The Regulation
All 99 GDPR articles, explained.
The full text of the GDPR runs to 99 articles across 11 chapters. Here is every one in plain English — searchable, cross-linked, and connected to practical guidance and the latest enforcement.
Jump to a chapter
1. General Provisions2. Principles3. Rights of the Data Subject4. Controller and Processor5. Transfers to Third Countries6. Independent Supervisory Authorities7. Co-operation and Consistency8. Remedies, Liability and Sanctions9. Specific Processing Situations10. Delegated & Implementing Acts11. Final Provisions
Chapter 1 — General Provisions
Articles 1–4What the regulation is for, who and what it covers, and the definitions everything else depends on.
1Subject matter and objectivesSets out what the GDPR is for: protecting people's fundamental right to the protection of their personal data, while allowing personal data to flow freely within the EU.2Material scopeDefines what kinds of processing the GDPR applies to — broadly, the automated or structured processing of personal data — and the narrow activities it does not cover.3Territorial scopeThe GDPR's reach is extra-territorial. It applies to organisations established in the EU, and to those outside the EU that offer goods or services to, or monitor, people in the EU.4DefinitionsThe dictionary of the GDPR — defining 'personal data', 'processing', 'controller', 'processor', 'consent', 'pseudonymisation', 'profiling' and more. Almost every other article depends on these terms.
Chapter 2 — Principles
Articles 5–11The core principles of lawful processing — including lawful basis, consent and special-category data.
5Principles relating to processing of personal dataThe seven principles at the heart of the GDPR. Every processing activity must satisfy all of them, and you must be able to demonstrate that it does (accountability).6Lawfulness of processingYou need a lawful basis for every processing activity. There are six, and consent is only one of them — picking the right basis is a foundational compliance decision.7Conditions for consentWhere you rely on consent, it must be freely given, specific, informed and unambiguous — and as easy to withdraw as it was to give. Pre-ticked boxes and bundled consent do not count.8Conditions applicable to a child's consentFor online services offered directly to children, consent is only valid if the child is at least 16 — or a lower age set by the member state, but never below 13. Below that, a parent must consent.9Processing of special categories of personal dataSensitive data — health, race, religion, sexual orientation, biometrics, political opinions and more — is processing-prohibited by default, unless a specific exception (such as explicit consent) applies.10Processing of criminal-conviction dataData about criminal convictions and offences can only be processed under the control of an official authority or where authorised by law with appropriate safeguards.11Processing not requiring identificationIf your purposes do not require you to identify a person, you are not obliged to keep or acquire extra data just to comply — and some data-subject rights may not apply if you genuinely cannot identify them.
Chapter 3 — Rights of the Data Subject
Articles 12–23The enforceable rights every person has over their personal data, from access to erasure.
12Transparent information and modalitiesThe umbrella rule for exercising rights: information and communications must be concise, transparent, intelligible and in plain language — and you must respond, usually free of charge, within one month.13Information to be provided (data collected from the person)When you collect data directly from someone, you must tell them — at the time — who you are, why you are processing, your lawful basis, who receives the data, how long you keep it, and their rights. This is your privacy notice.14Information to be provided (data not obtained from the person)Where you obtain data about someone from a third party, you still owe them transparency information — generally within a month, and including where the data came from.15Right of access by the data subjectAnyone can ask whether you hold data about them and, if so, receive a copy plus information about how and why you process it. This is the Data Subject Access Request (DSAR).16Right to rectificationPeople can have inaccurate personal data about them corrected, and incomplete data completed, without undue delay.17Right to erasure ('right to be forgotten')In defined circumstances — data no longer needed, consent withdrawn, unlawful processing — people can have their data deleted. It is not absolute, and must be balanced against other interests such as free expression.18Right to restriction of processingPeople can require you to pause processing — for example while accuracy is checked or an objection is considered — so the data is stored but not otherwise used.19Notification obligationIf you rectify, erase or restrict data, you must tell each recipient you disclosed it to — unless that proves impossible or disproportionate.20Right to data portabilityWhere processing is based on consent or contract and is automated, people can receive the data they provided in a structured, commonly used, machine-readable format — and have it transmitted to another provider.21Right to objectPeople can object to processing based on legitimate interests or public task, and have an absolute right to object to direct marketing — at which point you must stop using their data for it.22Automated decision-making and profilingPeople have the right not to be subject to a decision based solely on automated processing — including profiling — that has legal or similarly significant effects, save in defined cases with safeguards.23RestrictionsMember states may restrict certain rights and obligations by law — for example for national security, defence or the prevention of crime — provided the restriction respects the essence of the rights and is necessary and proportionate.
