dynamic IP address. On the other hand, the court observed stated that where Mr Breyer did not reveal his identity and only the internet service provider knew his identity the dynamic IP address doesn’t amount to personal data. Mr Breyer and the Federal Republic of Germany each brought an appeal on a point of law before the Federal Court of Justice, Germany (Bundesgerichtshof). Mr Breyer sought to have his application for an injunction upheld in its entirety while the Federal Republic of Germany sought to have it dismissed. The Federal court stayed the proceedings and referred the following issues to the CJEU. Dispute — The CJEU answered the following questions: a) Whether a dynamic IP address constitutes personal data as defined under Article 2(1)(a) Directive 95/46 where a third party has additional knowledge required to identify a data subject. b) Whether Article 7(1)(f) prevents a provision in national law that allows a service provider to collect and use personal data without the data subject’s consent for purposes of ensuring general operability of the tele-medium. Holding — On the first question, the court reiterated personal data under Article 2(1)(a) Directive 95/46 is defined as information relating to an identified or an identifiable natural person. Also, an identifiable person is one who can be identified directly or indirectly by reference to an identification number or to one or more factors that are specific to the person’s physical, physiological, mental, economic, cultural or social identity. The court also noted that it was held in Scarlet Extended (C‑70/10), IP addresses of internet users were protected as personal data because they allowed users to be identified even though this case was concerning collection and identification of IP addresses by internet service providers. In answering this question, the court observed that a dynamic IP address alone doesn’t amount to information of an identified person but for it to fall under the definition in Article 2(1)(a) Directive 95/46 there must be additional data that can lead to the identification of a natural person. The court referred to Recital 26 Directive 95/46 which states that to determine whether a person is identifiable, account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the said person. The referring court highlighted that German law doesn’t allow internet service providers to transmit data necessary for the identification of a data subject directly to online media services providers except in the event of cyber attacks when the online media services provider can contact a competent authority who can contact the internet service provider for such information that may help bring criminal proceedings. In light of this, the court held that an IP dynamic address is personal data where an online media services provider has legal means that enable them to identify natural persons. On the second question, the court first examined whether the processing activities if the General Federal Institute fall under the exception under Article 3(2) Directive 95/46 of processing activities of the state in criminal law. On this, the court referred to the decisions in Lindqvist, C‑101/01 and Satakunnan Markkinapörssi and Satamedia, C‑73/07 where it was stated that activities of the state or state authorities fall under the exception in Article 3(2) Directive 95/46. In the present case, the court observed that despite the status of the German Federal Institutions as public authorities, their activities fall outside the area of state criminal law activities. On to the main question of consent, the court referred to the wording under Article 7(1)(f) Directive 95/46 that provides that personal data may be processed based on a legitimate interest of a controller or a third party, without the consent of the data subject, except where such interests are overridden by the interests, fundamental rights and freedoms of the data subject. Besides, the court referred to the judgement in ASNEF and FECEMD, C‑468/10 and C‑469/10 at paragraphs 30 and 32 where the court held that Article 7 Directive 95/46 provides an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful. Also, member states cannot add new principles relating to the lawfulness of processing personal data or impose additional requirements that have the effect of amending the scope of one of the six principles provided for in that article. This position is clearly stipulated under Article 5 Directive 95/46 which provides the margin of discretion that member states have according to Article 7 Directive 95/46. In light of this, the court observed that Paragraph 15 of TMG, if interpreted strictly, has a more restrictive scope than that stipulated under Article 7 Directive 95/46. The court held that the provision under Paragraph 15 reduces the scope of the principle laid down under Article 7 Directive 95/46 by excluding the balance of the controller’s interest and the fundamental