eu
European Union
GDPR remains the benchmark comprehensive privacy regime across the European Union.
Editorial caveat
Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.
high confidence, Flagship benchmark jurisdiction with mature structured coverage. Continue maintaining transfer and enforcement nuance.
At a glance
Key presentation points
A compact summary of high-signal fields before the full structured record.
Structured record
Regulation details grouped by topic
Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.
Identity
- Effective status
- in-forceSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Law status
- activeSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Effective date
- 2018-05-25Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Last amended
- 2023-05-11Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
Scope
- Extraterritorial application
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Territorial scope
- Applies across EU member states and to controllers/processors targeting individuals in the EU.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Private sector coverage
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Public sector coverage
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
Definitions
- Personal data definition
- Any information relating to an identified or identifiable natural person.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Sensitive data recognized
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
Legal Basis
- Legal bases
- consent, contract, legal obligation, vital interests, public task, legitimate interestsSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Requires legal basis
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
Rights
- Right of access
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Right to deletion
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Right to object
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Right to portability
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Right to appeal
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Right to erasure or delete summary
- Erasure right with exceptionsSupport: 1 primary • Reviewed 17/04/2026Sources: EUR-Lex consolidated GDPR text (primary)Note: GDPR provides a formal right to erasure rather than a narrower deletion framing.
- Right to rectification or correction summary
- Rectification rightSupport: 1 primary • Reviewed 17/04/2026Sources: EUR-Lex consolidated GDPR text (primary)Note: GDPR uses the language of rectification rather than correction.
Breach
- Breach deadline (hours)
- 72Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Breach notification required
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
Governance
- DPO required
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Impact assessment required
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Records of processing required
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
Enforcement
- Maximum fine
- Up to €20 million or 4% of worldwide annual turnover.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Private right of action
- NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Regulator or enforcement authority summary
- Member State supervisory authorities and EDPBSupport: 1 primary • Reviewed 17/04/2026Sources: EUR-Lex consolidated GDPR text (primary)Note: EU enforcement is distributed across national supervisory authorities within the GDPR cooperation framework.
Transfers
- Cross-border transfer restricted
- YesSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
- Data localization required
- NoSupport: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
Marketing
- Cookie consent rule
- Consent is generally required for non-essential cookies under ePrivacy rules.Support: 1 primary + 1 secondary • Reviewed 15/04/2026Sources: EUR-Lex consolidated GDPR text (primary); European Data Protection Board guidance hub (secondary)Note: Starter MVP editorial summary based on official source set.
Official sources
- EUR-Lex consolidated GDPR textPrimary official law • en • html
- European Data Protection Board guidance hubSecondary official material • en • html