GDPR

General Data Protection Regulation (EU) 2016/679

In force privacy consumer rights transfers breach notification

WhenIn effect since 25 May 2018

Who enforces itNational data protection authorities, coordinated by the European Data Protection Board

Who it applies toOrganizations established in the EU, and organizations outside it that offer goods or services to people in the EU or monitor their behavior.

Tell the regulatorNotify the supervisory authority without undue delay and, where feasible, within 72 hours of b… DPO requiredDPO required for public bodies, large-scale systematic monitoring, or large-scale special-cate… RegistrationNo general registration Transfers abroadTransfers outside the EEA need an adequacy decision or appropriate safeguards (SCCs, BCRs), or… Request deadlineRespond within one month, extendable by two further months for complex or numerous requests Maximum fineUp to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher

Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →

Reach and lawful basis

Reach abroad

Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.Art. 3(2) · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex.

Lawful basis

Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.Art. 6(1) · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex.

Consent

Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.Art. 4(11), Art. 7(1) · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex.

Sensitive data

Special categories (health, biometrics, religion, etc.) are prohibited unless explicit consent or another listed exception applies.Art. 9(1)-(2) · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex. Member States may add conditions under Art. 9(4).

Children

Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.Art. 8(1) · secondary source · source ↗ Text read on gdpr-text.com, a mirror of the EUR-Lex official text (https://eur-lex.europa.eu/eli/reg/2016/679/oj). National thresholds vary between 13 and 16.

People's rights

Rights

Access, rectification, erasure, restriction, portability, objection and rights on solely automated decisions.Arts. 15-22 · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex.

Request deadline

Respond within one month, extendable by two further months for complex or numerous requests.Art. 12(3) · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex.

Marketing

Absolute right to object to direct marketing; prior consent required for electronic marketing under the ePrivacy Directive, with a customer soft opt-in.Art. 21(2)-(3); ePrivacy Directive 2002/58/EC Art. 13 · secondary source · source ↗ ePrivacy Art. 13 is a separate directive implemented nationally; not fetched this session.

Governance

DPO required

DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.Art. 37(1) · secondary source · source ↗ Text read on gdpr-text.com, a mirror of the EUR-Lex official text (https://eur-lex.europa.eu/eli/reg/2016/679/oj). Some Member States (e.g. Germany) extend the duty.

DPO qualifications

DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.Art. 37(5) · secondary source · source ↗ Text read on gdpr-text.com, a mirror of the EUR-Lex official text (https://eur-lex.europa.eu/eli/reg/2016/679/oj).

Registration

No general registration; controllers communicate DPO contact details to the supervisory authority.Art. 37(7) · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex.

DPIA

DPIA required before processing likely to result in high risk; prior consultation if residual high risk remains.Art. 35(1), Art. 36(1) · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex.

Records

Controllers and processors keep records of processing; limited exemption for organizations under 250 employees doing occasional, low-risk processing.Art. 30(1), (5) · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex.

Retention

Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.Art. 5(1)(e), Art. 17(1)(a) · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex.

Breaches

Tell the regulator

Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.Art. 33(1) · secondary source · source ↗ Text read on gdpr-text.com, a mirror of the EUR-Lex official text (https://eur-lex.europa.eu/eli/reg/2016/679/oj). Commission Digital Omnibus proposal (Nov 2025) would raise threshold to high risk and 96 hours; not adopted as of as_of date.

Tell people

Notify affected individuals without undue delay when the breach is likely to result in high risk.Art. 34(1) · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex.

Transfers

Transfers abroad

Transfers outside the EEA need an adequacy decision or appropriate safeguards (SCCs, BCRs), or a listed derogation.Arts. 44-49 · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex. BCRs require supervisory authority approval (Art. 47).

Localization

–

Not addressedN/A · secondary source · source ↗ GDPR has no data localization requirement; free flow within the EU.

Enforcement

Maximum fine

Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher.Art. 83(5) · secondary source · source ↗ Text read on gdpr-text.com, a mirror of the EUR-Lex official text (https://eur-lex.europa.eu/eli/reg/2016/679/oj).

Criminal liability

Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.Art. 84 · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex. Criminal exposure depends on national law.

Private action

Right to compensation for material or non-material damage; representative bodies may bring claims, including collective redress.Art. 79, Art. 80, Art. 82 · secondary source · source ↗ Article content not fetched this session; cited from the GDPR text, mirror of EUR-Lex. Collective redress also via Representative Actions Directive (EU) 2020/1828.

Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the map Follow Regulatory Watch

In force
Coming into force
Sector laws

AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL