European Data Protection and Privacy Law: GDPR, Institutional Oversight, and Individual Rights

European Data Protection and Privacy Law: GDPR, Institutional Oversight, and Individual Rights

Introduction

Personal data has become one of the most valuable resources of the modern economy. Governments use it to administer public services, businesses rely on it to develop products and target customers, employers process it to manage their workforce, and digital platforms collect it to personalise services and predict behaviour. Increasingly, information about individuals is generated not only through deliberate disclosure but also through location tracking, online activity, connected devices, biometric identification, automated profiling, and artificial intelligence.

This environment creates a fundamental legal question: under what conditions may organisations collect, analyse, retain, disclose, and transfer information relating to individuals?

European Union law approaches this question through a framework grounded in fundamental rights. Data protection is not merely a matter of confidentiality or cybersecurity. It is an independent legal right intended to preserve individual autonomy, dignity, and control over information relating to a person. It also supports trust in the internal market by establishing common rules for organisations processing personal data across national borders.

The central instrument is Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), which has applied since 25 May 2018. It establishes principles governing the processing of personal data, defines the responsibilities of controllers and processors, grants individuals enforceable rights, and creates a system of independent national supervisory authorities coordinated at European level.

The GDPR is not the entire European data protection framework. Processing by EU institutions is governed by Regulation (EU) 2018/1725, while processing by competent authorities for law-enforcement purposes is principally regulated by Directive (EU) 2016/680. Electronic communications, cybersecurity, digital services, and artificial intelligence are also subject to related legislation. These instruments operate alongside, rather than simply replacing, the GDPR.

European data protection law therefore combines substantive rights, organisational duties, regulatory supervision, judicial enforcement, and rules governing international transfers. Its effectiveness depends on the relationship between all these elements.

1. Constitutional Foundations of European Data Protection

1.1 Article 16 TFEU and the Charter of Fundamental Rights

The constitutional foundation of EU data protection law is found in Article 16 of the Treaty on the Functioning of the European Union. It recognises that everyone has the right to the protection of personal data concerning them and authorises the European Parliament and the Council to adopt rules governing the processing of personal data by EU institutions and Member States when acting within the scope of Union law.

Article 16 TFEU provides both a fundamental-rights foundation and a legislative competence. It allows the Union to establish a common regulatory framework rather than leaving data protection entirely to divergent national systems.

Article 8 of the Charter of Fundamental Rights of the European Union independently recognises the right to the protection of personal data. It requires that personal data be processed fairly, for specified purposes, and on the basis of consent or another legitimate basis laid down by law. It also provides that compliance with data protection rules must be subject to control by an independent authority.

The Charter distinguishes data protection from the right to respect for private and family life under Article 7. The two rights are closely connected, but they are not identical. Article 7 protects private life, family life, the home, and communications. Article 8 focuses specifically on the lawful processing and protection of personal information.

This distinction is significant. An organisation may process information that is not particularly intimate or confidential and still be subject to data protection law. A person’s professional email address, online identifiers, employment records, purchasing history, or location data may all constitute personal data even when they do not reveal traditionally private matters.

1.2 The relationship with the European Convention on Human Rights

Article 8 of the European Convention on Human Rights protects the right to respect for private and family life, home, and correspondence. The European Court of Human Rights has developed substantial case law concerning surveillance, retention of personal information, communications monitoring, and the collection of sensitive data.

The EU framework and the Convention overlap in important respects, but their legal structures differ. The GDPR establishes detailed obligations for public and private organisations, while the Convention primarily provides a human-rights standard against which state conduct is assessed.

The European Court of Human Rights has repeatedly emphasised that the systematic collection and retention of personal information can interfere with private life even where the information is not subsequently disclosed. In S. and Marper v United Kingdom, for example, the Court examined the indefinite retention of fingerprints and DNA profiles of individuals who had not been convicted of an offence. The judgment demonstrated that the retention of personal data itself can raise serious fundamental-rights concerns.

1.3 Data protection and the internal market

The GDPR also serves an economic and regulatory purpose. Before its adoption, national data protection rules were based principally on Directive 95/46/EC. Although the Directive established common principles, differences in national implementation created legal uncertainty and administrative complexity for organisations operating across the Union.

The GDPR replaced the Directive with a directly applicable regulation. Its objective is not simply to restrict processing but to permit lawful data use within a predictable framework. The free movement of personal data within the Union is expressly protected, provided that the Regulation’s safeguards are respected.

The result is a dual legal structure: individuals receive enforceable protection, while organisations benefit from a common set of rules across the EU and the European Economic Area, subject to the relevant arrangements extending the GDPR’s application.

2. Scope and Application of the GDPR

2.1 What constitutes personal data?

Article 4(1) GDPR defines personal data as any information relating to an identified or identifiable natural person, known as the data subject.

A person may be identifiable directly or indirectly. Direct identifiers include names, identification numbers, and contact details. Indirect identifiers may include location information, online identifiers, device identifiers, or combinations of information that make it possible to distinguish an individual.

The concept is deliberately broad. It can cover:

• Names, addresses, telephone numbers, and email addresses.
• Employment, educational, and financial records.
• Medical information and genetic data.
• Photographs, video recordings, and voice recordings.
• IP addresses and online identifiers, depending on the circumstances.
• Location and movement data.
• Information derived through profiling or behavioural analysis.

In Breyer v Bundesrepublik Deutschland (Case C-582/14), the Court of Justice considered whether a dynamic IP address could constitute personal data for an online service provider. The Court held that information may be personal data where the controller has legal means reasonably likely to be used to identify the individual by combining it with additional information held by another person.

The judgment illustrates that identifiability is not confined to information already held by a single organisation. The wider practical and legal context of identification may be relevant.

Information that has been irreversibly anonymised so that an individual can no longer be identified falls outside the GDPR’s definition of personal data. Pseudonymised information, however, remains personal data where identification is possible through additional information. Replacing a name with a code does not automatically remove the information from the Regulation’s scope.

The GDPR protects natural persons. It does not generally regulate information relating solely to legal persons, although information about a company’s employees, directors, or individual customers may be personal data. The Regulation also does not apply to personal data relating to deceased persons as such, although Member States may adopt national rules concerning their processing.

2.2 Material scope

Article 2 applies to the processing of personal data wholly or partly by automated means and to non-automated processing where the data form part of, or are intended to form part of, a filing system.

Processing is defined broadly. It includes collection, recording, organisation, storage, alteration, retrieval, consultation, use, disclosure, transmission, combination, restriction, erasure, and destruction.

The GDPR therefore applies to much more than the operation of databases. A company collecting customer information, a hospital maintaining patient records, an employer storing personnel files, and an online platform analysing user behaviour may all be processing personal data.

Certain activities are excluded. These include processing in the course of an activity falling outside the scope of EU law, activities relating to national security, and processing by natural persons in the course of a purely personal or household activity. The household exemption is interpreted in light of the nature and context of the activity; it does not automatically cover public dissemination or systematic monitoring extending beyond private life.

2.3 Territorial scope

Article 3 GDPR establishes a broad territorial application.

First, the Regulation applies to processing carried out in the context of the activities of an establishment of a controller or processor in the Union, regardless of whether the processing itself takes place within the EU.

Second, it applies to controllers and processors established outside the Union where their processing activities relate to offering goods or services to individuals in the Union, whether payment is required or not, or monitoring their behaviour insofar as that behaviour takes place within the Union.

This means that an organisation cannot avoid the GDPR merely by locating its servers or headquarters outside Europe. A non-European digital platform targeting individuals in the EU, or systematically tracking their online behaviour within the Union, may fall within the Regulation’s territorial scope.

Where a non-EU controller or processor is subject to Article 3(2), it will generally have to designate an EU representative under Article 27, unless a statutory exception applies.

3. Fundamental Principles of Personal Data Processing

Article 5 establishes seven principles that govern the processing of personal data. They are not merely abstract declarations. They determine whether particular processing operations are lawful and shape the practical duties of controllers and processors.

3.1 Lawfulness, fairness, and transparency

Processing must have a valid legal basis, be fair to the data subject, and be explained in a transparent manner.

Lawfulness requires more than obtaining information through technically permissible means. An organisation must identify an applicable legal basis under Article 6 and, where relevant, satisfy the additional requirements governing special-category data.

Fairness concerns the manner in which information is collected and used. Processing may be technically authorised yet unfair where it exploits an individual’s vulnerability, conceals material consequences, or uses information in ways that undermine reasonable expectations.

Transparency requires intelligible information about the processing operation. A privacy notice should explain who is processing the data, why it is being processed, the legal basis, the relevant recipients, retention periods, and the rights available to the individual. Information should be accessible and understandable rather than hidden within unnecessarily complicated legal language.

3.2 Purpose limitation

Personal data must be collected for specified, explicit, and legitimate purposes. It cannot simply be retained indefinitely for any future use an organisation may wish to pursue.

Further processing for a different purpose is not automatically prohibited. Article 6(4) provides criteria for assessing compatibility, including the relationship between the original and proposed purposes, the context of collection, the nature of the information, possible consequences for individuals, and safeguards such as encryption or pseudonymisation.

The principle prevents organisations from treating personal information as an unrestricted resource that may be repurposed without legal assessment.

3.3 Data minimisation

Organisations should collect only information that is adequate, relevant, and necessary for the stated purpose.

A retailer processing an online purchase may need a delivery address and payment information. It does not necessarily need access to the customer’s entire contact list or continuous location history.

Data minimisation is particularly important in digital services, where organisations may be technically capable of collecting far more information than is necessary to provide the service.

3.4 Accuracy

Personal data must be accurate and, where necessary, kept up to date. Reasonable steps must be taken to correct or erase inaccurate information without undue delay.

This principle is especially important in credit assessments, recruitment, insurance, public administration, and automated decision-making. Inaccurate information may produce consequences extending well beyond the original processing operation.

3.5 Storage limitation

Personal data must not be kept in identifiable form for longer than necessary for the purposes for which it was collected.

The GDPR does not impose a universal retention period. The appropriate period depends on the legal basis, purpose, applicable statutory obligations, and the nature of the information. Organisations should establish retention schedules and review whether continued storage remains justified.

Longer retention may be permitted for archiving in the public interest, scientific or historical research, and statistical purposes, subject to appropriate safeguards under Article 89.

3.6 Integrity and confidentiality

Controllers must ensure appropriate security through technical and organisational measures. These may include access controls, encryption, pseudonymisation, secure authentication, staff training, backup procedures, and incident-response systems.

The appropriate level of security depends on the nature of the data, the risks involved, the state of technological development, and the costs of implementation. The Regulation does not demand absolute security, but it requires measures proportionate to the risks.

3.7 Accountability

Article 5(2) establishes the principle of accountability: the controller is responsible for compliance and must be able to demonstrate it.

This changes the regulatory approach. An organisation cannot rely solely on a declaration that it respects data protection law. It must maintain evidence of its legal bases, policies, assessments, contracts, security measures, and responses to individual requests.

Accountability is therefore both a substantive obligation and a method of regulatory supervision.

4. Legal Bases for Processing Personal Data

Article 6 GDPR provides six legal bases. At least one must apply to each processing operation.

Consent. The data subject has agreed to processing for one or more specific purposes. Consent must be freely given, specific, informed, and unambiguous, expressed through a statement or clear affirmative action. Where consent is relied upon, the controller must be able to demonstrate that it was obtained validly. Individuals must be able to withdraw it as easily as they gave it.

Consent is not always the most appropriate basis. It may be problematic where there is a significant imbalance between the individual and the organisation, such as in certain employment relationships.

Contract. Processing is lawful where it is necessary to perform a contract with the data subject or to take steps requested by that person before entering into a contract. The provision does not authorise every form of processing that an organisation chooses to include in its contractual terms. The processing must genuinely be necessary for the contractual purpose.

Legal obligation. An organisation may process personal data where this is necessary to comply with a legal obligation imposed upon it. The obligation must have a basis in applicable law.