rights and freedoms of users which call for protection under Article 1(1) Directive 95/46. ## Guidance ### Guidelines 01/2022 on data subject rights - Right of access *Source: EDPB, edpb-guidelines-on-data-subject-rights---right-of-access, 2023-04-17 — https://overview.legal/posts/38055 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-012022-on-data-subject-rights-right-of-access_en* The right of access of data subjects is enshrined in Art. 8 of the EU Charter of Fundamental Rights. It has been a part of the European data protection legal framework since its beginning and is now further developed by more specified and precise rules in Art. 15 GDPR. ### Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects *Source: EDPB, guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in-en, 2019-10-16 — https://overview.legal/posts/126202 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in_en* 1 Adopted Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects Version 2.0 8 October 2019 2 Adopted Version history Version 2.0 8 October 2019 Adoption of the Guidelines after public consultation Version 1.0 9 April 2019 Adoption of the Guidelines for publication consultation 3 Adopted 1 Part 1 – Introduction ................................ ................................… ### Guidelines 9/2022 on personal data breach notification under GDPR *Source: EDPB, edpb-guidelines-on-personal-data-breach-notification-under-gdpr, 2023-04-04 — https://overview.legal/posts/38058 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en* The EDPB adopted Guidelines 9/2022 (Version 2.0, 28 March 2023) to update and replace the prior WP250 guidance on personal data breach notification under Articles 33 and 34 of the GDPR. The guidelines address the definition and types of personal data breaches, controller and processor notification obligations, the concept of a controller becoming "aware" of a breach, cross-border and non-EU establishment breach scenarios, and the conditions under which notification to supervisory authorities and data subjects is or is not required. ### Statement on restrictions on data subject rights in connection to the state of emergency in Member States *Source: EDPB, statement-on-restrictions-on-data-subject-rights-in-connection-to-the-state-of-en, 2020-06-02 — https://overview.legal/posts/126146 — original: https://www.edpb.europa.eu/documents/statement/statement-on-restrictions-on-data-subject-rights-in-connection-to-the-state-of_en* 1 Statement on restrictions on data subject rights in connection to the state of emergency 1 in Member States Adopted on 2 June 2020 The European Data Protection Board has adopted the following statement: 1. The EDPB has been informed of the adoption by the Hungarian government of the Decree 179/2020 of 4 May 2020 on the derogations from certain data protection and access to information provisions during the state of danger 2 . Under Article 1, this Decree provides that, with respect to… ### Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject *Source: EDPB, opinion-392021-on-whether-article-582g-gdpr-could-serve-as-a-en, 2021-12-14 — https://overview.legal/posts/125971 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-392021-on-whether-article-582g-gdpr-could-serve-as-a_en* Adopted 1 Opinion 39 /2021 on whether Article 58(2) ( g) GDPR coul d serve as a legal basis for a s upervisory a uthority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject Adopted on 14 December 2021 Adopted 2 Adopted 3 The European Data Protection Board Having regard to Article 63 and Article 64 (2) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural… ### Statement on the processing of personal data in the context of the COVID-19 outbreak *Source: EDPB, statement-on-the-processing-of-personal-data-in-the-context-of-the-covid-19-en, 2020-03-19 — https://overview.legal/posts/126176 — original: https://www.edpb.europa.eu/documents/statement/statement-on-the-processing-of-personal-data-in-the-context-of-the-covid-19_en* 1 Statement on the processing of personal data in the context of the COVID - 19 outbreak . Adopted on 19 March 2020 The European Data Protection Board has adopted the following statement: Governments, p ublic and private organisations throughout Europe are taking measures to contain and mitigate COVID - 19. This can involve the processing of different types of personal data. Data protection rules ( such as the GDPR ) do not hinder measures taken in the fight against the coronavirus pandemic.