General Data Protection Regulation obligations

Who. All organizations processing personal data of natural persons within the EU

• Organizations must follow GDPR rules when processing personal data of natural persons
• Respect fundamental rights and freedoms regarding personal data protection
• Ensure free movement of personal data within the EU is not restricted

Who. All organizations and individuals processing personal data in the EU, except for purely personal/household use, law enforcement authorities, and activities outside EU jurisdiction

• Must comply with GDPR when processing personal data through automated means
• Must comply with GDPR when manually processing personal data that is part of a filing system
• Cannot claim exemption unless activity falls under specific exclusions (personal use, law enforcement, outside EU scope)

Who. Controllers and processors established in the EU, non-EU organizations targeting EU residents with goods/services, non-EU organizations monitoring EU residents' behavior, organizations in territories where EU law applies via international law

• Organizations established in the EU must comply with GDPR for all personal data processing activities
• Non-EU organizations must comply when offering goods/services to EU residents
• Non-EU organizations must comply when monitoring behavior of individuals within the EU
• Organizations must determine if they fall under GDPR's territorial scope and comply accordingly

Who. Any organization (controller or processor) that handles information relating to identified or identifiable individuals (personal data), including businesses, public authorities, agencies, and any other entities processing personal data in the EU

• Understand and correctly identify when information qualifies as 'personal data' under GDPR
• Recognize when any activity with personal data constitutes 'processing' requiring compliance
• Correctly determine your role as either a 'controller' or 'processor' to understand your specific obligations
• Ensure 'consent' meets the strict requirements of being freely given, specific, informed and unambiguous
• Implement proper 'pseudonymisation' techniques when used as a data protection measure
• Establish appropriate technical and organizational measures for any 'filing systems' containing personal data

and 2 more in the full text

Who. Data controllers (any organization that determines how and why personal data is processed)

• Provide all GDPR information in concise, transparent, and easily accessible form using clear language
• Respond to data subject requests within one month (extendable by 2 months for complex cases)
• Facilitate the exercise of data subject rights under Articles 15-22
• Provide information free of charge unless requests are manifestly unfounded or excessive
• Allow oral information provision when requested if identity can be verified
• Use electronic means for responses when requests are made electronically

and 2 more in the full text

Who. Data controllers collecting personal data directly from data subjects (individuals)

• Provide controller identity and contact details at time of data collection
• Disclose the purposes and legal basis for data processing
• Specify data retention period or criteria for determining it
• Inform about data subject rights (access, rectification, erasure, objection, portability)
• Explain right to withdraw consent when processing is based on consent
• Disclose recipients or categories of recipients of personal data

and 5 more in the full text

Who. Data controllers who obtain personal data from sources other than the data subject directly (third-party data collection)

• Provide identity and contact details of the controller and data protection officer
• Explain the purposes and legal basis for processing the data
• Specify categories of personal data and their sources
• List recipients or categories of recipients of the data
• Inform about data retention periods or criteria for determining them
• Notify about data subject rights (access, rectification, erasure, objection, portability)

and 4 more in the full text

Who. Data controllers (any organization that determines the purposes and means of processing personal data)

• Confirm whether personal data is being processed when requested
• Provide access to the personal data being processed
• Disclose the purposes of processing
• Identify recipients or categories of recipients of the data
• Specify data retention periods or criteria for determining retention
• Inform about data subject rights (rectification, erasure, restriction, objection)

and 6 more in the full text

Who. All data controllers processing personal data of EU residents under GDPR

• Must rectify inaccurate personal data without undue delay upon request
• Must allow data subjects to complete incomplete personal data
• Must accept supplementary statements to complete data records
• Must have processes in place to handle rectification requests promptly

Who. Data controllers (any organization that determines purposes and means of processing personal data) and applies to all personal data of EU residents

• Delete personal data without undue delay when requested by the data subject
• Erase data when it's no longer necessary for original purposes
• Delete data immediately when consent is withdrawn and no other legal basis exists
• Remove data that was unlawfully processed
• Take reasonable steps to inform third parties who received the data about erasure requests
• Implement technical measures to facilitate data deletion across systems

and 1 more in the full text

Who. Data controllers who process personal data and data subjects exercising their rights

• Controllers must restrict processing when data accuracy is contested
• Controllers must restrict processing when data subject opposes erasure of unlawfully processed data
• Controllers must retain data when needed by data subject for legal claims
• Controllers must restrict processing during pending objection verification
• Controllers can only store (not process) restricted data without consent
• Controllers must inform data subjects before lifting processing restrictions

Who. Data controllers who have disclosed personal data to third parties

• Notify all recipients when personal data is rectified (corrected)
• Notify all recipients when personal data is erased (deleted)
• Notify all recipients when processing is restricted
• Maintain records of who received the data to enable notifications
• Inform data subjects about recipients upon request

Who. Data controllers processing personal data based on consent or contract using automated means

• Provide personal data in structured, commonly used, machine-readable format upon request
• Allow data transfer to another controller without hindrance
• Enable direct transmission between controllers where technically feasible
• Only applies to data the person provided themselves
• Only applies when processing is based on consent or contract and done by automated means

Who. Data controllers processing personal data based on legitimate interests or public tasks (Article 6(1)(e) or (f)), especially those engaged in direct marketing, profiling, or scientific/historical research

• Stop processing personal data when a data subject objects unless you have compelling legitimate grounds that override their rights
• Immediately cease all processing for direct marketing purposes when objected to
• Explicitly inform data subjects of their right to object at first communication
• Present the right to object clearly and separately from other information
• Provide automated means for objecting in online services using technical specifications
• Honor objections to research/statistical processing unless necessary for public interest tasks

Who. Data controllers using automated systems for decisions that legally or significantly affect individuals (credit scoring, hiring, insurance, pricing algorithms)

• Obtain explicit consent, contract necessity, or legal authorization before automated decision-making
• Provide right to human intervention and review of automated decisions
• Allow data subjects to express their viewpoint and contest decisions
• Implement suitable safeguards for rights and freedoms
• Prohibit automated decisions based on sensitive data unless specific exemptions apply

Who. Member State legislators creating laws that restrict GDPR rights, and data controllers/processors operating under such restrictive laws

• Restrictions must be implemented through legislative measures, not ad-hoc decisions
• Restrictions must respect the essence of fundamental rights and freedoms
• Restrictions must be necessary and proportionate in a democratic society
• Legislative measures must specify purposes, data categories, scope, and safeguards
• Must include provisions to prevent abuse or unlawful access/transfer
• Must specify storage periods and applicable safeguards

and 2 more in the full text

Who. Data controllers and processors transferring personal data to third countries (non-EU) or international organizations

• Comply with all conditions in Chapter V before any international data transfer
• Ensure GDPR-level protection continues after transfer
• Apply transfer rules to any onward transfers (when data moves from one third country to another)
• Both controllers and processors must comply with transfer requirements

Who. Data controllers and processors transferring personal data outside the EU to third countries or international organizations

• Organizations may transfer personal data to Commission-approved countries without specific authorization
• Must monitor Commission decisions and official lists of approved countries
• Must cease transfers if adequacy decision is revoked or suspended
• Alternative transfer mechanisms (Articles 46-49) remain available even if adequacy is revoked

Who. Data controllers and processors transferring personal data to third countries or international organizations without an adequacy decision

• Provide appropriate safeguards before any data transfer to non-EU countries
• Ensure enforceable data subject rights remain available after transfer
• Ensure effective legal remedies remain available for data subjects
• Use one of the approved safeguard mechanisms (SCCs, BCRs, codes of conduct, certifications)
• Obtain supervisory authority authorization for custom contractual clauses or administrative arrangements
• Apply consistency mechanism when using custom safeguards requiring authorization

Who. Multinational groups of companies or enterprises engaged in joint economic activities that need to transfer personal data between their entities across different countries, particularly from the EU to non-EU countries

• Make BCRs legally binding and enforceable across all company entities and employees
• Grant enforceable rights to data subjects regarding their personal data
• Document complete company structure and contact details for all entities
• Specify all data transfers including categories, purposes, and destination countries
• Implement all GDPR principles (purpose limitation, data minimization, security measures)
• Establish liability acceptance for non-EU entities' GDPR breaches

and 6 more in the full text

Who. All data controllers and processors handling EU personal data who receive requests from non-EU courts or authorities

• Do not transfer personal data based solely on foreign court orders or administrative decisions
• Only comply with foreign data requests if backed by valid international agreements (e.g., mutual legal assistance treaties)
• Verify that an appropriate international agreement exists before responding to foreign data requests
• Ensure any data transfer still complies with other GDPR transfer requirements in Chapter V

Who. Data controllers and processors transferring personal data to third countries or international organizations outside the EU without adequacy decisions or standard safeguards

• Obtain explicit consent after informing data subjects of risks when transferring without adequacy decisions
• Document all assessments and safeguards for transfers based on compelling legitimate interests
• Inform supervisory authorities of transfers made under compelling legitimate interests exception
• Inform data subjects about the transfer and compelling legitimate interests pursued
• Ensure transfers from public registers don't involve entire datasets or categories
• Limit transfers to non-repetitive, limited data subjects when using compelling legitimate interests exception

and 1 more in the full text

Who. European Commission and EU supervisory authorities (data protection authorities)

• Develop international cooperation mechanisms for data protection enforcement
• Provide mutual assistance to other countries in data protection enforcement
• Include appropriate safeguards when sharing information internationally
• Engage stakeholders in international data protection cooperation discussions
• Exchange and document data protection laws and practices across jurisdictions
• Address jurisdictional conflicts with non-EU countries

Who. Lead supervisory authorities, other concerned supervisory authorities, controllers and processors with establishments in multiple EU member states, and the European Data Protection Board

• Lead authority must cooperate and share all relevant information with other concerned supervisory authorities
• Submit draft decisions to other authorities for opinion and take their views into account
• Wait 4 weeks for objections from other authorities before proceeding
• Submit revised draft if following a relevant and reasoned objection (2-week review period)
• Adopt and notify final decision to controller/processor's main establishment
• Inform other supervisory authorities and the Board of the decision

and 1 more in the full text

Who. EU data protection supervisory authorities in all member states

• Provide relevant information and mutual assistance to other supervisory authorities
• Reply to assistance requests within one month maximum
• Share information only for the stated purpose of the request
• Provide reasons if refusing an assistance request
• Use electronic means and standardized formats for information exchange
• Provide assistance free of charge (no fees for requested actions)

Who. Supervisory authorities when controllers/processors have establishments in multiple Member States or when processing affects data subjects in multiple Member States

• Lead supervisory authority must invite other affected Member States' authorities to participate in joint operations
• Lead authority must respond without delay to participation requests from other supervisory authorities
• Host supervisory authority must provide guidance and presence for visiting authority staff during joint operations
• Member States must assume responsibility and liability for damage caused by seconded staff operating in their territory
• Member States must reimburse other Member States for damages their seconded staff cause in other territories

Who. All EU supervisory authorities (national data protection authorities)

• Supervisory authorities must cooperate with each other through the consistency mechanism
• Supervisory authorities must cooperate with the European Commission where relevant
• Authorities must contribute to consistent GDPR application throughout the EU

Who. National supervisory authorities (data protection authorities) in EU member states when making decisions with cross-border impact or general application

• Supervisory authorities must submit draft decisions to the Board for opinion before adopting measures related to: impact assessment lists, codes of conduct approval, accreditation criteria, standard data protection clauses, contractual clauses authorization, or binding corporate rules
• Supervisory authorities must communicate all relevant information to the Board using standardized electronic format
• Supervisory authorities must wait for the Board's opinion period (8 weeks, extendable by 6 weeks) before adopting their draft decision
• Supervisory authorities must take utmost account of the Board's opinion and respond within 2 weeks stating whether they will maintain or amend their decision

Who. This article applies to all EU supervisory authorities (data protection authorities), the European Data Protection Board, and indirectly affects controllers and processors whose cases are subject to dispute resolution

• Supervisory authorities must accept binding decisions from the Board when disputes arise
• The Board must make decisions within 1-2 months (extendable for complex cases)
• Lead supervisory authorities must implement the Board's binding decision within one month
• Supervisory authorities cannot make independent decisions on matters submitted to the Board while review is pending
• The Board must publish its decisions on its website after the final decision is made

Who. Supervisory authorities (national data protection regulators) when protecting data subjects' rights in exceptional circumstances requiring urgent action

• Supervisory authorities must immediately communicate emergency measures to other concerned authorities, the Board, and the Commission
• Emergency provisional measures are limited to 3 months maximum duration
• Authorities must provide clear reasons when requesting urgent opinions or decisions
• The Board must respond to urgent requests within 2 weeks by simple majority vote

Who. National data protection supervisory authorities and the European Data Protection Board

• Supervisory authorities must use Commission-specified electronic formats for information exchange
• Supervisory authorities must follow standardized arrangements for communication with other authorities
• Supervisory authorities must comply with electronic exchange protocols established with the Board

Who. EU Member States, national supervisory authorities, the European Commission, and the European Data Protection Supervisor

• Each Member State must appoint a supervisory authority head to the Board
• Member States with multiple supervisory authorities must appoint a joint representative
• The Board must have a Chair who represents the organization
• The Board must allow Commission participation in meetings and activities

Who. The European Data Protection Board and its members when performing their regulatory duties

• The Board must act independently when performing all tasks under Articles 70 and 71
• The Board cannot seek instructions from any external party
• The Board cannot accept or follow instructions from any external party
• The Board must maintain independence even when responding to Commission requests

Who. The European Data Protection Board itself - this article defines the Board's own responsibilities and functions rather than imposing obligations on organizations or individuals

• Monitor and ensure correct GDPR application across member states
• Issue guidelines, recommendations, and best practices for consistent GDPR interpretation
• Review and approve binding corporate rules for international data transfers
• Accredit and maintain register of certification bodies
• Resolve disputes between supervisory authorities through binding decisions
• Advise the Commission on data protection matters and proposed regulation amendments

and 3 more in the full text

Who. The European Data Protection Board (supervisory authority)

• Board must draw up an annual report on personal data protection
• Report must be made publicly available
• Report must be transmitted to European Parliament, Council, and Commission
• Report must review practical application of guidelines and recommendations
• Report must review binding decisions made under Article 65

Who. European Data Protection Board members and the Board as an institution

• Board members must participate in voting processes where decisions are made by simple majority
• Board must establish and adopt its own rules of procedure
• Two-thirds majority vote required for adopting internal rules of procedure
• Board must organize its own operational arrangements

Who. Members of the European Data Protection Board

• Board members must participate in the election process for chair and deputy chairs
• Elections must be conducted by simple majority
• Term limits must be respected (maximum two 5-year terms)

Who. The Chair of the European Data Protection Board and the Board itself as an institution

• Convene Board meetings and prepare meeting agendas
• Notify lead and concerned supervisory authorities of Board decisions under Article 65
• Ensure timely performance of Board tasks, especially consistency mechanism operations
• Establish and follow procedures for task allocation between Chair and deputy chairs

Who. European Data Protection Board, European Data Protection Supervisor, and their respective staff members

• European Data Protection Supervisor must provide secretariat services to the Board
• Secretariat staff must work exclusively under the Board Chair's instructions
• Separate reporting lines must be maintained between Board and Supervisor staff
• Secretariat must handle all Board communications, translations, and meeting logistics
• Secretariat must prepare and publish Board opinions, decisions, and other documents

Who. The European Data Protection Board, its members, experts, and third-party representatives involved in Board proceedings

• Board must maintain confidentiality when deemed necessary according to its rules
• Must follow EU Regulation 1049/2001 for document access requests
• Must balance transparency with confidentiality requirements

Who. Member States (national governments) who must create legislation, and organizations engaged in journalistic, academic, artistic, or literary expression who may benefit from exemptions

• Member States must create national laws reconciling data protection with freedom of expression
• Member States must provide exemptions/derogations from most GDPR chapters for journalistic, academic, artistic, or literary purposes
• Member States must notify the European Commission of their adopted provisions and any subsequent amendments

Who. Public authorities, public bodies, and private bodies performing tasks in the public interest that hold official documents containing personal data

• Public authorities must have legal basis under EU or national law to disclose personal data in official documents
• Disclosure must reconcile public access rights with data protection requirements
• Organizations must comply with applicable Union or Member State transparency laws while respecting GDPR

Who. Any organization or entity processing national identification numbers or general identifiers within EU member states

• Use national ID numbers only in compliance with member state-specific conditions
• Implement appropriate safeguards when processing national identification numbers
• Ensure protection of data subject rights and freedoms when using general identifiers
• Follow both GDPR requirements and national regulations for ID number processing

Who. Member States creating employment data protection laws, employers processing employee personal data, and collective agreement parties

• Member States must include suitable and specific measures to safeguard employee human dignity and fundamental rights
• Rules must address transparency of processing
• Rules must cover transfer of personal data within groups of undertakings
• Rules must address workplace monitoring systems
• Member States must notify the Commission of their employment data protection laws by May 25, 2018
• Member States must notify the Commission of any subsequent amendments to these laws

Who. Organizations conducting scientific or historical research, statistical analysis, or archiving for public interest purposes

• Implement appropriate technical and organizational safeguards for data subjects' rights
• Ensure data minimization principle is respected
• Use pseudonymization when purposes can be achieved with it
• Avoid identifying data subjects when purposes can be fulfilled without identification
• Apply derogations only to the specific research/archiving/statistical purposes

Who. Controllers or processors subject to professional secrecy obligations under EU or Member State law (such as lawyers, doctors, accountants, and other regulated professions)

• Member States must ensure any secrecy rules are necessary and proportionate
• Rules must specifically reconcile data protection rights with professional secrecy obligations
• Member States must notify the European Commission of any rules adopted under this article
• Member States must notify the Commission of any subsequent amendments without delay

Who. Churches, religious associations, religious communities, and other religious organizations in EU Member States that had comprehensive data protection rules before GDPR took effect

• Bring existing comprehensive data protection rules in line with GDPR requirements
• Submit to supervision by an independent supervisory authority
• Ensure the supervisory authority meets Chapter VI conditions if using a specific religious authority

Who. All organizations, legal entities, and regulatory bodies that previously operated under or referenced Directive 95/46/EC

• Treat all references to Directive 95/46/EC as references to the GDPR after May 25, 2018
• Recognize the European Data Protection Board as the successor to the Article 29 Working Party
• Update any legal documentation or policies that reference the old directive

Who. Electronic communications service providers operating in public networks (telecom companies, ISPs, messaging services)

• No additional GDPR obligations for matters already covered by ePrivacy Directive 2002/58/EC
• Must still comply with ePrivacy Directive for electronic communications services

Who. Member States with pre-GDPR international data transfer agreements, and organizations relying on such agreements for international data transfers

• Member States must ensure pre-GDPR international agreements comply with pre-GDPR Union law
• Organizations relying on pre-2016 agreements must verify they remain valid and unmodified
• Any amendments to pre-existing agreements must comply with current GDPR requirements

Who. The European Commission (reporting obligation), with indirect involvement of Member States and supervisory authorities who may be asked to provide information

• Commission must submit evaluation reports to European Parliament and Council by May 25, 2020 and every four years thereafter
• Reports must be made publicly available
• Commission must examine application of international data transfers (Chapter V)
• Commission must examine cooperation and consistency mechanisms (Chapter VII)
• Commission may request information from Member States and supervisory authorities
• Commission must consider feedback from European Parliament, Council, and other relevant bodies

and 1 more in the full text

Who. European Commission (primary responsibility) and indirectly all EU institutions, bodies, offices and agencies that process personal data

• Commission must review other EU data protection laws for consistency with GDPR
• Commission must submit legislative proposals to align other EU laws with GDPR standards
• Ensure uniform protection standards across all EU institutions, bodies, offices and agencies
• Harmonize rules for data processing and free movement of data within EU institutions

Who. All data controllers and processors handling EU residents' personal data, regardless of location

• All GDPR requirements became mandatory on May 25, 2018
• No transitional period after the application date
• Organizations must have been fully compliant by May 25, 2018