Vital interests. Processing may be necessary to protect the vital interests of the data subject or another natural person, particularly in circumstances involving serious threats to life or physical integrity.

Public task or official authority. Public bodies and other organisations carrying out legally assigned public-interest functions may rely on this basis where processing is necessary for the relevant task or exercise of authority.

Legitimate interests. Processing may be based on legitimate interests pursued by the controller or a third party, provided that those interests are not overridden by the interests or fundamental rights and freedoms of the data subject. The controller must assess the purpose, necessity, and balancing of interests. The interests of children require particular attention.

The legal bases are alternatives, not a hierarchy. Consent is not automatically superior to every other basis. The correct basis depends on the purpose and legal circumstances of the processing, and organisations should identify it before processing begins rather than selecting a justification retrospectively.

5. Special Categories of Personal Data

Article 9 establishes additional protection for special categories of personal data. These include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, health data, and information concerning a person’s sex life or sexual orientation.

Processing these categories is generally prohibited unless one of the specific exceptions in Article 9(2) applies.

The exceptions include explicit consent, employment and social-protection obligations, protection of vital interests where the individual cannot consent, certain activities of non-profit bodies, information manifestly made public by the individual, the establishment or defence of legal claims, substantial public interest, healthcare and public-health purposes, and qualifying archiving, research, or statistical activities.

The Article 9 exception does not replace the need for a lawful basis under Article 6. In many cases, both provisions must be satisfied.

For example, a hospital processing health information for treatment must identify an applicable Article 6 basis and an Article 9 exception, together with any relevant national or sector-specific safeguards.

Article 10 separately regulates personal data relating to criminal convictions and offences. Such data may be processed under the control of official authority or where authorised by Union or Member State law providing appropriate safeguards.

The distinction matters because sensitive information can expose individuals to discrimination, exclusion, or serious interference with their fundamental rights. The additional restrictions are intended to reduce those risks.

6. Controllers, Processors, and Organisational Responsibility

The GDPR distinguishes between controllers and processors because responsibility depends on the role an organisation plays in determining and carrying out processing.

A controller determines the purposes and means of processing. It decides why personal data are collected and the essential arrangements through which they are used.

A processor processes personal data on behalf of a controller. Examples include cloud-hosting providers, payroll service providers, and external companies managing customer databases under instructions.

An organisation may be a controller for one operation and a processor for another. The classification depends on the actual functions performed, not simply on contractual labels.

Article 28 requires controllers to use processors that provide sufficient guarantees of appropriate technical and organisational measures. A written contract or other binding legal act must define the subject matter, duration, nature, and purpose of processing, the categories of data and data subjects, and the rights and obligations of the parties.

Processors must follow documented instructions, maintain confidentiality, assist the controller with compliance, support security and breach-response obligations, and comply with requirements concerning sub-processors and deletion or return of information.

Where two or more controllers jointly determine the purposes and means of processing, Article 26 requires a transparent arrangement allocating their respective responsibilities. The essential content of that arrangement must be made available to data subjects. The existence of an internal allocation does not prevent individuals from exercising their rights against either controller, subject to the Regulation.

7. Data Protection by Design and by Default

Article 25 requires controllers to integrate data protection into the design and operation of processing systems.

Data protection by design means that safeguards should be considered when systems, services, and processes are developed, rather than added only after problems arise. Examples include limiting the information collected, separating datasets, using encryption, controlling access, and building deletion mechanisms into the system.

Data protection by default requires that, without further intervention by the individual, only personal data necessary for each specific purpose are processed. This concerns the amount of information collected, the extent of processing, the period of storage, and accessibility.

A digital platform, for example, should not automatically make a user’s profile public or enable extensive tracking where such processing is unnecessary for the service requested.

These requirements make privacy a matter of organisational and technical architecture. They also demonstrate that compliance cannot be achieved solely through a privacy notice or consent banner.

8. Data Protection Officers and Impact Assessments

8.1 Data Protection Officers

Article 37 requires the appointment of a Data Protection Officer (DPO) in specified circumstances. These include where processing is carried out by a public authority or body, where the core activities of the controller or processor involve regular and systematic monitoring of individuals on a large scale, or where core activities involve large-scale processing of special-category data or personal data relating to criminal convictions and offences.

The DPO advises the organisation, monitors compliance, provides information and advice concerning data protection impact assessments, cooperates with the supervisory authority, and acts as a contact point for that authority and data subjects.

The DPO must be involved properly and in a timely manner, have access to the resources necessary to perform the role, and operate independently. The controller or processor must not penalise the DPO for carrying out statutory duties. The DPO may perform other tasks, but these must not create a conflict of interests.

The appointment of a DPO does not transfer the controller’s legal responsibility to that officer.

8.2 Data Protection Impact Assessments

Article 35 requires a Data Protection Impact Assessment (DPIA) where a type of processing is likely to result in a high risk to the rights and freedoms of individuals.

A DPIA is particularly relevant to systematic and extensive evaluation based on automated processing, large-scale processing of special-category data, and systematic monitoring of publicly accessible areas on a large scale. Supervisory authorities also publish lists identifying types of processing that require or do not require an assessment.

A DPIA should describe the proposed processing, assess its necessity and proportionality, identify risks to individuals, and set out measures designed to address those risks.

If the assessment indicates that processing would result in a high risk in the absence of measures taken by the controller to mitigate that risk, Article 36 requires prior consultation with the supervisory authority.

The assessment is not a general permission to process data. It is a structured risk-management obligation that helps determine whether the proposed operation can lawfully and safely proceed.

9. Security, Personal Data Breaches, and Notification

Articles 32–34 establish security and breach-response obligations.

A personal data breach is a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. It may involve cyberattacks, stolen devices, misdirected emails, accidental publication, unauthorised staff access, or the loss of unencrypted records.

Under Article 33, a controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where notification is made later, reasons for the delay must be provided.

The notification should describe the nature of the breach, the categories and approximate numbers of individuals and records affected where possible, the likely consequences, and the measures taken or proposed to address it.

A processor must notify the controller without undue delay after becoming aware of a breach. The processor does not replace the controller as the party responsible for the Article 33 notification.