… ### Guidelines 01/2021 on Examples regarding Personal Data Breach Notification *Source: EDPB, edpb-guidelines-on-examples-regarding-personal-data-breach-notification, 2022-01-03 — https://overview.legal/posts/38047 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-012021-on-examples-regarding-personal-data-breach-notification_en* The European Data Protection Board (EDPB) adopted Guidelines 01/2021 on December 14, 2021, providing practical examples and analysis regarding personal data breach notification obligations under Articles 33 and 34 of the GDPR. The guidelines present hypothetical scenarios covering ransomware attacks and data exfiltration incidents, illustrating how controllers should assess risk to determine whether notification to supervisory authorities and communication to data subjects are required. The document serves as interpretive guidance for controllers evaluating breach severity, appropriate mitigation measures, and notification decisions, and does not impose any fines or sanctions. ### Statement on the processing of personal data in the context of reopening of borders following the COVID-19 outbreak *Source: EDPB, statement-on-the-processing-of-personal-data-in-the-context-of-reopening-of-en, 2020-06-16 — https://overview.legal/posts/126144 — original: https://www.edpb.europa.eu/documents/statement/statement-on-the-processing-of-personal-data-in-the-context-of-reopening-of_en* 1 Statement on the processing of personal data in the context of reopening of borders following the COVID - 19 outbreak Adopted on 16 June 2020 The European Data Protection Board has adopted the following statement: 1. In the Communication from the Commission on the third assessment of the application of the temporary restriction on non - essential travel to the EU from 11 June 2020, the Schengen Member States and Schengen Associated State s are invited to lift internal border controls by 15… ## Enforcement decisions ### APD/GBA (Belgium) - DOS-2026-00228 *Source: APD/GBA, 2026-10-12 — https://overview.legal/posts/595692 — original: https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_DOS-2026-00228* The DPA warned a company in a prima facie decision that accidentally sending emails relating to debt collection cases concerning a data subject to a third party in the cc field, and the failure to respond to the data subject’s request to exercise their rights, likely infringes Article 12(3) GDPR and Article 32 GDPR. English Summary. Facts. A company (controller) sent a data subject an email with a formal notice attached to it. The email was sent to the data subject’s work email address, with a t ### Tietosuojavaltuutetun toimisto (Finland) - TSV/12992/2025 *Source: Tietosuojavaltuutettu, 2026-10-12 — https://overview.legal/posts/595687 — original: https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_TSV/12992/2025* The DPA held that a social media platform had violated Article 12(4) GDPR by failing to inform the data subject of the reasons for not taking action on their request to object to direct marketing. English Summary. Facts. A user of a social media platform (the data subject) sent the platform (the controller) an email where they objected to the processing of their personal data for direct marketing purposes. The controller replied with instructions on how to delete data stored in the social media ### Persónuvernd (Island) - 2025051308 *Source: Persónuvernd, 2026-10-09 — https://overview.legal/posts/593304 — original: https://gdprhub.eu/index.php?title=Persónuvernd_(Island)_-_2025051308* The DPA issued a reprimand against a hospital employee for conducting unauthorised searches of a data subjects medical records, which constituted personal data processing, without an appropriate legal basis. English Summary. Facts. The DPA received a complaint from a data subject concerning the unauthorised searches by an employee of Landspitali Hospital (the controller) of her medical records. Particularly, because the employee was not involved in the data subject’s medical treatment. The contr ### UODO reprimands mayor for disclosing data subject's data to company without legal basis *Source: UODO (Poland), 2026-05-18 — https://overview.legal/posts/291434 — original: https://gdprhub.eu/index.php?title=UODO_(Poland)_-_DS.523.2582.2024* Facts — The data subject requested the mayor of their place of residence (the controller) to provide them scans of contracts the city had concluded with certain companies and invoices issued to these companies in February 2024. In April 2024, the controller responded that he did not possess the requested documents. This response contained the first and last name as well as the email address of the data subject and was forwarded to multiple recipients, including one of the companies the data subject’s request concerned. Following this, the data subject filed a complaint with the DPA. The controller argued it had processed the data subject’s personal data solely for responding to the request for access to public information. In addition, the controller was of the opinion that the processing had been necessary to fulfil a legal obligation. Since the request concerned multiple parties, the controller had determined there had been special grounds for disclosing the processed data. Holding — The DPA issued the controller a reprimand for the disclosure of personal data to unauthorised entities without a legal basis. It