Topic

Recipient

LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this topic. Contains: the overview, key law text, case law, enforcement and guidance for this topic. Everything links back to its source on overview.legal — legal information, not advice.

A person or body to which personal data are disclosed (Art 4(9) GDPR).

202 linked items 25 Laws65 Case Law50 Guidance44 Enforcement6 News
Newest Relevant
Everything on this topic, by type links go to the exact provision / paragraph / section
Laws 25
Art. 4(9) ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party… GDPR Art. 14(1)(f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existe… GDPR Art. 14(3)(c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed. GDPR Art. 15(1)(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or int… GDPR art 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing GDPR Apr 2016 art 2 Definitions ePrivacy Jul 2002 rec 5 Recital 5 DSA Oct 2022 rec 34 Recital 34 DSA Oct 2022 rec 39 Recital 39 DSA Oct 2022 rec 43 Recital 43 DSA Oct 2022 rec 54 Recital 54 DSA Oct 2022 rec 55 Recital 55 DSA Oct 2022 rec 56 Recital 56 DSA Oct 2022 rec 58 Recital 58 DSA Oct 2022 rec 67 Recital 67 DSA Oct 2022 rec 68 Recital 68 DSA Oct 2022 rec 70 Recital 70 DSA Oct 2022 rec 71 Recital 71 DSA Oct 2022 rec 77 Recital 77 DSA Oct 2022 rec 80 Recital 80 DSA Oct 2022 rec 121 Recital 121 DSA Oct 2022 rec 23 Recital 23 DSA Oct 2022 rec 20 Recital 20 DSA Oct 2022 rec 18 Recital 18 DSA Oct 2022 Show 5 more →
Case Law 65
¶10 Artikel 4 van die verordening bepaalt: „In deze verordening wordt verstaan onder: […] 2) ‚verwerking’: een bewerking of een geheel van bewerkingen met… HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) ¶14 Artikel 46 van deze verordening, met als opschrift „Doorgiften op basis van passende waarborgen”, bepaalt in de leden 1 tot en met 3: „1. Bij ontstent… HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) ¶19 Artikel 58, leden 2 en 4, van diezelfde verordening bepaalt: „2. Elk toezichthoudende autoriteit heeft alle volgende bevoegdheden tot het nemen van co… HvJ EU: Privacy Shield ongeldig verklaard (Schrems II) ¶11 (information requirement where data is not collected from data subject) requires that specified information be provided to the data subject, including… SMARANDA BARA ET AL. V. PRESEDINTELE CASEI NATIONALE DE ASIGURARI DE SANATATE (CNAS) ET AL., 1.10.2015 (“BARA”) 793/19 Judgment of the Court (Grand Chamber) of 20 September 2022.#Bundesrepublik Deutschland v SpaceNet AG and Telekom Deutschland GmbH.#Requests for a preliminary ruling from the Bundesverwaltungsgericht.#Reference for a preliminary ruling – Processing of personal data in the electronic communications sector – Confidentiality of communications – Providers of electronic communications services – General and indiscriminate retention of traffic and location data – Directive 2002/58/EC – Article 15(1) – Court of Justice of the European Union Oct 2022 154/21 Judgment of the Court (First Chamber) of 12 January 2023.#RW v Österreichische Post AG.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 15(1)(c) – Data subject’s right of access to his or her data – Information about the recipients or categories of recipient to whom the personal data have been or will be disclosed – Restrictions.#C Court of Justice of the European Union Jan 2023 492/23 Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – Court of Justice of the European Union Dec 2025 557/20 Judgment of the General Court (Eighth Chamber, Extended Composition) of 26 April 2023.#Single Resolution Board v European Data Protection Supervisor.#Protection of personal data – Procedure for granting compensation to shareholders and creditors following the resolution of a bank – Decision of the EDPS in which it found that the SRB failed to fulfil its obligations concerning the processing of personal data – Article 15(1)(d) of Regulation (EU) 2018/1725 – Concept of personal data – Article 3(1) General Court Apr 2023 245/19 Judgment of the Court (Grand Chamber) of 6 October 2020.#État luxembourgeois v B and Others.#Requests for a preliminary ruling from the Cour administrative (Luxembourg).#References for a preliminary ruling – Directive 2011/16/EU – Administrative cooperation in the field of taxation – Articles 1 and 5 – Decision ordering that information be provided to the competent authority of a Member State, acting in response to a request for exchange of information from the competent authority of another Mem Court of Justice of the European Union Oct 2020 597/19 Judgment of the Court (Fifth Chamber) of 17 June 2021.#Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA.#Request for a preliminary ruling from the Ondernemingsrechtbank Antwerpen.#Reference for a preliminary ruling – Intellectual property – Copyright and related rights – Directive 2001/29/EC – Article 3(1) and (2) – Concept of ‘making available to the public’ – Downloading of a file containing a protected work via a peer-to-peer network and the simultaneous Court of Justice of the European Union Jun 2021 203/22 Judgment of the Court (First Chamber) of 27 February 2025.