Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
GDPR
Reglamento General de Protección de Datos (UE) 2016/679
El punto de referencia mundial de la legislación de privacidad: bases jurídicas, principios, derechos, responsabilidad proactiva, aviso de violaciones en un plazo de 72 horas, normas de transferencia y multas de hasta el 4 por ciento del volumen de negocios mundial.
The law in brief
The GDPR is the European Union's main data protection law. It sets the rules for collecting, using, sharing and keeping personal data about people in the EU, and it gives those people rights they can enforce. It reaches organizations inside the EU and many outside it.
Most of its duties fall on the controller, the organization that decides why and how personal data is used. Processors, which handle data on a controller's behalf, carry their own narrower duties and can be fined directly.
A quién se aplica
- Organizations established in the EU, for processing in the context of that establishment, wherever the processing itself happens.
- Organizations outside the EU that offer goods or services to people in the EU, paid or free, or monitor their behavior in the EU (Art. 3(2)). They usually need a representative in the EU (Art. 27).
- It covers personal data: any information about an identified or identifiable living person. Purely personal or household activity is outside it (Art. 2).
- Size is no exemption. The one relief for smaller organizations concerns records of processing, and it is narrow (see Records of processing below).
Where it reaches
An EU establishment brings its processing under the GDPR even when the servers, staff or vendors doing the work are outside the EU.
What it requires
A lawful basis for every use
Each purpose needs one of six bases: consent, contract, legal obligation, vital interests, public task or legitimate interests. Choose and record it before you start; it decides which rights apply later.
The principles, and proving you follow them
Use data fairly and openly, only for stated purposes, no more than you need, accurate, kept no longer than necessary and secure. You must be able to show compliance, not just achieve it.
Datos sensibles
Health, genetic and biometric data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and sex life or sexual orientation are off limits unless one of the specific conditions in Article 9(2) applies.
Tell people what you do
When you collect data, tell people who you are, why you use it, on what basis, who receives it, how long you keep it and what rights they have, in clear and plain language.
Answer rights requests within a month
Act on a request without undue delay and within one month. For complex or numerous requests you can extend by two more months, if you tell the person within the first month. Requests are free unless manifestly unfounded or excessive.
Processors under a written contract
Use only processors that give sufficient guarantees, and bind each one by contract: documented instructions, confidentiality, security, sub-processor approval, help with rights and breaches, deletion or return at the end, and audits.
Records of processing
Keep a written record of your processing: purposes, categories of people and data, recipients, transfers, retention and security measures. Organizations with fewer than 250 employees are exempt only when processing is occasional, unlikely to result in a risk and involves no sensitive or criminal-offense data, which is rare in practice.
Security appropriate to the risk
Put technical and organizational measures in place that match the risk, such as encryption or pseudonymization, resilience, the ability to restore access after an incident, and regular testing.
Report breaches to the authority within 72 hours
Notify the supervisory authority without undue delay, unless the breach is unlikely to result in a risk to people. A late notice must give reasons, and information can follow in phases. Processors must tell their controller without undue delay. Document every breach, notified or not.
Tell people about high-risk breaches
When a breach is likely to result in a high risk to people, tell them directly and without undue delay, in plain language, unless a listed exception applies, such as strong encryption.
Impact assessments before high-risk processing
Assess the impact before you start processing that is likely to be high risk. It is required in particular for automated decisions with legal or similar effects, large-scale sensitive or criminal-offense data, and large-scale monitoring of public areas.
A data protection officer, where required
Public authorities must appoint one, as must organizations whose core activities involve large-scale regular and systematic monitoring of people, or large-scale sensitive or criminal-offense data.
Transfers out of the EU
Personal data can leave the EU only on a recognized basis: an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a narrow derogation.
Derechos de las personas
People can ask a controller to:
- see their data and how it is used (access, Art. 15);
- correct it (Art. 16), or erase it in the cases the law sets out (Art. 17);
- restrict its use, for example while a dispute is resolved (Art. 18);
- receive it in a machine-readable format to take elsewhere, where processing is automated and based on consent or a contract (portability, Art. 20);
- object to processing, with an absolute right to stop direct marketing (Art. 21);
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects, subject to limited exceptions (Art. 22).
They can also complain to a supervisory authority (Art. 77) and claim compensation for material or non-material damage (Art. 82).
Enforcement and penalties
Dos niveles de multas. Hasta €10 millones o el 2% del volumen de negocio anual mundial, lo que sea mayor, por las obligaciones del responsable y del encargado del tratamiento, como la seguridad, los registros, las evaluaciones de impacto y la notificación de violaciones (art. 83(4)). Hasta €20 millones o el 4%, lo que sea mayor, por los principios, las bases jurídicas, los derechos de las personas y las normas sobre transferencias, y por desatender una orden de una autoridad (art. 83(5) y (6)). Las autoridades también pueden ordenar que cese el tratamiento (art. 58), y las personas pueden reclamar daños y perjuicios (art. 82).
The higher tier of fines
Up to €20 million or 4% of worldwide annual turnover, whichever is higher, for breaching the principles, legal bases, people's rights or transfer rules.
What's changing
Proposed, not law. The European Commission's Digital Omnibus proposal (COM(2025) 837, November 2025) would notify authorities only of breaches likely to result in a high risk, extend the deadline from 72 to 96 hours, and add a single EU reporting point. In late August 2026 it was still before the Parliament and Council. Keep your 72-hour process until it is adopted; Regulatory Watch will report the outcome.