Chapter 4 — Controller and Processor
Articles 24–43The duties of organisations that decide and carry out processing — security, breach, DPIAs and DPOs.
24Responsibility of the controllerThe controller must implement appropriate technical and organisational measures to ensure — and be able to demonstrate — that processing complies with the GDPR. This is accountability in practice.25Data protection by design and by defaultPrivacy must be built into systems from the outset and as the default setting — minimising data, limiting access and applying safeguards by design rather than as an afterthought.26Joint controllersWhere two or more controllers jointly decide the purposes and means, they must agree — transparently — who is responsible for which obligations, especially towards data subjects.27Representatives of controllers not established in the UnionNon-EU organisations caught by the GDPR generally must designate a representative in the EU as a contact point for individuals and regulators.28ProcessorWhenever a processor handles data on your behalf, a written contract with specific mandatory terms (a Data Processing Agreement) must be in place. Processors have direct obligations too.29Processing under the authority of controller or processorAnyone acting under a controller or processor may only process personal data on documented instructions — not on their own initiative.30Records of processing activitiesMost organisations must keep an internal record of their processing activities — the 'ROPA' — describing what data they process, why, who they share it with and how long they keep it.31Cooperation with the supervisory authorityControllers and processors must cooperate with their data-protection authority on request in the performance of its tasks.32Security of processingYou must implement appropriate technical and organisational security measures for the risk — potentially including encryption, pseudonymisation, resilience and regular testing.33Notification of a breach to the supervisory authorityA personal data breach likely to risk people's rights must be reported to the supervisory authority within 72 hours of becoming aware of it. All breaches must be documented internally.34Communication of a breach to the data subjectWhere a breach is likely to result in a high risk to individuals, you must also tell the affected people, in clear language and without undue delay.35Data protection impact assessment (DPIA)Before high-risk processing — large-scale monitoring, sensitive data, new technologies — you must run a DPIA to identify and mitigate the risks. AI deployments frequently trigger this.36Prior consultationIf a DPIA shows a high residual risk you cannot mitigate, you must consult your supervisory authority before going ahead.37Designation of the Data Protection OfficerYou must appoint a DPO if you are a public authority, carry out large-scale systematic monitoring, or process special-category data at large scale.38Position of the Data Protection OfficerThe DPO must be involved in all data-protection matters, given the resources to do the job, allowed to act independently, and report to the highest level of management.39Tasks of the Data Protection OfficerThe DPO informs and advises on obligations, monitors compliance, advises on DPIAs, and acts as contact point for the supervisory authority and data subjects.40Codes of conductEncourages associations and industry bodies to draw up approved codes of conduct that spell out how the GDPR applies to their sector — a practical way to demonstrate compliance.41Monitoring of approved codes of conductAn accredited body with the right expertise monitors compliance with an approved code of conduct, and can act against members that breach it.42CertificationProvides for approved data-protection certification mechanisms, seals and marks so organisations can visibly demonstrate that their processing meets the GDPR.43Certification bodiesSets the rules for accrediting the bodies that issue GDPR certifications, ensuring they are independent, competent and properly supervised.
Chapter 5 — Transfers to Third Countries
Articles 44–50The rules for moving personal data outside the EEA safely.