#CK v Magistrat der Stadt Wien.#Request for a preliminary ruling from the Verwaltungsgericht Wien.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 15(1)(h) – Automated decision-making, including profiling – Scoring – Assessment of the creditworthiness of a natural person – Access to meaningful information about the logic involved in profiling – Verification of the accuracy of the infor Court of Justice of the European Union Feb 2025 73/16 Judgment of the Court (Second Chamber) of 27 September 2017.#Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy.#Request for a preliminary ruling from the Najvyšší súd Slovenskej republiky.#Reference for a preliminary ruling — Charter of Fundamental Rights of the European Union — Articles 7, 8 and 47 — Directive 95/46/EC — Articles 1, 7 and 13 — Processing of personal data — Article 4(3) TEU — Drawing up of a list of personal data — Subject matter — Ta Court of Justice of the European Union Sep 2017 473/12 Judgment of the Court (Third Chamber), 7 November 2013.#Institut professionnel des agents immobiliers (IPI) v Geoffrey Englebert and Others.#Request for a preliminary ruling from the Cour constitutionnelle (Belgium).#Processing of personal data — Directive 95/46/EC — Articles 10 and 11 — Obligation to inform — Article 13(1)(d) and (g) — Exceptions — Scope of exceptions — Private detectives acting for the supervisory body of a regulated profession — Directive 2002/58/EC — Article 15(1).#Case C‑47 Court of Justice of the European Union Nov 2013 740/22 Judgment of the Court (Sixth Chamber) of 7 March 2024.#Endemol Shine Finland Oy.#Request for a preliminary ruling from the Itä-Suomen hovioikeus.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 2, 4, 6, 10 and 86 – Data held by a court relating to the criminal convictions of a natural person – Oral disclosure of such data to a commercial company on account of a competition organised by that company – Concept of ‘processing of personal data’ Court of Justice of the European Union Mar 2024 348/23 Judgment of the General Court (Seventh Chamber, Extended Composition) of 3 September 2025.#Zalando SE v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation of a very large online platform – Plea of illegality – Article 33(1) and (4) of Regulation 2022/2065 – Legal certainty – Equal treatment – Proportionality – Obligation to state reasons.#Case T-348/23. General Court Sep 2025 367/23 Judgment of the General Court (Seventh Chamber, Extended Composition) of 19 November 2025.#Amazon EU Sàrl, venant aux droits de Amazon Services Europe Sàrl v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation as a very large online platform – Plea of illegality – Admissibility – Article 33(1) and (4) of Regulation 2022/2065 – Right to respect for private and family life – Freedom to conduct a business – Right to property – Equal treatment – Freedom of expression – Da General Court Nov 2025 413/23 Judgment of the Court (First Chamber) of 4 September 2025.#European Data Protection Supervisor v Single Resolution Board.#Appeal – Protection of natural persons with regard to the processing of personal data – Procedure for granting compensation to shareholders and creditors of a banking institution following the resolution of that institution – Decision of the European Data Protection Supervisor finding that the Single Resolution Board failed to fulfil its obligations relating to the processing Court of Justice of the European Union Sep 2025 200/23 Judgment of the Court (First Chamber) of 4 October 2024.#Agentsia po vpisvaniyata v OL.#Request for a preliminary ruling from the Varhoven administrativen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Publication in the commercial register of a company’s constitutive instrument containing personal data – Directive (EU) 2017/1132 – Non-compulsory personal data – Lack of consent of the data subjec Court of Justice of the European Union Oct 2024 203/15 Judgment of the Court (Grand Chamber) of 21 December 2016.#Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others.#Requests for a preliminary ruling from the Kammarrätten i Stockholm and the Court of Appeal (England & Wales) (Civil Division).#Reference for a preliminary ruling — Electronic communications — Processing of personal data — Confidentiality of electronic communications — Protection — Directive 2002/58/EC — Articles 5, 6 and 9 Court of Justice of the European Union Dec 2016 354/22 Judgment of the General Court (Sixth Chamber, Extended Composition) of 8 January 2025.#Thomas Bindl v European Commission.#Processing of personal data – Protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies – Regulation (EU) 2018/1725 – Concept of ‘transfer of personal data to a third country’ – Transfer of data when visiting a website – EU Login – Action for annulment – Act not open to challenge – Inadmissibility – A General Court Jan 2025 129/21 Judgment of the Court (Fourth Chamber) of 27 October 2022.#Proximus NV v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Processing of personal data and protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 12 – Public telephone directories and directory enquiry services – Subscriber’s consent – Obligations of the provider of directories and of directory enquiry serv Court of Justice of the European Union Oct 2022 653/16 Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment General Court May 2018 CJEU VOLKER UND MARKUS SCHECKE GBR V. LAND HESSEN, EIFERT V. LAND HESSEN AND BUNDESANSTALT FUR LANDWIRTSCHAFT UND ERNAHRUNG, 9.Nov.2010 (“SCHECKE”) CJEU Nov 2010 654/23 Judgment of the Court (First Chamber) of 13 November 2025.#Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).#Request for a preliminary ruling from the Curtea de Apel Bucureşti.#Reference for a preliminary ruling – Processing of personal data and the protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 13(1) and (2) – Unsolicited communications – Concept of communication ‘for the purposes of di Court of Justice of the European Union Nov 2025 Show 45 more →
Guidance 50
012023 on article 37 law enforcement directive Guidelines 01/2023 on Article 37 Law Enforcement Directive EDPB Jun 2024 052021 on the interplay between the application of article 3 and the Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR EDPB Feb 2023 012020 on processing personal data in the context of connected Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications EDPB Mar 2021 22020 on articles 46 2 a and 46 3 b of regulation 2016679 for Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies EDPB Dec 2020 22019 on the processing of personal data under article 61b gdpr in Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects EDPB Oct 2019 29 working party guidelines on transparency under regulation 2016679 Article 29 Working Party - Guidelines on transparency under Regulation 2016/679 EDPB Apr 2018 12022 on the application for approval and on the elements Recommendations 1/2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR) EDPB Jun 2023 012020 on measures that supplement transfer tools to Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data EDPB Jun 2021 012021 on the adequacy referential under the law Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive EDPB Feb 2021 222024 on certain obligations following from the Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) EDPB Oct 2024 082024 on valid consent in the context of consent or Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms EDPB Apr 2024 372023 on the draft decision of the competent Opinion 37/2023 on the draft decision of the competent supervisory authority of Luxemburg regarding the approval of the requirements for accreditation of a certification body pursuant to Art. 43.3 EDPB Dec 2023 152023 on the draft decision of the dutch supervisory Opinion 15/2023 on the draft decision of the Dutch Supervisory Authority regarding the Brand Compliance certification criteria EDPB Sep 2023 edps joint opinion 012023 on the proposal for a regulation of EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB Sep 2023 252022 regarding the european privacy seal europrise Opinion 25/2022 regarding the European Privacy Seal (EuroPriSe ) certification criteria for the certification of processing operations by processors EDPB Sep 2022 edps joint opinion 042022 on the proposal for a regulation of EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse EDPB Jul 2022 edps joint opinion 032022 on the proposal for a regulation on EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space EDPB Jul 2022 edps joint opinion 22022 on the proposal of the european EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB May 2022 162020 on the draft decision of the competent Opinion 16/2020 on the draft decision of the competent supervisory authority of the Czech Republic regarding the approval of the requirements for accreditation of a certification body pursuant to Article 43.3 (GDPR) EDPB May 2020 us data privacy framework faq for european individuals EU-US Data Privacy Framework FAQ for European individuals EDPB Jul 2024 Show 30 more →
Enforcement 44