Article 34 requires communication to affected individuals where the breach is likely to result in a high risk to their rights and freedoms. The communication should explain the nature of the breach in clear language and provide information about the measures taken and recommended steps.

Not every security incident must be reported to the authority or communicated to individuals. The legal threshold depends on the risk. Nevertheless, controllers must document personal data breaches, including those not subject to notification, so that compliance can be demonstrated.

10. Individual Rights Under the GDPR

The rights of data subjects are central to the Regulation. They give individuals legal means to understand, challenge, correct, and in appropriate circumstances restrict the use of information relating to them.

10.1 Right to be informed

Articles 13 and 14 require controllers to provide information about processing. Where data are collected directly from the individual, the information is generally supplied at the time of collection. Where data are obtained from another source, the controller must provide the information within the period specified by Article 14, ordinarily within one month, subject to the Regulation’s exceptions.

The information includes the controller’s identity, purposes and legal basis, categories of data, recipients, retention period, relevant rights, and the right to complain to a supervisory authority. Where applicable, information must also be provided about international transfers and automated decision-making.

10.2 Right of access

Article 15 allows individuals to obtain confirmation as to whether their personal data are being processed and, where they are, access to the data and specified supplementary information.

The right includes information about processing purposes, categories of data, recipients, retention periods, sources of data not collected directly from the individual, and relevant rights.

The controller must provide a copy of the personal data undergoing processing. The right is not necessarily a right to obtain every internal document or the entire database in which the information appears. However, the copy must be sufficiently comprehensive to allow the individual to understand the processing and verify its lawfulness.

In Österreichische Datenschutzbehörde v CRIF (Case C-487/21), the Court of Justice clarified that the right to obtain a copy may require the reproduction of extracts from documents or entire documents where this is essential to make the personal data intelligible and enable effective exercise of the right.

10.3 Right to rectification

Article 16 gives individuals the right to obtain correction of inaccurate personal data and, taking account of the purposes of processing, completion of incomplete information.

The right is particularly relevant where inaccurate records affect employment, credit, insurance, public services, or legal proceedings. Controllers must consider the purpose for which the data are used and should not preserve an inaccurate record merely because it was accurate when originally collected.

10.4 Right to erasure: the right to be forgotten

Article 17 provides a right to erasure in specified circumstances. These include where personal data are no longer necessary for the purpose for which they were collected, consent is withdrawn and no other legal basis applies, the individual successfully objects to processing, the data have been unlawfully processed, or erasure is required to comply with a legal obligation.

The right is not absolute. Exceptions include freedom of expression and information, compliance with legal obligations, public-interest tasks, public health, qualifying archiving and research, and the establishment, exercise, or defence of legal claims.

The right to erasure must also be distinguished from a general right to remove every reference to an individual from the internet. The legal assessment depends on the nature of the information, the purpose of publication, the public interest, and the relevant exceptions.

10.5 Right to restriction of processing

Article 18 allows individuals to request restriction in specified situations. These include where the accuracy of the data is contested while the controller verifies it, where processing is unlawful but the individual opposes erasure, where the controller no longer needs the data but the individual requires them for legal claims, or where an objection is being assessed.

Restriction generally means that the data may be stored but cannot otherwise be processed, except in circumstances permitted by the Regulation.

10.6 Right to data portability

Article 20 provides the right to receive personal data in a structured, commonly used, and machine-readable format and, where technically feasible, to transmit them directly to another controller.

The right applies where processing is based on consent or contract and carried out by automated means. It does not generally apply to processing necessary for a public task or the exercise of official authority.

Data portability is intended to support individual control and competition by making it easier to move information between service providers. It does not require controllers to develop technically compatible systems in every circumstance or to disclose information concerning other individuals without appropriate safeguards.

10.7 Right to object

Article 21 permits individuals to object, on grounds relating to their particular situation, to processing based on public task or legitimate interests.

The controller must stop processing unless it demonstrates compelling legitimate grounds that override the individual’s interests, rights, and freedoms, or the processing is necessary for legal claims.

The right is stronger in the context of direct marketing. Where an individual objects to processing for direct marketing purposes, including related profiling, the data must no longer be processed for those purposes.

10.8 Rights concerning automated decision-making and profiling

Article 22 gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects concerning them or similarly significantly affects them.

The provision is subject to exceptions, including where the decision is necessary for entering into or performing a contract, authorised by Union or Member State law, or based on the individual’s explicit consent. Where certain exceptions apply, safeguards must be provided, including the right to obtain human intervention, express a point of view, and contest the decision.

Profiling is defined broadly in Article 4(4) and may involve automated evaluation of personal aspects such as performance at work, economic situation, health, preferences, interests, reliability, behaviour, or location.

Not every algorithmic recommendation or automated calculation falls within Article 22. The legal assessment depends on whether the decision is solely automated and whether it has the required legal or similarly significant effect. Nevertheless, profiling remains subject to the general GDPR principles and other applicable rights.

10.9 Exercising rights and response periods

Controllers must facilitate the exercise of data subject rights. Under Article 12, they generally must respond without undue delay and within one month of receiving a request. This period may be extended by up to two further months where necessary, taking account of the complexity and number of requests. The individual must be informed of the extension and the reasons for it within the initial one-month period.

Requests are generally free of charge. A reasonable fee or refusal may be permitted where requests are manifestly unfounded or excessive, particularly because of their repetitive character. The controller bears the burden of demonstrating that a request falls within these exceptions.

Where a controller does not act on a request, it must inform the individual of the reasons and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

11. Institutional Oversight: National Supervisory Authorities

11.1 Independent national authorities

The GDPR establishes a decentralised enforcement system. Article 51 requires each Member State to provide for one or more independent public authorities responsible for monitoring the application of the Regulation.

These supervisory authorities are commonly referred to as Data Protection Authorities (DPAs). Their independence is essential because data protection supervision must be effective even where the organisation under investigation is a public institution, a major commercial undertaking, or an entity exercising significant economic or political influence.