44General principle for transfersPersonal data may only leave the EEA if the conditions of Chapter 5 are met — the protection travelling with the GDPR must not be undermined by sending data abroad.45Transfers on the basis of an adequacy decisionThe Commission can decide that a country (or framework, like the EU–US Data Privacy Framework) offers adequate protection, allowing free transfers there without extra safeguards.46Transfers subject to appropriate safeguardsWithout adequacy, transfers need appropriate safeguards — most commonly Standard Contractual Clauses (SCCs) or Binding Corporate Rules — often plus a transfer impact assessment.47Binding corporate rulesMultinational groups can adopt approved internal rules (BCRs) to transfer data within the group across borders, once a supervisory authority signs them off.48Transfers not authorised by Union lawA foreign court or authority order to hand over data is not, by itself, a lawful basis to transfer — it must go through an international agreement such as mutual legal assistance.49Derogations for specific situationsIn the absence of adequacy or safeguards, narrow exceptions allow occasional transfers — for example explicit consent, contract necessity, or important public-interest grounds.50International cooperationCommits the EU and regulators to develop international cooperation mechanisms to protect personal data across borders.
Chapter 6 — Independent Supervisory Authorities
Articles 51–59The national regulators (DPAs) that enforce the GDPR, and their powers.
51Supervisory authorityRequires each member state to provide for one or more independent public authorities (DPAs) responsible for monitoring the application of the GDPR.52IndependenceEach supervisory authority must act with complete independence — free from external influence, and neither seeking nor taking instructions from anybody.53General conditions for the members of the supervisory authoritySets out how the members of a DPA are appointed, their qualifications and the terms on which they serve.54Rules on the establishment of the supervisory authorityRequires each member state to lay down, by law, the rules governing the establishment of its supervisory authority — its constitution, resources and staff.55CompetenceEach DPA is competent to perform its tasks and exercise its powers on its own member state's territory.56Competence of the lead supervisory authorityFor cross-border processing, the DPA of the controller's or processor's main establishment acts as the 'lead authority' — the basis of the one-stop-shop.57TasksLists the tasks of a DPA — from handling complaints and investigations to raising awareness, advising, and cooperating with other authorities.58Powers of the supervisory authoritySpells out the concrete powers of a DPA — to investigate, to order compliance, to limit or ban processing, and to impose fines.59Activity reportsEach supervisory authority must draw up an annual report on its activities, which is made public and sent to the EDPB, parliament and government.
Chapter 7 — Co-operation and Consistency
Articles 60–76How regulators work together across borders, and the European Data Protection Board.
60Cooperation between the lead and concerned authoritiesThe heart of the one-stop-shop: the lead authority must cooperate with the other 'concerned' authorities to reach a single, jointly-agreed decision on cross-border processing.61Mutual assistanceSupervisory authorities must help one another — sharing information and carrying out measures such as consultations, inspections and investigations across borders.62Joint operations of supervisory authoritiesDPAs may run joint investigations and enforcement operations, including in each other's territories, with staff from several authorities taking part.63Consistency mechanismEstablishes the consistency mechanism so the GDPR is applied uniformly across the EU, with the EDPB coordinating and, where needed, deciding.64Opinion of the BoardThe EDPB issues opinions on draft measures with EU-wide relevance — such as codes of conduct, standard clauses and certain lists — to keep practice consistent.65Dispute resolution by the BoardWhen authorities cannot agree on a cross-border case, the EDPB adopts a binding decision that resolves the dispute — a powerful backstop to the one-stop-shop.66Urgency procedureIn exceptional urgency, a DPA can immediately adopt provisional measures to protect people's rights, bypassing the usual consistency steps.67Exchange of informationThe Commission may specify how authorities and the Board exchange information electronically, in a standardised format.68European Data Protection BoardEstablishes the EDPB as an EU body with legal personality, made up of the head of each national DPA and the European Data Protection Supervisor.69IndependenceThe EDPB must act independently when performing its tasks and exercising its powers.70Tasks of the BoardLists the EDPB's tasks — issuing guidelines and opinions, advising the Commission, promoting cooperation and consistency, and encouraging codes and certification.71ReportsThe EDPB draws up an annual public report on the protection of individuals with regard to processing across the EU.72ProcedureThe EDPB takes decisions by a simple majority of its members, unless the GDPR provides otherwise, and adopts its own rules of procedure.73ChairThe EDPB elects a chair and two deputy chairs from among its members, for a five-year term.74Tasks of the ChairSets out the chair's duties — convening meetings, setting the agenda and ensuring the Board's tasks are carried out.75SecretariatThe European Data Protection Supervisor provides the EDPB's secretariat, which works solely under the instructions of the chair.76ConfidentialityThe EDPB's discussions are confidential where the Board considers it necessary, under its rules of procedure.
