PrivacyEurope & UK

GDPR

Make privacy accountability easier to demonstrate

Connect privacy work, security evidence and vendor reviews so your teams can explain what has been done and what remains open.

Full title
Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)
Issued by
European Parliament and Council of the European Union
In force
Adopted 27 April 2016. Applies from 25 May 2018.
Applies to
Controllers and processors established in the EU, and those outside the EU that offer goods or services to, or monitor the behaviour of, people in the EU
Nature
An EU regulation, directly applicable in every Member State and enforced by national supervisory authorities
Structure
11 chapters and 99 articles, read with 173 recitals

Overview

What GDPR is

The General Data Protection Regulation sets the rules for processing personal data in the European Union. It applies directly in every Member State, without national transposition, although it leaves room for national law on some matters, such as the age of consent for online services and processing for employment purposes. Each Member State has an independent supervisory authority, and the European Data Protection Board (EDPB) issues guidelines and resolves disputes between authorities.

The regulation is built on seven principles in Article 5: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Accountability is the one that shapes most compliance work. The controller must be able to demonstrate compliance, which means keeping records of processing, documented lawful bases, assessments, contracts and security measures that can be shown when asked.

Every processing activity needs one of the six lawful bases in Article 6. Individuals have rights to information, access, rectification, erasure, restriction, portability and objection, and rights in relation to solely automated decisions. Requests must normally be answered within one month. Personal data breaches must be notified to the supervisory authority within 72 hours where feasible, unless the breach is unlikely to result in a risk to individuals.

GDPR has not been replaced. Regulation (EU) 2025/2518 adds procedural rules for how supervisory authorities handle cross-border complaints and investigations, and applies from 2 April 2027. It does not change the obligations of controllers and processors. Further amendments proposed by the European Commission in 2025 were still going through the legislative process in October 2026. Where AI systems process personal data, see also the EU AI Act.

Who it applies to

GDPR applies to the processing of personal data by controllers and processors that fall within its territorial scope (Article 3), including:

  • Organisations established in the EU, wherever the processing takes place
  • Organisations outside the EU that offer goods or services to people in the EU
  • Organisations outside the EU that monitor the behaviour of people in the EU, for example through tracking or profiling
  • Processors, such as cloud, SaaS and IT service providers, acting on behalf of a controller
  • Indian IT, BPO and technology companies processing personal data of EU customers or their end users
  • Public authorities and bodies in the EU

Purely personal or household activity is outside scope, as is processing by competent authorities for law enforcement, which is covered by Directive (EU) 2016/680. A controller or processor outside the EU that falls under Article 3(2) must usually appoint a representative in the EU (Article 27).

Structure

How the regulation is organised

99 articles in 11 chapters. Chapters II to V carry the obligations that organisations work to. Chapters VI to VIII set out supervision, cooperation between authorities, remedies and fines.

Chapters I and II

Scope and principles (Articles 1 to 11)

Subject matter, scope and definitions (Articles 1 to 4)
Material and territorial scope, and definitions of personal data, processing, controller, processor, consent, personal data breach and other terms.
Principles (Article 5)
The seven principles, including accountability: the controller is responsible for compliance and must be able to demonstrate it.
Lawfulness of processing (Article 6)
Six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests.
Consent and children (Articles 7 and 8)
Conditions for valid consent, including the right to withdraw it, and parental consent for information society services offered to children.
Special categories and criminal data (Articles 9 and 10)
Processing of health, biometric, genetic and other special category data is prohibited unless an Article 9 condition applies. Criminal convictions data needs a basis in law.
Processing without identification (Article 11)
A controller need not obtain extra information only to identify a person for the purpose of complying with the regulation.
Chapter III

Rights of the data subject (Articles 12 to 23)

Transparency and modalities (Article 12)
Clear communication, and a response to requests without undue delay and within one month, extendable by two further months where necessary.
Information to be provided (Articles 13 and 14)
What individuals must be told when data is collected from them or obtained from elsewhere.
Access, rectification and erasure (Articles 15 to 17)
The right of access to one’s data, to have it corrected, and to have it erased in defined circumstances.
Restriction, notification and portability (Articles 18 to 20)
The right to restrict processing, the duty to tell recipients of corrections and erasures, and the right to receive data in a portable format.
Objection and automated decisions (Articles 21 and 22)
The right to object, including to direct marketing, and rights in relation to decisions based solely on automated processing that have legal or similarly significant effects.
Restrictions (Article 23)
Limits that Union or Member State law may place on the rights, for objectives such as national security or the prevention of crime.
Chapter IV