Under Article 52, supervisory authorities must act with complete independence when performing their tasks and exercising their powers. Their members must be free from external influence, and they must have the human, technical, and financial resources necessary to carry out their responsibilities.

The institutional arrangements differ between Member States. Some have a single national data protection authority, while others distribute particular responsibilities among more than one body, subject to the GDPR’s requirements.

11.2 Investigative and corrective powers

Article 58 gives supervisory authorities extensive powers.

Their investigative powers include requiring information, conducting data protection audits, reviewing certifications, obtaining access to personal data and processing premises, and investigating complaints.

Their corrective powers include issuing warnings and reprimands, ordering compliance with data subject requests, requiring controllers to bring processing into conformity with the Regulation, imposing temporary or definitive limitations or bans on processing, ordering rectification or erasure, suspending international data transfers, and imposing administrative fines.

Authorities may also issue authorisations and advisory opinions in circumstances specified by the GDPR.

The combination of investigative and corrective powers allows supervisory authorities to respond to both individual complaints and systemic failures. Their role is not limited to punishing unlawful conduct; they also supervise compliance and seek to prevent continuing violations.

11.3 Administrative fines

Article 83 provides for administrative fines that must be effective, proportionate, and dissuasive.

The maximum level depends on the nature of the infringement. Certain violations, including failures concerning basic processing principles, legal bases, data subject rights, and international transfers, may attract fines of up to €20 million or, in the case of an undertaking, up to 4% of its total worldwide annual turnover for the preceding financial year, whichever is higher.

Other categories of infringement may attract fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher.

These figures are statutory maximums, not automatic penalties. Authorities must consider the circumstances of the individual case, including the nature, gravity, and duration of the infringement; whether it was intentional or negligent; mitigation measures; the categories of data affected; cooperation with the authority; and previous infringements.

The concept of an undertaking is important when calculating turnover-based fines. The assessment may extend beyond the individual legal entity where the relevant organisation forms part of an economic undertaking under EU competition-law concepts.

11.4 Judicial review

Decisions of supervisory authorities are subject to judicial review. Article 78 guarantees the right to an effective judicial remedy against a legally binding decision of a supervisory authority.

Article 79 separately provides a right to an effective judicial remedy against a controller or processor where an individual considers that their rights under the GDPR have been infringed.

This ensures that regulatory discretion is not unlimited and that both individuals and regulated organisations have access to judicial protection.

12. The European Data Protection Board

The European Data Protection Board (EDPB) is an independent EU body established under Articles 68–76 GDPR. It replaced the Article 29 Working Party when the GDPR became applicable in 2018.

The EDPB consists of the head of one supervisory authority of each Member State, or their representatives, together with the European Data Protection Supervisor or the relevant representative. The European Commission participates without voting rights.

Its principal purpose is to ensure consistent application of the GDPR throughout the Union and to promote cooperation among national supervisory authorities.

The EDPB performs several important functions.

First, it issues guidelines, recommendations, and best practices on the interpretation of the GDPR. These materials address issues such as consent, transparency, data breaches, international transfers, profiling, and the rights of individuals.

Second, it adopts opinions in circumstances specified by the Regulation. These opinions support consistent decision-making by national authorities and advise the Commission on data protection matters.

Third, it adopts binding decisions under the consistency mechanism, particularly where supervisory authorities disagree in cross-border cases. These decisions are legally significant because they can determine the substance of a national authority’s final decision.

The EDPB is not a general European data protection inspectorate that independently investigates every organisation in the Union. Enforcement remains principally with national supervisory authorities, while the Board provides coordination, guidance, and dispute resolution.

Its structure reflects the GDPR’s institutional compromise: national authorities retain their enforcement responsibilities, but the Union has mechanisms to prevent materially inconsistent interpretations of common legislation.

13. The One-Stop-Shop and Cross-Border Enforcement

13.1 The lead supervisory authority

Where processing takes place across several Member States, the GDPR establishes the one-stop-shop mechanism under Articles 56 and 60.

The supervisory authority of the controller’s or processor’s main establishment, or single establishment in the Union, will generally act as the lead supervisory authority for the relevant cross-border processing.

The lead authority coordinates the investigation and cooperates with other supervisory authorities concerned by the processing. The system is intended to prevent an organisation from facing entirely separate and inconsistent regulatory procedures in every Member State where its services are used.

The one-stop-shop does not mean that individuals must always complain in the country where a company has its headquarters. Under Article 77, an individual may lodge a complaint with the supervisory authority of their habitual residence, place of work, or place of the alleged infringement. That authority will cooperate with the lead authority where the cross-border mechanism applies.

13.2 Cooperation and consistency

The lead authority must share relevant information and work with concerned supervisory authorities. Under Article 60, it submits a draft decision to the other authorities concerned, which may raise relevant and reasoned objections.

Where disagreement cannot be resolved, the matter may be referred to the EDPB under Article 65. The Board may adopt a binding decision designed to resolve the dispute and ensure consistent application of the GDPR.

The mechanism is important because digital services frequently operate across borders. A platform may be established in one Member State, process information across several countries, and affect individuals throughout the Union. Without coordination, the same processing operation could be assessed differently by different authorities.

13.3 Regulation (EU) 2025/2518: procedural reform

The original GDPR cooperation mechanism encountered practical difficulties, particularly in lengthy cross-border investigations and disputes concerning procedural requirements. The EU therefore adopted Regulation (EU) 2025/2518, laying down additional procedural rules for the enforcement of the GDPR.

The Regulation was adopted on 26 November 2025 and published in the Official Journal on 12 December 2025. It will apply from 2 April 2027. It does not replace the GDPR’s substantive rights and obligations; it supplements the procedural framework governing cross-border enforcement.

The reform seeks to harmonise the handling of complaints and investigations, clarify the rights of complainants and parties under investigation, improve cooperation between supervisory authorities, and establish more predictable procedures.

Its provisions address matters such as the admissibility of complaints, the involvement of complainants, the right of investigated parties to be heard, access to relevant procedural material, and the use of simplified cooperation procedures in suitable cases.

The Regulation also introduces procedural timelines. Under the framework, an investigation should generally be completed within 15 months, with a possible extension of 12 months for the most complex cases. A simplified cooperation procedure is intended to be completed within 12 months.

The significance of Regulation 2025/2518 is institutional rather than substantive. It seeks to make existing GDPR rights more effectively enforceable by reducing procedural fragmentation and delay in cases involving several national authorities.

14. The European Data Protection Supervisor

The European Data Protection Supervisor (EDPS) is the independent supervisory authority responsible for monitoring the processing of personal data by EU institutions, bodies, offices, and agencies.

Its legal framework is principally Regulation (EU) 2018/1725, which is the institutional counterpart to the GDPR. It establishes rules for the processing of personal data by EU bodies and provides rights and safeguards for individuals whose information is processed by them.

The EDPS supervises compliance, investigates complaints, conducts inquiries, advises EU institutions on legislative and administrative proposals, and may impose corrective measures within its statutory competence.

The distinction between the EDPS and the EDPB is fundamental:

• The EDPS supervises personal data processing by EU institutions and bodies under Regulation 2018/1725.
• The EDPB coordinates the consistent application of the GDPR and the Law Enforcement Directive by national supervisory authorities.

The EDPS also participates in the EDPB, but the two bodies are institutionally and legally distinct.

The EDPS therefore provides independent oversight of the Union’s own administration, while the EDPB supports consistency among the national authorities responsible for GDPR enforcement.

15. Data Protection in Law Enforcement and Criminal Justice

The GDPR does not govern every form of personal data processing by public authorities. Processing by competent authorities for the prevention, investigation, detection, or prosecution of criminal offences, or the execution of criminal penalties, falls principally under Directive (EU) 2016/680, commonly known as the Law Enforcement Directive.

The Directive establishes rules for processing by competent authorities acting for law-enforcement purposes. It provides principles of lawful processing, data minimisation, accuracy, storage limitation, security, and accountability, together with rights and safeguards for individuals.

It also regulates the processing of sensitive categories of information and transfers of personal data to third countries or international organisations for law-enforcement purposes.

The distinction is functional. A public authority does not automatically fall outside the GDPR merely because it is a police service, prosecutor’s office, or other public body. The applicable regime depends on the purpose and legal context of the particular processing operation.

For example, an authority processing employee information for ordinary human-resources administration may be subject to the GDPR, whereas processing evidence in a criminal investigation will generally fall within the Law Enforcement Directive.

The Directive must be implemented in national law and is enforced through national supervisory authorities with responsibilities under the law-enforcement framework.

16. International Transfers of Personal Data

The GDPR’s protection does not end when personal data leave the European Economic Area. Chapter V establishes conditions for transfers to third countries and international organisations.

16.1 Adequacy decisions

Under Article 45, the European Commission may determine that a third country, territory, specified sector, or international organisation ensures an adequate level of data protection.

Where an adequacy decision applies, personal data may generally be transferred without requiring additional transfer authorisation under Chapter V. The Commission must monitor developments and periodically review the continued adequacy of the protection.

An adequacy decision does not mean that the third country’s legal system must be identical to the GDPR. The assessment concerns whether the level of protection is essentially equivalent in the relevant circumstances.

16.2 Appropriate safeguards

Where no adequacy decision applies, transfers may take place through appropriate safeguards under Article 46.

These include standard contractual clauses adopted by the European Commission, binding corporate rules approved for transfers within corporate groups, and certain approved codes of conduct or certification mechanisms accompanied by binding commitments.

Standard contractual clauses do not automatically resolve every issue. The parties may need to assess the legal environment of the destination country and whether supplementary technical, contractual, or organisational measures are necessary to ensure effective protection.

16.3 Derogations

Article 49 provides limited derogations for specific situations, including explicit informed consent, certain contractual necessities, important reasons of public interest, legal claims, vital interests, and certain transfers from public registers.

These derogations are not intended to become routine substitutes for adequacy decisions or appropriate safeguards. Their use must be assessed in light of the specific conditions in Article 49.

16.4 The Schrems judgments

The Court of Justice has played a decisive role in defining the limits of international transfers.

In Schrems I (Case C-362/14), the Court invalidated the former EU–US Safe Harbour arrangement, finding that the framework did not provide adequate protection in light of the circumstances examined, including access by public authorities and the availability of effective remedies.

In Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18), commonly known as Schrems II, the Court invalidated the EU–US Privacy Shield adequacy decision. It upheld the validity of the Commission’s standard contractual clauses in principle, but emphasised that exporters and competent authorities must ensure that the protection required by EU law is maintained in practice.

The judgment established that contractual safeguards cannot simply be treated as formal documents. The legal environment of the destination country and the practical ability to protect transferred data must be assessed.

International data transfers therefore illustrate the GDPR’s broader constitutional purpose: protection should not disappear merely because information crosses a geographical border.

17. Compensation and Civil Liability

Article 82 gives individuals the right to receive compensation from a controller or processor for material or non-material damage resulting from an infringement of the GDPR.

The provision establishes a civil-liability mechanism alongside regulatory enforcement. An administrative fine is imposed in the public interest by a supervisory authority; compensation is intended to remedy damage suffered by an individual.

A claimant must establish an infringement, damage, and a causal link between them. The mere infringement of the GDPR does not automatically create a right to compensation where no damage has occurred.

In Österreichische Post (Case C-300/21), the Court of Justice held that a breach of the GDPR alone is insufficient to establish entitlement to compensation. However, EU law does not permit Member States to impose a national threshold requiring non-material damage to reach a particular level of seriousness. The damage must be real, but it need not exceed a minimum gravity threshold.

Article 82 also contains rules governing responsibility between controllers and processors. Where several parties are involved in the same processing operation and are responsible for damage, the Regulation provides for liability designed to ensure effective compensation, subject to rights of recourse between those responsible.

Compensation claims may be brought before the competent courts under Article 79 and the jurisdictional rules in Article 82. The GDPR therefore combines administrative supervision with private enforcement.