What to do first
- Map your personal data: what you hold, why, where it goes and how long you keep it. The map becomes your record of processing.
- Give each purpose a lawful basis, and write it down.
- Rewrite your privacy notices so they match the map.
- Set up a rights-request process that verifies identity and answers within a month.
- Review processor contracts against Article 28(3) and close the gaps.
- Rehearse a breach: who decides, who notifies, and how you meet 72 hours.
- List every transfer out of the EU and the mechanism each one relies on.
- Run an impact assessment for anything high-risk, before it goes live.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novedades recientes
-
CEPD launches Privacy for Kids platform to educate children and families on data privacy
The initiative creates a Europe‑wide hub of educational resources to improve children’s digital privacy awareness. The European Data Protection Board, together with data protection authorities including France’s CNIL, has launched the “Privacy for Kids” platform. It offers videos, quizzes, comics, podcasts and games for children, parents, teachers and educators across Europe to help them understand and protect personal data online.
Effective: 4 November 2026.
Source: CNIL (France). GDPR in the regulations library.
-
EPIC urges EDPB to tighten draft guidelines on web scraping for AI training
The comments highlight significant privacy risks of web‑scraped data for AI, urging stricter guidance to protect individuals under the GDPR. EPIC submitted comments to the European Data Protection Board on its draft Guidelines addressing web scraping for generative AI. The organization argues that the practice is largely illegal under the GDPR, citing legitimate interest as the only possible legal basis and highlighting deficiencies in transparency and data minimisation. EPIC recommends a public registry for scraped data use and a default prohibition unless explicit permission is indicated.
Source: EPIC. GDPR in the regulations library.
-
noyb files five GDPR complaints against Scale AI’s Outlier platform for invasive tracking and biometric surveillance
The filings highlight potential GDPR violations by an AI training platform that surveils its freelance workforce, prompting EU data‑protection authorities to investigate. The privacy NGO noyb, together with partners, lodged five GDPR complaints in France, Italy, the Netherlands and Austria against US‑based Scale AI. The complaints allege illegal placement of trackers on workers’ devices without consent, excessive collection of personal data, and forced biometric verification. No response to access requests was provided, breaching GDPR rights.
Source: noyb and 1 more. GDPR in the regulations library.
-
AI Hallucination Goes to Court: Global Mapping of Emerging Legal Issues
The post shows how existing legal frameworks are being stretched to address the harms of AI‑generated misinformation, signalling emerging obligations for AI providers and users. A Future of Privacy Forum blog post maps 11 recent judicial and regulatory matters worldwide where AI‑generated false statements have become legally salient. The article highlights cases in China, Germany, Canada, the United States and the EU, showing how courts and regulators are applying existing doctrines such as defamation, unfair competition, misrepresentation and data‑protection accuracy to AI hallucinations.
Source: Future of Privacy Forum. GDPR in the regulations library.
-
noyb files GDPR complaints (C078, C097) over AI-generated inaccurate personal data
These complaints highlight how AI hallucinations challenge GDPR's accuracy and correction rights for individuals. The privacy NGO noyb has lodged two complaints (C078 and C097) with Data Protection Authorities alleging that ChatGPT generated false personal data, including an incorrect date of birth and a fabricated criminal narrative. The complaints argue that OpenAI cannot adequately correct or erase the inaccurate outputs, testing GDPR obligations on accuracy, rectification and erasure. The cases remain pending as of the publication date.
Case C078, C097.
Source: Future of Privacy Forum. GDPR in the regulations library.
-
German court grants preliminary injunction against Google for AI-generated search summary linking publishers to fraud
The ruling highlights that providers may be liable for inaccurate AI‑generated content presented as their own, shaping future AI governance and privacy obligations. The Munich I Regional Court issued a preliminary injunction in the Google AI Overview proceedings (26 O 869/26). The court found that the AI-generated search summary, which linked two publishers to fraud and other dubious practices, was treated as Google's own content. The decision emphasizes the provider’s responsibility for the authority created by AI‑generated statements.
Case 26 O 869/26.
Source: Future of Privacy Forum. GDPR in the regulations library.
-
EU Council approves amendment to GDPR allowing unrestricted AI data processing
The amendment could override fundamental privacy rights by permitting AI firms to use all personal data with minimal safeguards. EU Member States, through the Council, approved a change to the GDPR that would make processing personal data "in the context of AI" automatically lawful. The amendment (Article 88bis) would let AI companies use any personal data without consent, relying on a broad legitimate interest. The proposal still requires negotiation with the European Parliament before becoming law.
Effective: not stated.
Source: noyb and 1 more. GDPR in the regulations library.
-
EDPB adopts Guidelines 3/2025 on DSA‑GDPR interplay
The new EDPB guidance helps platforms align DSA duties with GDPR privacy requirements. On 17 September 2026 the European Data Protection Board adopted Guidelines 3/2025 addressing how the Digital Services Act interacts with the EU General Data Protection Regulation. The guidance clarifies the application of GDPR obligations for services covered by the DSA.
Effective: 17 September 2026.
Source: Hunton Privacy & Cybersecurity Law Blog. GDPR in the regulations library.
Fuentes
- Reglamento (UE) 2016/679 EUR-Lex · Texto oficial o regulador
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales