Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

Summary

RECITALS

CHAPTER I - General provisions 

• Article 1 - Subject-matter and objectives
• Article 2 - Material scope
• Article 3 - Territorial scope
• Article 4 - Definitions

CHAPTER II - Principles

• Article 5 - Principles relating to processing of personal data
  
• Article 6 - Lawfulness of processing
• Article 7 - Conditions for consent
• Article 8 - Conditions applicable to child's consent in relation to information society services
  
• Article 9 - Processing of special categories of personal data
• Article 10 - Processing of personal data relating to criminal convictions and offences
  
• Article 11 - Processing which does not require identification

CHAPTER III - Rights of the data subject

Section 1 - Transparency and modalities

• Article 12 - Transparent information, communication and modalities for the exercise of the rights of the data subject

Section 2 - Information and access to personal data

• Article 13 - Information to be provided where personal data are collected from the data subject
  
• Article 14 - Information to be provided where personal data have not been obtained from the data subject
  
• Article 15 - Right of access by the data subject

Section 3 - Rectification and erasure

• Article 16 - Right to rectification
  
• Article 17 - Right to erasure (‘right to be forgotten’)
  
• Article 18 - Right to restriction of processing
  
• Article 19 - Notification obligation regarding rectification or erasure of personal data or restriction of processing
  
• Article 20 - Right to data portability

Section 4 - Right to object and automated individual decision-making

• Article 21 - Right to object
  
• Article 22 - Automated individual decision-making, including profiling 

Section 5 - Restrictions 

• Article 23 - Restrictions

CHAPTER IV - Controller and processor 

Section 1 - General obligations 

• Article 24 - Responsibility of the controller
  
• Article 25 - Data protection by design and by default
  
• Article 26 - Joint controllers
  
• Article 27 - Representatives of controllers or processors not established in the Union
  
• Article 28 -Processor
  
• Article 29 - Processing under the authority of the controller or processor
  
• Article 30 - Records of processing activities
  
• Article 31 - Cooperation with the supervisory authority 

Section 2 - Security of personal data 

• Article 32 - Security of processing
• Article 33 - Notification of a personal data breach to the supervisory authority
  
• Article 34 - Communication of a personal data breach to the data subject

Section 3 - Data protection impact assessment and prior consultation

• Article 35 - Data protection impact assessment
  
• Article 36 - Prior consultation 

Section 4 - Data protection officer 

• Article 37 - Designation of the data protection officer
  
• Article 38 - Position of the data protection officer
  
• Article 39 - Tasks of the data protection officer 

Section 5 - Codes of conduct and certification

• Article 40 - Codes of conduct
  
• Article 41 - Monitoring of approved codes of conduct
  
• Article 42 - Certification
  
• Article 43 - Certification bodies

CHAPTER V - Transfers of personal data to third countries or international organisations 

• Article 44 - General principle for transfers
  
• Article 45 - Transfers on the basis of an adequacy decision
  
• Article 46 - Transfers subject to appropriate safeguards
  
• Article 47 - Binding corporate rules
  
• Article 48 - Transfers or disclosures not authorised by Union law
  
• Article 49 - Derogations for specific situations
  
• Article 50 - International cooperation for the protection of personal data

CHAPTER VI - Independent supervisory authorities

Section 1 - Independent status

• Article 51 - Supervisory authority
• Article 52 - Independence
  
• Article 53 - General conditions for the members of the supervisory authority
  
• Article 54 - Rules on the establishment of the supervisory authority

Section 2 - Competence, tasks and powers

• Article 55 - Competence
• Article 56 - Competence of the lead supervisory authority
  
• Article 57 - Tasks
  
• Article 58 - Powers
  
• Article 59 - Activity reports 

CHAPTER VII - Cooperation and consistency

Section 1 - Cooperation

• Article 60 - Cooperation between the lead supervisory authority and the other supervisory authorities concerned
• Article 61 - Mutual assistance
• Article 62 - Joint operations of supervisory authorities 

Section 2 - Consistency

• Article 63 - Consistency mechanism 
• Article 64 - Opinion of the Board
  
• Article 65 - Dispute resolution by the Board
  
• Article 66 - Urgency procedure
  
• Article 67 - Exchange of information

Section 3 - European data protection board

• Article 68 - European data protection board
• Article 69 - Independence
• Article 70 - Tasks of the Board
• Article 71 - Reports
  
• Article 72 - Procedure
  
• Article 73 - Chair
  
• Article 74 - Tasks of the Chair
  
• Article 75 - Secretariat
  
• Article 76 - Confidentiality

CHAPTER VIII - Remedies, liability and penalties

• Article 77 - Right to lodge a complaint with a supervisory authority
• Article 78 - Right to an effective judicial remedy against a supervisory authority
• Article 79 - Right to an effective judicial remedy against a controller or processor
• Article 80 - Representation of data subjects
• Article 81 - Suspension of proceedings
• Article 82 - Right to compensation and liability
• Article 83 - General conditions for imposing administrative fines
• Article 84 - Penalties

CHAPTER IX -  Provisions relating to specific processing situations

• Article 85 -  Processing and freedom of expression and information 
• Article 86 - Processing and public access to official documents
  
• Article 87 - Processing of the national identification number
  
• Article 88 - Processing in the context of employment
  
• Article 89 - Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
  
• Article 90 - Obligations of secrecy
  
• Article 91 - Existing data protection rules of churches and religious associations 

CHAPTER X - Delegated acts and implementing acts 

• Article 92 - Exercise of the delegation
• Article 93 - Committee procedure

CHAPTER XI - Final provisions

• Article 94 -Repeal of Directive 95/46/EC
  
• Article 95 - Relationship with Directive 2002/58/EC
  
• Article 96 - Relationship with previously concluded Agreements
  
• Article 97 - Commission reports
  
• Article 98 - Review of other Union legal acts on data protection
  
• Article 99 - Entry into force and application