Chapter 8 — Remedies, Liability and Sanctions
Articles 77–84Complaints, compensation and the headline fines — up to €20m or 4% of global turnover.
77Right to lodge a complaint with a supervisory authorityAnyone can complain to a DPA — usually in their own country — if they believe their data has been processed in breach of the GDPR.78Right to an effective judicial remedy against a supervisory authorityA person or organisation can challenge a legally binding decision of a DPA — or its failure to act on a complaint — before the courts.79Right to an effective judicial remedy against a controller or processorData subjects can bring court proceedings directly against a controller or processor they believe has infringed their GDPR rights.80Representation of data subjectsPeople can mandate a not-for-profit body to lodge complaints and bring proceedings on their behalf — opening the door to collective redress.81Suspension of proceedingsWhere the same cross-border matter is before courts in more than one member state, later courts may suspend their proceedings to avoid conflicting judgments.82Right to compensation and liabilityAnyone who suffers material or non-material damage from a GDPR breach has the right to compensation from the controller or processor responsible.83General conditions for imposing administrative finesThe headline enforcement tool: fines up to €20 million or 4% of total worldwide annual turnover, whichever is higher, with a lower tier of €10m / 2% for other breaches.84PenaltiesMember states may lay down additional penalties — including criminal ones — for infringements not already covered by administrative fines.
Chapter 9 — Specific Processing Situations
Articles 85–91How the GDPR is balanced against free expression, employment, research and other contexts.
85Processing and freedom of expression and informationMember states must reconcile data protection with freedom of expression — including journalistic, academic, artistic and literary processing, which gets special exemptions.86Processing and public access to official documentsPersonal data in official documents held by a public body may be disclosed to reconcile public access to documents with the right to data protection.87Processing of the national identification numberMember states may set specific conditions for processing national identification numbers, which must be used only with appropriate safeguards.88Processing in the context of employmentMember states (or collective agreements) may lay down more specific rules for processing employees' personal data — recruitment, management, monitoring and termination.89Safeguards for archiving, research and statisticsProcessing for archiving in the public interest, or scientific, historical or statistical purposes, is allowed with safeguards such as data minimisation and pseudonymisation.90Obligations of secrecyMember states may set rules on DPAs' powers where controllers or processors are subject to professional secrecy obligations, such as lawyers or doctors.91Existing data protection rules of churches and religious associationsChurches and religious associations that already applied comprehensive data-protection rules may keep them, provided they are brought into line with the GDPR and supervised.
Chapter 10 — Delegated & Implementing Acts
Articles 92–93How the Commission may adopt further detailed rules.
Chapter 11 — Final Provisions
Articles 94–99Repeal of the old directive, review, and entry into force.
94Repeal of Directive 95/46/ECRepeals the old 1995 Data Protection Directive that the GDPR replaced, with references to it read as references to the GDPR.95Relationship with Directive 2002/58/ECThe GDPR does not impose extra obligations where the ePrivacy Directive (2002/58/EC) already sets specific rules for the same processing in electronic communications.96Relationship with previously concluded AgreementsInternational agreements involving transfers of personal data concluded before 24 May 2016 remain in force until amended, replaced or revoked.97Commission reportsRequires the European Commission to evaluate and report on the GDPR periodically — the basis of the ongoing GDPR review.98Review of other Union legal acts on data protectionDirects the Commission to review and, if appropriate, propose amendments to other EU legal acts on data protection to ensure consistency with the GDPR.99Entry into force and applicationThe GDPR entered into force in 2016 and applied from 25 May 2018 — the date it became directly enforceable across the EU after a two-year grace period.
These summaries are a plain-English orientation only and are not a substitute for the official text of the Regulation or for legal advice.
From the text to your business
Reading the article is the first step. Our team applies it to your data, your contracts and your risk.