18. The GDPR and the Wider European Digital Regulatory Framework

The GDPR operates alongside a growing body of EU digital legislation. These instruments address different risks and should not be treated as interchangeable.

The ePrivacy Directive 2002/58/EC regulates particular aspects of privacy and electronic communications, including confidentiality of communications and rules governing certain forms of tracking and terminal-equipment access. It complements the GDPR in the electronic communications environment. The proposed ePrivacy Regulation has not replaced the existing Directive as a generally applicable instrument.

The Digital Services Act, Regulation (EU) 2022/2065, establishes obligations for intermediary services and online platforms, including transparency and safeguards concerning online content and platform practices. It does not displace the GDPR’s rules on personal data.

The Digital Markets Act, Regulation (EU) 2022/1925, imposes obligations on designated gatekeepers, including restrictions concerning certain combinations and uses of personal data. Its competition and market-fairness objectives complement data protection requirements.

The Data Governance Act, Regulation (EU) 2022/868, establishes a framework for certain forms of data sharing and reuse, including data intermediation services and the reuse of protected public-sector data. It does not create a general permission to process personal data contrary to the GDPR.

The Data Act, Regulation (EU) 2023/2854, addresses access to and use of data generated by connected products and related services. Where personal data are involved, the GDPR continues to apply.

The Artificial Intelligence Act, Regulation (EU) 2024/1689, establishes a risk-based framework for AI systems. It contains obligations relevant to transparency, data governance, and high-risk systems, but does not replace the GDPR. An AI system that processes personal data must still have a lawful basis and comply with the principles and rights established by data protection law.

The relationship between these instruments is cumulative. A platform, connected device, or AI system may be subject to several legal regimes at once. Compliance with one does not automatically establish compliance with the others.

19. The GDPR and Emerging Technological Challenges

The GDPR’s principles are technologically neutral, but their application becomes more difficult as data processing grows more complex.

Artificial intelligence raises questions about the source and lawfulness of training data, the use of sensitive information, the transparency of automated systems, and the ability of individuals to exercise their rights. A model’s technical complexity does not remove the obligations of a controller where personal data are processed.

Biometric technologies create particular concerns because facial images, fingerprints, voice patterns, and other biometric identifiers may be used to identify individuals. Where biometric data are processed for the purpose of uniquely identifying a natural person, the additional requirements of Article 9 apply.

Large-scale behavioural profiling may affect autonomy and equality, particularly where individuals are classified according to inferred preferences, economic circumstances, or perceived risks. The legality of such processing depends on the applicable legal basis, transparency, proportionality, and the rights available to the individuals concerned.

The growth of connected devices also challenges traditional assumptions about collection and control. Smart vehicles, wearable devices, household equipment, and industrial systems may generate continuous streams of information. Organisations must identify which information constitutes personal data, determine who acts as controller or processor, and establish appropriate limits on access, use, and retention.

The GDPR does not prohibit technological innovation. It requires innovation to operate within a framework that respects individual rights and makes responsibility traceable.

20. Enforcement, Institutional Cooperation, and the Effectiveness of Rights

The GDPR combines several enforcement routes.

An individual may submit a complaint to a supervisory authority under Article 77. The authority must inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy.

An individual may also bring proceedings against a controller or processor under Article 79. This remedy is distinct from the administrative complaint procedure and may be relevant where direct judicial protection is necessary.

Where damage has been suffered, Article 82 provides a compensation route. National courts determine the claim in accordance with EU law and applicable national procedural rules, subject to the principles of equivalence and effectiveness.

Supervisory authorities may conduct investigations and impose corrective measures or fines. The EDPB supports consistent enforcement in cross-border cases, while the EDPS supervises EU institutions under its separate legal framework.

The effectiveness of the system depends on more than the existence of formal rights. Individuals must be able to understand those rights, identify the organisation responsible for processing, obtain meaningful responses, and access effective remedies. Authorities must have sufficient resources and independence to investigate complex cases. Organisations must be able to demonstrate compliance rather than rely on general assurances.

The procedural reform introduced by Regulation 2025/2518 recognises that a right without timely enforcement may be ineffective in practice. Its application from April 2027 will be an important development in the operation of the cross-border system.

21. Key Takeaways

• The GDPR is the principal EU instrument governing the processing of personal data by public and private organisations. It has applied since 25 May 2018.
• Article 16 TFEU and Article 8 of the Charter establish the constitutional foundations of the right to personal data protection.
• The GDPR applies to a broad range of information relating to identified or identifiable natural persons, including online identifiers and certain forms of derived data.
• Its territorial scope can extend to organisations outside the EU that offer goods or services to individuals in the Union or monitor behaviour taking place within the Union.
• Article 5 establishes seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
• Article 6 provides six alternative legal bases for processing. Special-category data require an additional exception under Article 9.
• Controllers determine the purposes and means of processing, while processors act on behalf of controllers under appropriate contractual and legal safeguards.
• Data protection by design and by default, DPO appointments, impact assessments, and security obligations form part of organisational compliance.
• Individuals have rights to information, access, rectification, erasure, restriction, portability, objection, and safeguards concerning certain automated decisions.
• National supervisory authorities enforce the GDPR. The EDPB coordinates consistent application and resolves specified disputes, while the EDPS supervises EU institutions.
• The one-stop-shop mechanism coordinates cross-border enforcement. Regulation (EU) 2025/2518 will supplement its procedural rules from 2 April 2027.
• International transfers require an adequacy decision, appropriate safeguards, or a valid derogation under Chapter V.
• Article 82 provides compensation for material or non-material damage caused by an infringement, but infringement alone does not automatically establish a compensation claim.
• The GDPR operates alongside the ePrivacy framework, Digital Services Act, Digital Markets Act, Data Act, and AI Act; compliance with one instrument does not replace compliance with another.

22. Frequently Asked Questions

1. What is the GDPR and why was it adopted?

The General Data Protection Regulation is Regulation (EU) 2016/679. It establishes common rules for processing personal data, protects individuals’ rights, and supports the free movement of personal data within the EU. It replaced the earlier Data Protection Directive 95/46/EC and has applied since 25 May 2018.

