GDPR Map - General Data Protection Regulation

Introduction

Welcome to GDPR Map! This site provides a structured view of Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR) — based on the official text published in OJ L 119, 04.05.2016 and corrigendum OJ L 127, 23.5.2018. All articles are interconnected with their relevant recitals to enhance understanding. The GDPR has been in effect since May 25th, 2018, aiming to unify data protection laws across the European Union.

Easy Navigation

Chapter 1 1 2 3 4

Chapter 2 5 6 7 8 9 10 11

Chapter 3 12 13 14 15 16 17 18 19 20 21 22 23

Chapter 4 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

Chapter 5 44 45 46 47 48 49 50

Chapter 6 51 52 53 54 55 56 57 58 59

Chapter 7 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76

Chapter 8 77 78 79 80 81 82 83 84

Chapter 9 85 86 87 88 89 90 91

Chapter 10 92 93

Chapter 11 94 95 96 97 98 99

Table of Contents

Chapter 1 General provisions Art. 1–4

1 Subject-matter and objectives 2 Material scope 3 Territorial scope 4 Definitions

Chapter 2 Principles Art. 5–11

5 Principles relating to processing of personal data 6 Lawfulness of processing 7 Conditions for consent 8 Conditions applicable to child's consent in relation to information society services 9 Processing of special categories of personal data 10 Processing of personal data relating to criminal convictions and offences 11 Processing which does not require identification

Chapter 3 Rights of the data subject Art. 12–23

12 Transparent information, communication and modalities for the exercise of the rights of the data subject 13 Information to be provided where personal data are collected from the data subject 14 Information to be provided where personal data have not been obtained from the data subject 15 Right of access by the data subject 16 Right to rectification 17 Right to erasure (‘right to be forgotten’) 18 Right to restriction of processing 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing 20 Right to data portability 21 Right to object 22 Automated individual decision-making, including profiling 23 Restrictions

Chapter 4 Controller and processor Art. 24–43

24 Responsibility of the controller 25 Data protection by design and by default 26 Joint controllers 27 Representatives of controllers or processors not established in the Union 28 Processor 29 Processing under the authority of the controller or processor 30 Records of processing activities 31 Cooperation with the supervisory authority 32 Security of processing 33 Notification of a personal data breach to the supervisory authority 34 Communication of a personal data breach to the data subject 35 Data protection impact assessment 36 Prior consultation 37 Designation of the data protection officer 38 Position of the data protection officer 39 Tasks of the data protection officer 40 Codes of conduct 41 Monitoring of approved codes of conduct 42 Certification 43 Certification bodies

Chapter 5 Transfers of personal data to third countries or international organisations Art. 44–50

44 General principle for transfers 45 Transfers on the basis of an adequacy decision 46 Transfers subject to appropriate safeguards 47 Binding corporate rules 48 Transfers or disclosures not authorised by Union law 49 Derogations for specific situations 50 International cooperation for the protection of personal data

Chapter 6 Independent supervisory authorities Art. 51–59

51 Supervisory authority 52 Independence 53 General conditions for the members of the supervisory authority 54 Rules on the establishment of the supervisory authority 55 Competence 56 Competence of the lead supervisory authority 57 Tasks 58 Powers 59 Activity reports

Chapter 7 Cooperation and consistency Art. 60–76

60 Cooperation between the lead supervisory authority and the other supervisory authorities concerned 61 Mutual assistance 62 Joint operations of supervisory authorities 63 Consistency mechanism 64 Opinion of the Board 65 Dispute resolution by the Board 66 Urgency procedure 67 Exchange of information 68 European Data Protection Board 69 Independence 70 Tasks of the Board 71 Reports 72 Procedure 73 Chair 74 Tasks of the Chair 75 Secretariat 76 Confidentiality

Chapter 8 Remedies, liability and penalties Art. 77–84

77 Right to lodge a complaint with a supervisory authority 78 Right to an effective judicial remedy against a supervisory authority 79 Right to an effective judicial remedy against a controller or processor 80 Representation of data subjects 81 Suspension of proceedings 82 Right to compensation and liability 83 General conditions for imposing administrative fines 84 Penalties

Chapter 9 Provisions relating to specific processing situations Art. 85–91

85 Processing and freedom of expression and information 86 Processing and public access to official documents 87 Processing of the national identification number 88 Processing in the context of employment 89 Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 90 Obligations of secrecy 91 Existing data protection rules of churches and religious associations

Chapter 10 Delegated acts and implementing acts Art. 92–93

92 Exercise of the delegation 93 Committee procedure

Chapter 11 Final provisions Art. 94–99

94 Repeal of Directive 95/46/EC 95 Relationship with Directive 2002/58/EC 96 Relationship with previously concluded Agreements 97 Commission reports 98 Review of other Union legal acts on data protection 99 Entry into force and application