General Data Protection Regulation (GDPR)
Regulation (EU) 2016/679. Applicable since 25 May 2018. The reference model for personal-data law, and the yardstick China's PIPL is usually compared against.
In one line
A regulation built on rights: it sets principles for processing, a closed list of lawful bases, a strong rights catalogue, heavy fines, and a dedicated cross-border transfer chapter.
Who and what it governs
- Article 3 (territorial scope) — applies to processing in the EU, and to controllers or processors outside the EU where they offer goods or services to people in the EU or monitor their behaviour.
- Covers personal data of individuals in the EU, regardless of nationality.
Key provisions
| Topic | Provision |
|---|---|
| Principles | Article 5 — lawfulness, fairness, transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. |
| Lawful bases | Article 6 — consent; contract; legal obligation; vital interests; public task; legitimate interests (with a balancing test and a right to object). |
| Special categories | Article 9 — racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic and biometric data for identification, health, sex life or sexual orientation. Processing is prohibited unless an exception applies. |
| Rights | Articles 12–22 — information, access, rectification, erasure, restriction, portability, objection, and rights on automated decision-making including profiling. |
| Breach notification | Articles 33–34 — notify the supervisory authority within 72 hours; notify individuals where the risk is high. |
| Impact assessment | Article 35 — DPIA for high-risk processing. |
| Data protection officer | Articles 37–39. |
| Cross-border transfers | Chapter V, Articles 44–49 — adequacy decision, appropriate safeguards (SCCs, BCRs), or derogations. |
| Penalties | Article 83 — two tiers: up to EUR 10 million or 2% of total worldwide annual turnover, and up to EUR 20 million or 4% for the most serious breaches. |
| Regulators | National supervisory authorities plus the European Data Protection Board. |
Relationship to other EU laws
- The AI Act layers AI-specific duties on top; the Data Act and Data Governance Act govern non-personal and mixed data; the ePrivacy Directive covers cookies and electronic communications.
Unverified / TODO
- Confirm the current text of the SCCs adopted under Article 46 [gap:not_located] — the SCCs are a Commission implementing decision, not part of this regulation's text
- Check the EU–US Data Privacy Framework's current status
- Note the interplay between GDPR and the AI Act's data-governance duties for high-risk systems
Source quotes
administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher— Article 83(4) — the lower band in the card's Penalties row (snapshot:snapshots/eu/gdpr.txt)administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher— Article 83(5) — the upper band (snapshot:snapshots/eu/gdpr.txt)It shall apply from 25 May 2018.— Article 99(2) — the date behind the card's applies field (snapshot:snapshots/eu/gdpr.txt)