held that the processing had not been lawful under Article 6(1)(c) GDPR, as the controller could have complied with its obligation to respond to the request for information without disclosing the data subject’s personal data. Furthermore, the DPA held that the controller had violated the principles of lawfulness and confidentiality laid down in Articles 5(1)(a) and 5(1)(f) GDPR respectively. ### Legal Person: Insufficient fulfilment of data subjects rights *Source: Czech DPA (UOOU), 2022-11-09 — https://overview.legal/posts/48940 — original: https://www.enforcementtracker.com/ETid-2825* The Czech DPA has imposed a fine of EUR 400 on a legal person. The accused did not provide access to information about the purpose of the processing, the storage period, the sources of the personal data, the possible recipients to whom the personal data have been or will be transferred, the right to request the controller to rectify or erase the personal data or to restrict or object to the processing and the right to lodge a complaint with a supervisory authority. ### AEPD: Data subject entitled to identity of professionals who accessed medical records *Source: AEPD (Spain), 2026-09-15 — https://overview.legal/posts/353917 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_pd-00055-2026* Facts — Suspecting unauthorised access to his medical records, a public civil servant, the data subject, requested the Ministry of Defence, the controller, to provide a log copy of accesses to his medical history, including the date, time, identity of the professional and purpose of each access. The controller rejected the request, relying on Article 15(4) GDPR and Article 18(3) Law 41/2002. It argued that identifying the professionals who had accessed the medical history would involve disclosing personal data of third parties. Instead, it provided general information concerning the processing of the data subject's personal data. The data subject subsequently reiterated his request and the controller again refused to disclose the identities of the persons who had accessed the records. During the proceedings, the controller carried out an audit of the accesses recorded since 2023. It concluded that the accesses identified had been made for justified purposes by administrative or healthcare personnel and that no unauthorised access had occurred. Regarding older information from 2016 to 2023, the controller stated that retrieving the relevant records from historical databases would require extraordinary technical and financial resources. The data subject argued that access information, including the identity of professionals, had previously been provided to him and maintained that organisational or technical difficulties could not justify limiting his rights. Holding — The DPA upheld the complaint and found an infringement of Article 15 GDPR. The DPA first recalled that Article 15 GDPR allows data subjects to obtain access to personal data concerning them and must be interpreted together with the transparency principle under Article 5(1)(a) GDPR and the accountability obligations under Articles 5(2) and 24 GDPR. It also considered that appropriate technical and organisational measures under Article 25 GDPR should enable the traceability and control of access to personal data. Regarding the identity of employees who accessed the data, the DPA referred to CJEU Case C-579/21. It acknowledged that Article 15 GDPR does not generally require controllers to disclose the identity of individual employees who accessed personal data and that providing categories of employees may normally be sufficient. However, their identity may have to be disclosed where this is necessary for the effective exercise of the data subject's rights, subject to the rights and freedoms of those employees. The DPA considered that a stricter transparency standard applies in the healthcare context because health data constitute special categories of personal data. It referred in that regard to the approach introduced by the not yet applicable Regulation (EU) 2025/327 on the European Health Data Space. Accordingly, the DPA held that, as a general rule, the right of access to information concerning access to health data includes the identity of the persons who accessed those data where this is necessary to ensure transparency and enable the data subject to effectively control the lawfulness of the processing. However, this right is not absolute. The controller may restrict disclosure where proportionate and under specific circumstances. The DPA therefore rejected the controller's blanket reliance on Article 15(4) GDPR and Article 18(3) Law 41/2002. It found that automatically excluding disclosure of the identity of all persons who accessed the medical records was incompatible with the enhanced transparency required in the healthcare context. The controller had neither provided the requested information nor demonstrated specific circumstances justifying its refusal. The DPA also found that the controller failed to fully comply with the access request in accordance with Articles 12 and 15 GDPR. Consequently, it ordered the controller, within ten working days, either to provide the requested access information or to issue a properly reasoned refusal explaining why disclosure was not justified. No administrative fine was imposed. ### Legal Person: Insufficient fulfilment of data subjects rights *Source: Czech DPA (UOOU), 2021-06-09 — https://overview.legal/posts/48917 — original: https://www.enforcementtracker.com/ETid-2802* The Czech DPA has imposed a fine of EUr 2,000 on a legal person. The accused did not respond to the subject's request to disclose what information the accused was processing about them and how the accused obtained their data box address, which is tied to an individual. Nor did it respond to a notice from the Office for personal data protection. ### Legal Person: Insufficient fulfilment of data subjects rights *Source: Czech DPA (UOOU), 2020-12-18 — https://overview.legal/posts/48925 — original: https://www.enforcementtracker.com/ETid-2810* The Czech DPA has imposed a fine of EUR 200 on a legal person. The accused sent the data subject, despite his objection and therefore his disagreement with further processing of personal data, a request for a financial contribution (marketing communication). ## Recent developments ### Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements *Source: European Data Protection Board, 2026-10-12 — https://overview.legal/posts/595686 — original: https://www.edpb.europa.eu/news/italian-dpa-fines-wind-tre-eur-16-700-000-for-unlawful-telemarketing-and-data-protection_en* Background informationDate of final decision: 05/06/2026National caseController: Wind Tre S.p.A.Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller), Article 25 (Data protection by desig ### Privacy win: Norwegian Authority fines Microsoft’s Xandr € 8.5 Million *Source: noyb - European Center for Digital Rights, 2026-10-12 — https://overview.legal/posts/593465 — original: https://noyb.eu/en/privacy-win-norwegian-authority-fines-microsofts-xandr-eu-85-million* Online & Mobile tracking In 2020, noyb (in cooperation with the Norwegian Consumer Council) has filed a complaint against the online advertising company Xandr (now part of Microsoft) for processing personal data from the dating app Grindr. Now, the Norwegian Data Protection Authority has issued its decision – and fined Xandr € 8.5 million (NOK 92 000 000) for its GDPR violations. This decision is a major blow to the online adtech industry. Press Release of the Norwegian Data Protection Authority ### AZOP (Croatia) - Croatian Gambling Operator *Source: GDPRhub, 2026-10-11 — https://overview.legal/posts/595693 — original: https://gdprhub.eu/index.php?title=AZOP_(Croatia)_-_Croatian_Gambling_Operator* The DPA fined a gambling operator €2.59 m for processing biometric data without valid consent and beyond the necessary scope, bundling multiple purposes into single consent, and providing incomplete and inconsistent processing information. English Summary. Facts. The DPA initiated an ex officio investigation against a gambling operator (controller) regarding the identification and registration of players (data subjects) visiting its casino. The controller verified data subjects' identities ### Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data *Source: European Data Protection Board, 2026-10-09 — https://overview.legal/posts/593298 — original: https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en* Background informationDate of final decision: 23 September 2026National caseController: IQVIA Solutions Italy S.r.lLegal Reference(s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 25 (Data protection by design and by default), Article 28 (Processor) and Article 35 (Data protection impact assessment)Decision: Adm ### ANSPDCP (Romania) - Fine against GLOBAL CUSTOMER CARE SERVICES S.R.L *Source: GDPRhub, 2026-10-09 — https://overview.legal/posts/593306 — original: https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_GLOBAL_CUSTOMER_CARE_SERVICES_S.R.L* The DPA fined a controller RON 26,294 (€5,000) for failing to implement adequate security measures, which led to a breach affecting the confidentiality and availability of personal data following a cyberattack. English Summary. Facts. A personal data breach occurred because of a cyberattack on of a call centre service provider (the controller). Thus, the confidentiality and availability of personal data were compromised and unauthorised parties gained access to the personal data of a significant ## Literature ### The data subject’s right to access to information under GDPR and the right of the data controller to protect its know-how *Source: Przegląd Prawniczy Uniwersytetu im. Adam Mickiewicza, 2023-12-30 — https://overview.legal/posts/132546 — original: https://doi.org/10.14746/ppuam.2023.15.09* The data