CNIL (France) CNIL (France) - SAN-2020-013 CNIL (France) Dec 2020 ICO (UK) ICO (UK) - KRA Consultancy Ltd ICO (UK) May 2026 AKI (Estonia) AKI (Estonia) - No. 2.1-1/24/397-890-38 AKI (Estonia) Apr 2026 AEPD (Spain) AEPD (Spain) - EXP202310345 AEPD (Spain) Jul 2026 IP (Slovenia) IP (Slovenia) - 0609-36/2026/7 IP (Slovenia) Jul 2026 VDAI (Lithuania) VDAI (Lithuania) - 3R-1143 VDAI (Lithuania) Jun 2026 UODO (Poland) UODO (Poland) - DKE.561.4.2026 UODO (Poland) May 2026 Data Protection Authority of Ireland Permanent TSB: Insufficient technical and organisational measures to ensure information security Data Protection Authority of Ireland May 2026 IP (Slovenia) IP (Slovenia) - 0609-42/2026/7 IP (Slovenia) May 2026 Spanish Data Protection Authority (aepd) DHL PARCEL IBERIA, S.L.: Overtreding van de algemene principes voor gegevensverwerking. Spanish Data Protection Authority (aepd) Sep 2025 NL Spanish Data Protection Authority (aepd) DHL PARCEL IBERIA, S.L.: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) Sep 2025 AEPD (Spain) AEPD (Spain) - EXP202306354 (PS/00312/2024) AEPD (Spain) Feb 2026 Spanish Data Protection Authority (aepd) IBERCAJA BANCO, S.A.: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) Jun 2025 Spanish Data Protection Authority (aepd) IBERCAJA BANCO, S.A.: Overtreding van de algemene principes voor gegevensverwerking. Spanish Data Protection Authority (aepd) Jun 2025 NL Polish National Personal Data Protection Office (UODO) mBank: Insufficient fulfilment of data breach notification obligations Polish National Personal Data Protection Office (UODO) Aug 2024 Italian Data Protection Authority (Garante) Azienda socio-sanitaria locale n. 1 di Sassari: Insufficient technical and organisational measures to ensure information security Italian Data Protection Authority (Garante) Feb 2024 Data Protection Authority of Sweden Trygg-Hansa: Non-compliance with general data processing principles Data Protection Authority of Sweden Aug 2023 Data Protection Authority of Hessen Company: Non-compliance with general data processing principles Data Protection Authority of Hessen Jan 2024 Spanish Data Protection Authority (aepd) THE BEE LOGISTICS, S.L.: Non-compliance with general data processing principles Spanish Data Protection Authority (aepd) Nov 2023 Italian Data Protection Authority (Garante) Mednow Medical Center di Giugni Marco: Non-compliance with general data processing principles Italian Data Protection Authority (Garante) Aug 2023 Show 24 more →
News 6
noyb - European Center for Digital Rights noyb takes Swedish tax authority to court for selling people’s personal data noyb - European Center for Digital Rights Apr 2025 noyb - European Center for Digital Rights Update on noyb’s 101 complaints on EU-US data transfers – only one country shines noyb - European Center for Digital Rights Sep 2020 noyb - European Center for Digital Rights Complaint: Amazon doesn’t allow baseline TLS security noyb - European Center for Digital Rights Mar 2020 European Digital Rights Unprecedented appearance by European Commissioner for Home Affairs, innovating on quicksand, and the cabinet vs. online confidentiality European Digital Rights Mar 2023 AEPD De Autoriteit Persoonsgegevens publiceert een rapport over de risicoanalyse van de AVG (Algemene Verordening Gegevensbescherming). AEPD Oct 2022 NL Future of Privacy Forum What Happened to the Risk-Based Approach to Data Transfers? Future of Privacy Forum Sep 2022
Literature 11
Awang Long Law Review PROTECTION OF DATA SUBJECT RIGHTS IN THE TRANSFER OF PERSONAL DATA BETWEEN DATA CONTROLLERS IN INDONESIA: A COMPARATIVE ANALYSIS OF THE PDP LAW AND THE EU GDPR Awang Long Law Review Jan 2026 Athens Journal of Law Artificial Intelligence in Decision-making: A Test of Consistency between the “EU AI Act” and the “General Data Protection Regulation” Athens Journal of Law Jan 2025 Requirements Engineering Understanding the GDPR from a requirements engineering perspective—a systematic mapping study on regulatory data protection requirements Requirements Engineering Jul 2024 Przegląd Prawniczy Uniwersytetu im. Adam Mickiewicza The data subject’s right to access to information under GDPR and the right of the data controller to protect its know-how Przegląd Prawniczy Uniwersytetu im. Adam Mickiewicza Dec 2023 Legal Issues in the Digital Age Data Protection Regulation and International Arbitration: Can There Be Harmonious Coexistence (with the GDPR Requirements Concerning Cross-Border Data Transfer)? Legal Issues in the Digital Age Jul 2021 International Data Privacy Law The transfer of personal data to third countries under the GDPR: when does a recipient country provide an adequate level of protection? International Data Privacy Law Jul 2018 Comparative Law Review General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens? Comparative Law Review Feb 2018 European Data Protection Law Review Tracking Walls, Take-It-Or-Leave-It Choices, the GDPR, and the ePrivacy Regulation European Data Protection Law Review Jan 2017 Zbornik radova. Aktualnosti građanskog i trgovačkog zakonodavstva i pravne prakse POJAM OSOBNOG PODATKA U TUMAČENJU SUDA EUROPSKE UNIJE Zbornik radova. Aktualnosti građanskog i trgovačkog zakonodavstva i pravne prakse Jul 2026 Computer law & security review Can the GPC standard eliminate consent banners in the EU? Computer law & security review Dec 2025 International Journal of Latest Technology in Engineering Management & Applied Science The Right to Be Forgotten in The Context of Mobile Number Recycling International Journal of Latest Technology in Engineering Management & Applied Science Sep 2025
Tools 1
US Department of Commerce Data Privacy Framework program — participant list US Department of Commerce Jul 2026