Controller and processor (Articles 24 to 43)

General obligations (Articles 24 to 31)
Controller responsibility, data protection by design and by default, joint controllers, EU representatives, processor contracts, records of processing activities (Article 30) and cooperation with the supervisory authority.
Security of personal data (Articles 32 to 34)
Appropriate technical and organisational security measures, notification of breaches to the supervisory authority, and communication of high-risk breaches to individuals.
DPIA and prior consultation (Articles 35 and 36)
A data protection impact assessment for processing likely to result in a high risk, and consultation with the authority where the risk cannot be sufficiently reduced.
Data protection officer (Articles 37 to 39)
When a DPO must be designated, the DPO’s independence and position, and the DPO’s tasks.
Codes of conduct and certification (Articles 40 to 43)
Approved codes of conduct, their monitoring, and data protection certification mechanisms, seals and certification bodies.
Chapter V

Transfers to third countries (Articles 44 to 50)

Adequacy decisions (Article 45)
Transfers to a country the Commission has found to provide an adequate level of protection need no further authorisation.
Appropriate safeguards (Articles 46 and 47)
Standard contractual clauses, binding corporate rules and other safeguards, with enforceable rights and effective remedies for individuals.
Third-country orders and derogations (Articles 48 and 49)
Limits on transfers ordered by foreign courts or authorities, and narrow derogations for specific situations.
International cooperation (Article 50)
Cooperation mechanisms between the Commission, supervisory authorities and third countries.
Chapters VI and VII

Supervision and cooperation (Articles 51 to 76)

Independent supervisory authorities (Articles 51 to 59)
Each Member State’s authority, its independence, competence, tasks and powers. For cross-border processing, a lead supervisory authority is identified by the main establishment (Article 56).
Cooperation and consistency (Articles 60 to 67)
The one-stop-shop cooperation procedure, mutual assistance, joint operations, the consistency mechanism and urgency procedure.
European Data Protection Board (Articles 68 to 76)
The EDPB, its independence and tasks, including guidelines, opinions and binding decisions in disputes between authorities.
Chapter VIII

Remedies, liability and penalties (Articles 77 to 84)

Complaints and judicial remedies (Articles 77 to 81)
The right to lodge a complaint, and to an effective judicial remedy against an authority, a controller or a processor, including through representative bodies.
Compensation (Article 82)
The right to compensation for material or non-material damage, and how liability is shared between controllers and processors.
Administrative fines (Article 83)
Up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher, for breaches such as controller and processor obligations; up to EUR 20 million or 4% for breaches of the principles, lawful bases, data subject rights and transfer rules.
Penalties (Article 84)
Member States set other penalties, in particular for infringements not subject to administrative fines.
Chapters IX to XI

Specific situations and final provisions (Articles 85 to 99)

Specific processing situations (Articles 85 to 91)
Freedom of expression, public access to documents, national identification numbers, employment, archiving and research, obligations of secrecy, and churches and religious associations.
Delegated and implementing acts (Articles 92 and 93)
The Commission’s powers to adopt delegated and implementing acts.
Final provisions (Articles 94 to 99)
Repeal of Directive 95/46/EC, the relationship with other EU law including the ePrivacy Directive, Commission reviews, entry into force and application.

Implementation roadmap

How to implement it, step by step

A practical sequence for building and maintaining a GDPR programme that can be demonstrated.

  1. 1

    Confirm scope and roles

    Establish whether GDPR applies under Article 3, and for each processing activity whether you act as controller, joint controller or processor. Decide whether an EU representative or a DPO is required.

    OutputsScope assessmentRole decisionsDPO and representative decisions
  2. 2

    Map processing and build the Article 30 record

    Identify what personal data is processed, for what purposes, where it is held, who receives it and how long it is kept.

    OutputsRecords of processing activitiesData inventory
  3. 3

    Document lawful bases and notices

    Record the lawful basis for each purpose, with legitimate interest assessments and consent records where relevant, and update privacy notices to match.

    OutputsLawful basis registerPrivacy notices
  4. 4

    Assess high-risk processing

    Screen new and changed processing for high risk and carry out DPIAs where required, consulting the supervisory authority where the residual risk remains high.