subject’s right to access information on data processing has a very broad meaning. Considering the latest developments in this field (mainly the CJEU ruling on Austrian posts and EDPB guidelines) one can draw the conclusion that the controller’s right to protect its confidential in-formation is limited and less valuable than the data subject’s rights. However, this may lead to unfair and unequal treatment of companies and data subjects. When looking at this right in a more systematic pe ### Grounds for Lawful Processing of Personal Data in GDPR and Personal Data Protection Bill 2018, India (PDPB): Section – III: Legal Obligation. *Source: SSRN Electronic Journal, 2019-01-01 — https://overview.legal/posts/132468 — original: https://doi.org/10.2139/ssrn.3720422* ### Grounds for Lawful Processing of Personal Data in GDPR and Personal Data Protection Bill 2018, India (PDPB): Section – V: Public Interests amp; Exercise of Official Authority. *Source: SSRN Electronic Journal, 2019-01-01 — https://overview.legal/posts/132516 — original: https://doi.org/10.2139/ssrn.3743566* ### HOW GDPR TREATS AUTOMATED DECISION-MAKING *Source: Journal Scientific and Applied Research, 2025-11-14 — https://overview.legal/posts/132599 — original: https://doi.org/10.46687/jsar.v28i1.435* This article examines how the General Data Protection Regulation (GDPR) regulates automated decision-making, including profiling, in the context of personal data processing. It analyzes the main provisions of Article 22 of the Regulation, as well as the conditions under which fully automated decisions that produce legal effects or significantly affect data subjects are permitted. The article highlights the rights of data subjects – the right to human intervention, the right to express their poin ### Grounds for Lawful Processing of Personal Data in GDPR and Personal Data Protection Bill 2018, India (PDPB): Section – IV: Vital Interests. *Source: SSRN Electronic Journal, 2019-01-01 — https://overview.legal/posts/132471 — original: https://doi.org/10.2139/ssrn.3743565* ## Tools ### CNIL GDPR guide for developers *Source: CNIL, 2026-07-04 — https://overview.legal/posts/53810 — original: https://github.com/LINCnil/GDPR-Developer-Guide* Open-source best-practice guide by the French DPA translating GDPR obligations into concrete development practice: data minimisation in code, managing consent, securing data flows, retention, and preparing for data subject rights — organised in 16 practical sheets. ### Meldloket datalekken Autoriteit Persoonsgegevens *Source: Autoriteit Persoonsgegevens, 2026-07-04 — https://overview.legal/posts/53807 — original: https://datalekken.autoriteitpersoonsgegevens.nl/* Het officiële loket van de Autoriteit Persoonsgegevens voor het melden van datalekken op grond van artikel 33 AVG. Verwerkingsverantwoordelijken melden hier binnen 72 uur een inbreuk in verband met persoonsgegevens, en kunnen meldingen aanvullen of intrekken. ### GDPR.eu compliance checklist *Source: GDPR.eu (Proton), 2026-07-17 — https://overview.legal/posts/125625 — original: https://gdpr.eu/checklist/* Widely used plain-language GDPR compliance checklist covering lawful basis, data inventory, accountability documents, data subject rights, security and transfer requirements. Published by Proton as part of the GDPR.eu resource site (an unofficial but well-maintained companion to the Regulation). ### Standard Contractual Clauses (SCCs) for international transfers *Source: European Commission, 2026-07-04 — https://overview.legal/posts/53805 — original: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en* The European Commission's modernised standard contractual clauses (2021) for transfers of personal data to third countries under Article 46(2)(c) GDPR, plus the controller-processor SCCs under Article 28(7). Includes the official Word/PDF templates for all four transfer modules. ### AVG-regelhulp voor bedrijven *Source: RVO, 2026-07-04 — https://overview.legal/posts/53808 — original: https://regelhulpenvoorbedrijven.nl/avg/* Interactieve regelhulp van de Rijksdienst voor Ondernemend Nederland, ontwikkeld met de Autoriteit Persoonsgegevens: in circa tien vragen een beeld van wat de AVG concreet voor een organisatie betekent, met een persoonlijk actieplan als resultaat. ## Related topics - **Processing** — https://overview.legal/topics/processing Any operation performed on personal data - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities National data protection authorities and their powers - **Supervision** — https://overview.legal/topics/supervision Oversight and enforcement by supervisory authorities - **Consent** — https://overview.legal/topics/consent Freely given, specific, informed indication of data subject wishes - **Public Authority** — https://overview.legal/topics/public-authority Government bodies and their data processing activities --- Generated by overview.legal · https://overview.legal/topics/personal-data · 2026-10-13