2. Does the GDPR apply to companies outside the European Union?

Yes, in certain circumstances. Article 3 applies the Regulation to organisations outside the EU where they offer goods or services to individuals in the Union or monitor their behaviour within the Union. The location of servers or corporate headquarters is not decisive by itself.

3. What is the difference between privacy and data protection?

Privacy is a broad fundamental right protecting personal and family life, communications, and other private interests. Data protection is a distinct right governing the lawful processing of personal information. The two rights overlap but have different legal functions.

4. Is consent always required to process personal data?

No. Consent is one of six legal bases under Article 6. Processing may also be lawful where necessary for a contract, legal obligation, vital interests, a public task, or legitimate interests. Special-category data require an additional exception under Article 9.

5. What is the difference between a controller and a processor?

A controller determines the purposes and essential means of processing. A processor handles personal data on behalf of the controller and under its instructions. Both have obligations under the GDPR, but their respective responsibilities differ.

6. Can an individual demand the deletion of all personal information held by an organisation?

Not in every circumstance. Article 17 provides a right to erasure where specified conditions are met, but exceptions apply, including legal obligations, freedom of expression, public-interest tasks, certain research and archiving activities, and legal claims.

7. How long does an organisation have to respond to a data subject request?

The general deadline is one month. It may be extended by up to two further months where necessary because of complexity or the number of requests. The individual must be informed of an extension and its reasons within the initial month.

8. What happens when an organisation suffers a personal data breach?

The controller must assess the risk. Where the breach is likely to result in a risk to individuals’ rights and freedoms, the supervisory authority must generally be notified within 72 hours of the controller becoming aware of it. Where a high risk exists, affected individuals must also be informed, subject to the exceptions in Article 34.

9. What is the role of the European Data Protection Board?

The EDPB promotes consistent application of the GDPR, issues guidance and opinions, supports cooperation between national supervisory authorities, and adopts binding decisions in specified cross-border disputes.

10. Is the European Data Protection Supervisor the same as the EDPB?

No. The EDPS supervises personal data processing by EU institutions and bodies under Regulation 2018/1725. The EDPB coordinates national supervisory authorities in applying the GDPR and the Law Enforcement Directive.

11. Can a person claim compensation for a GDPR violation?

Yes, under Article 82, where the person has suffered material or non-material damage as a result of an infringement. The infringement alone is insufficient; damage and a causal connection must also be established.

12. Does the GDPR prohibit the use of artificial intelligence?

No. The GDPR does not prohibit AI systems as such. It requires personal data used by or processed through such systems to comply with data protection principles, legal-basis requirements, transparency obligations, and applicable individual rights. The AI Act adds a separate regulatory framework.

13. What is the one-stop-shop mechanism?

It is the GDPR’s system for coordinating cross-border enforcement. A lead supervisory authority generally handles the investigation in cooperation with other concerned national authorities. Disagreements may be referred to the EDPB for a binding decision.

14. When will the new cross-border enforcement procedures apply?

Regulation (EU) 2025/2518, which supplements the GDPR’s procedural enforcement framework, applies from 2 April 2027. It is intended to improve cooperation, procedural consistency, and the handling of cross-border complaints.

Conclusion

European data protection law represents one of the most significant attempts to establish a rights-based legal framework for the digital economy. Its importance extends beyond the confidentiality of personal information. It concerns the conditions under which individuals may be observed, classified, evaluated, and influenced by public and private organisations.

The GDPR establishes a comprehensive system in which lawful processing is linked to purpose, necessity, transparency, security, and accountability. Its individual rights give people mechanisms to understand and challenge the use of their information, while national supervisory authorities and European institutions provide independent oversight and enforcement.

The system is not without difficulties. Cross-border investigations can be complex, technological developments may outpace institutional capacity, and the practical exercise of individual rights can be challenging where processing is opaque or distributed among numerous organisations. The procedural reform under Regulation 2025/2518 is an attempt to address some of these enforcement weaknesses.

Ultimately, the GDPR expresses a fundamental proposition: personal data may have economic, administrative, and technological value, but individuals are not merely sources of data. Their rights remain relevant at every stage of collection, analysis, storage, transfer, and use. The legitimacy of the digital economy depends not only on its capacity to process information, but also on its ability to respect the people to whom that information relates.

Primary Legal Sources and Further Reading

Treaties and fundamental rights

• Article 16 TFEU – Protection of personal data
• Charter of Fundamental Rights of the European Union – Articles 7, 8 and 47
• European Convention on Human Rights – Article 8

Core data protection legislation

• Regulation (EU) 2016/679 – General Data Protection Regulation
• Directive (EU) 2016/680 – Law Enforcement Directive
• Regulation (EU) 2018/1725 – Data protection by EU institutions and bodies
• Regulation (EU) 2025/2518 – Additional procedural rules on GDPR enforcement

Related digital legislation

• Directive 2002/58/EC – Privacy and Electronic Communications
• Regulation (EU) 2022/2065 – Digital Services Act
• Regulation (EU) 2022/1925 – Digital Markets Act
• Regulation (EU) 2022/868 – Data Governance Act
• Regulation (EU) 2023/2854 – Data Act
• Regulation (EU) 2024/1689 – Artificial Intelligence Act

European institutions and guidance

• European Commission – Data Protection
• European Commission – Information for Individuals
• European Data Protection Board – Tasks and Duties
• European Data Protection Board – Cooperation and Enforcement
• European Data Protection Supervisor

Selected Court of Justice case law

• S. and Marper v United Kingdom, Applications Nos. 30562/04 and 30566/04, European Court of Human Rights, Grand Chamber, 4 December 2008.
• Breyer v Bundesrepublik Deutschland, Case C-582/14, EU:C:2016:779.
• Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems, Case C-311/18, EU:C:2020:559.
• Meta Platforms Inc. and Others v Bundeskartellamt, Case C-252/21, EU:C:2023:537.
• Österreichische Datenschutzbehörde v CRIF GmbH, Case C-487/21, EU:C:2023:369.
• UI v Österreichische Post AG, Case C-300/21, EU:C:2023:370.