    OutputsDPIA screeningDPIAs
  5. 5

    Put security and breach handling in place

    Apply Article 32 measures appropriate to the risk and set up a breach procedure that can assess and notify within 72 hours.

    OutputsSecurity measuresBreach procedure and register
  6. 6

    Govern processors and transfers

    Put Article 28 terms in every processor contract, review processors before and during the relationship, and document the mechanism for each transfer outside the EEA.

    OutputsProcessor agreementsVendor reviewsTransfer records
  7. 7

    Operate individual rights

    Set up a route to receive, verify, track and answer requests within the one-month deadline, and keep a record of each response.

    OutputsRights request logResponse templates
  8. 8

    Train, review and improve

    Train staff, review records and policies on a schedule, and audit the programme so that gaps are found and closed before an authority asks.

    OutputsTraining recordsInternal audit reports

Audit and evidence guide

What auditors look for, and the evidence to keep

There is no general GDPR certificate. Compliance is tested when a supervisory authority investigates, usually after a complaint or a breach notification, and through internal audits, customer due diligence and approved certification schemes where an organisation chooses to use them.

What reviewers look for

  • A complete and current Article 30 record of processing activities
  • A documented lawful basis for each purpose, including legitimate interest assessments
  • Privacy notices that match what actually happens to the data
  • DPIAs for high-risk processing, completed before the processing starts
  • Rights requests answered within the one-month deadline, with records
  • Breach records, including breaches that were not notified and the reasons why
  • Processor contracts with Article 28 terms, and evidence of processor oversight
  • Transfer mechanisms for each transfer outside the EEA
  • Security measures appropriate to the risk, with evidence they operate
  • DPO designation, independence and involvement where a DPO is required

Key timelines

Response to a data subject request1 month, +2 if needed
Breach notification to the supervisory authorityWithin 72 hours if feasible
Breach communication to individuals where high riskWithout undue delay
Processor notifying the controller of a breachWithout undue delay
DPIABefore high-risk processing
Procedural Regulation 2025/2518Applies from 2 April 2027

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Accountability

  • Data protection policy
  • Records of processing activities
  • DPO designation and reports
  • Training records

Lawfulness and transparency

  • Lawful basis register
  • Legitimate interest assessments
  • Consent records
  • Privacy notices with version history

Risk

  • DPIA screening and DPIAs
  • Prior consultation records, where needed
  • Data protection by design reviews

Individual rights

  • Request log with dates
  • Identity verification records
  • Responses and extensions issued

Security and breaches

  • Article 32 security measures
  • Breach register
  • Notifications to the authority and individuals

Processors and transfers

  • Processor agreements
  • Processor due diligence
  • Standard contractual clauses and transfer assessments

Areas that often need attention

  • A record of processing that was built once and never updated
  • Legitimate interests relied on without a recorded balancing test
  • Privacy notices that do not match actual processing or retention
  • Rights requests missed or answered late because there is no tracked route
  • Breaches assessed informally, with no record of why they were not notified
  • Processor contracts without the Article 28 terms
  • Transfers outside the EEA without a documented mechanism
  • DPIAs written after the processing has already started

How Netra helps

Where each part of the work lives in Netra

Netra loads GDPR as requirements, tasks and policies, so accountability work is owned, scheduled and recorded with its evidence.

Accountability work owned and scheduled

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks keep the record of processing, reviews and training current.

Status against each chapter and article

Compliance Centre

Status is derived from completed tasks and evidence, never typed in. Work done for ISO 27001 or ISO 27701 security controls counts here too where the same control applies.

Data protection policies and notices

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

Risks to individuals and DPIA outcomes

Risk Manager

A risk register with inherent and residual heatmaps. Risks come down as the linked treating tasks are completed.

Processor oversight

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

Systems that hold personal data

Asset Management

Assets are linked to the tasks and controls that protect them.

Internal privacy audits

Audit Centre

Run internal audits end to end, with findings and corrective actions, using evidence held in a tamper-evident vault.

Drafting and evidence gaps

Netra AI

Works from the organisation’s own records to suggest missing evidence and draft procedures. It never changes status on its own.

Netra organises privacy work and evidence. It does not by itself establish GDPR compliance, decide lawful bases or give legal advice, and it does not notify supervisory authorities or individuals on your behalf. Legal assessments and decisions remain with the organisation and its DPO or advisers.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Privacy

ISO 27701:2019

Keep your privacy programme traceable through change

Privacy

CCPA

Keep California privacy obligations organised

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

See GDPR in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.