### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued . ### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others . the law of the member state must also respect the essence of the right to the protection of personal data in this regulation and in international treaties to which the member state is party . finally the member state shall evaluate and decide if national legislation is proportionate to the legitimate aim pursued or if a legitimate aim could be achieved using less privacy invasive solutions .


### the commission may set out standard forms and procedures for prior authorisations and consultations referred to in paragraphs 1 and 2 , and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of setting out standard forms and procedures for prior consultations referred to in paragraph 2 , and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the methods to obtain verifiable consent referred to in paragraph 1 . in doing so , the commission shall consider specific measures for micro , small and medium - sized enterprises . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of laying down standard forms for specific methods to obtain verifiable consent referred to in paragraph 1 .


### associations and other bodies representing categories of controllers or processors in one member state which intend to draw up codes of conduct or to amend or extend existing codes of conduct may submit them to an opinion of the supervisory authority in that member state . the supervisory authority may give an opinion whether the draft code of conduct or the amendment is in compliance with this regulation . the supervisory authority shall seek the views of data subjects or their representatives on these drafts . ### associations and other bodies representing categories of controllers or processors in one member state which intend to draw up codes of conduct or to amend or extend existing codes of conduct may submit them to an opinion of the supervisory authority in that member state . the supervisory authority shall without undue delay give an opinion whether the draft code of conduct or the amendment is in compliance with this regulation . the supervisory authority shall seek the views of data subjects or their representatives on these drafts .


### processing of data concerning health is necessary for health purposes and subject to the conditions and safeguards referred to in article 81 ; or ### processing of personal data intended to reveal information concerning health is necessary for purposes of preventative or occupational medicine , medical diagnosis , the provision of care or treatment or the management of health - care services , where those data are processed by a health professional subject to the obligation of professional secrecy or another person also subject to an equivalent obligation of confidentiality under member state law or rules established by national competent bodies ; or


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller , in particular by reference to an identification number or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person . a natural person shall not be considered identifiable if identification requires a disproportionate amount of time , effort or material resources ;


### to monitor the performance of the data protection impact assessment by the controller or processor and the application for prior authorisation or prior consultation , if required pursuant articles 33 and 34 ; ### to monitor the performance of the data protection impact assessment by the controller or processor and the application for prior consultation , if required pursuant articles 33 and 34 ;


### adequate , relevant , and limited to the minimum necessary in relation to the purposes for which they are processed ; they shall only be processed if , and as long as , the purposes could not be fulfilled by processing information that does not involve personal data ; ### adequate , relevant , and not excessive in relation to the purposes for which they are processed ; they shall only be processed if , and as long as , the purposes could not be fulfilled by processing information that does not involve personal data ;


### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within one week after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within one month by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authority competent under article 51 of the opinion and make it public . ### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within two week after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within two month by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authorities competent under article 51 of the opinion and make it public .


### the data are not collected from the data subject and recording or disclosure is expressly laid down by law ; or ### the data are not collected from the data subject and obtaining or disclosure is expressly laid down by law to which the controller is subject , which provides appropriate measures to protect the data subject ' s legitimate interests , considering the risks represented by the processing and the nature of the personal data ; or


### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate . ### where the personal data are collected from the data subject , the direct controller shall , at the time when the data are collected or immediately thereafter , inform the data subject , in addition to the information referred to in paragraph 1 , whether the provision of personal data is obligatory or voluntary , as well as the possible consequences of failure to provide such data ; the direct controller shall , after the first communication pursuant to paragraph 3 , provide the information pursuant to paragraph 1 once a year , provided that changes have occurred in the information since it was last communicated .


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission . in implementing the provisions of this regulation , it should be ensured that no mandatory requirements for specific technical features are imposed on products and services , including terminal or other electronic communications equipment , which could impede the placing of equipment on the market and the free circulation of such equipment in and between member states . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises in consultation with the parties concerned , as these measures should not overly burden those enterprises .


### the commission may decide that a third country , or a territory or a processing sector within that third country , or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this article , in particular in cases where the relevant legislation , both general and sectoral , in force in the third country or international organisation , does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 , or , in cases of extreme urgency for individuals with respect to their right to personal data protection , in accordance with the procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 to decide that a third country , or a territory within that third country , or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this article , in particular in cases where the relevant legislation in force in the third country or international organisation , does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred .


### if the controller refuses to take action on the request of the data subject , the controller shall inform the data subject of the reasons for the refusal and on the possibilities of lodging a complaint to the supervisory authority and seeking a judicial remedy . ### if the controller does not take action on the request of the data subject , the data subject shall have the right to ask the controller for the reasons for the inaction and on the possibilities of lodging a complaint to the supervisory authority and seeking a judicial remedy .


### the controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function . the data protection officer shall directly report to the management of the controller or the processor . ### the data protection organisation or data protection officer shall perform his or her tasks independently and shall directly report to the executive management of the controller or the processor .


### processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation , association or any other non - profit - seeking body with a political , philosophical , religious or trade - union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that body without the consent of the data subjects ; or ### processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation , association , organizations on the labour market or any other non - profit - seeking body with a political , philosophical , religious or trade - union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that body without the consent of the data subjects ; or


### prior authorisation and prior consultation ### prior consultation


### instead of erasure , the controller shall restrict processing of personal data where : ### instead of erasure , the controller or processor shall restrict processing of personal data where :


### the purposes of the processing for which the personal data are intended , including the contract terms and general conditions where the processing is based on point of article 6 and the legitimate interests pursued by the controller where the processing is based on point of article 6 ; ### the purposes of the processing for which the personal data are intended ;


### the purposes of the processing for which the personal data are intended , including the contract terms and general conditions where the processing is based on point of article 6 and the legitimate interests pursued by the controller where the processing is based on point of article 6 ; ### the specific purposes of the processing for which the personal data are intended as well as information regarding the security of the processing of personal data , including the contract terms and general conditions where the processing is based on point of article 6 and the legitimate interests pursued by the controller where the processing is based on point of article 6 ;


### processing is necessary for the purposes of the legitimate interests pursued by a controller , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child . this shall not apply to processing carried out by public authorities in the performance of their tasks . ### processing is necessary for the purposes of the legitimate interests pursued by a controller or controllers or by a third party or parties to whom the data are disclosed , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child .


### is carried out in the course of the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or ### is necessary for the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied , or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or


### when the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay . ### when the personal data breach causes or is likely to cause significant adverse effect on the privacy of the data subject and minimizing of the harm requires action by data subjects , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay unless this is disproportionally difficult . when communication to data subjects would risk causing further serious harm to the protection of the personal data or privacy of the data subject , the controller may , after consulting with the supervisory authority , delay communication to data subjects until such risk no longer prevails .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### other public interests of the union or of a member state , in particular an important economic or financial interest of the union or of a member state , including monetary , budgetary and taxation matters and the protection of market stability and integrity ; ### an important economic or financial interest of the union or of a member state , including monetary , budgetary and taxation matters and the protection of market stability and integrity ;


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### without prejudice to this regulation , member states or collective agreement among employers and employees may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , criminal conviction , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship .


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission’s exercise of implementing powers46 . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission . in implementing the provisions of this regulation , it should be ensured that no mandatory requirements for specific technical features are imposed on products and services , including terminal or other electronic communications equipment , which could impede the placing of equipment on the market and the free circulation of such equipment in and between member states .


### measures based on profiling ### measures based on automated processing


### the controller shall inform the data subject without delay and , at the latest within one month of receipt of the request , whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . this period may be prolonged for a further month , if several data subjects exercise their rights and their cooperation is necessary to a reasonable extent to prevent an unnecessary and disproportionate effort on the part of the controller . the information shall be given in writing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the controller shall inform the data subject without excessive delay whether or not any action has been taken pursuant to article 13 and articles 15 to 19 and shall provide the requested information . the information shall be given in writing .


### the controller or the processor shall support the data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 . ### the controller or the processor shall support the data protection officer in performing the tasks by providing appropriate means to carry out the duties and tasks referred to in article 37 .


### implementing the data security requirements laid down in article 30 ; ### the existence of proper policies , instructions or other guidelines to direct the processing of data in a way that complies with this regulation , as well as procedures and enforcement to make such policies , instructions or guidelines effective ;


### the controller and the processor shall designate a data protection officer in any case where : the processing is carried out by a public authority or body ; or the processing is carried out by an enterprise employing 250 persons or more ; or the core activities of the controller or the processor consist of processing operations which , by virtue of their nature , their scope and / or their purposes , require regular and systematic monitoring of data subjects . ### member states shall encourage the designation of a data protection officer by the data controller and the data processor and may require such designation in some cases provided for in their national legislation .


### the communication of a personal data breach to the data subject shall not be required if the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible to any person who is not authorised to access it . ### the communication of a personal data breach to the data subject shall not be required if the data breach does not have significant risk of harm to citizens and the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible to any person who is not authorised to access it .


### each supervisory authority shall have the power : ### the competent supervisory authority shall have the power :


### act only on instructions from the controller , in particular , where the transfer of the personal data used is prohibited ; ### the processor shall act only on instructions from the controller , in particular , where the transfer of the personal data used is prohibited ;


### the communication of a personal data breach to the data subject shall not be required if the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible to any person who is not authorised to access it . ### the communication of a personal data breach to the data subject shall not be required if the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall have the purpose to render the data unintelligible to any person who is not authorised to access them , taking into account the nature of the data , the state of the art and the cost .


### the existence of the right to request from the controller access to and rectification or erasure of the personal data concerning the data subject or to object to the processing of such personal data ; ### the existence of the right to request from the controller access to and rectification , to be forgotten or erasure of the personal data concerning the data subject or to object to the processing of such personal data or to obtain data portability ;


### the member states and the commission shall encourage , in particular at european level , the establishment of data protection certification mechanisms and of data protection seals and marks , allowing data subjects to quickly assess the level of data protection provided by controllers and processors . the data protection certifications mechanisms shall contribute to the proper application of this regulation , taking account of the specific features of the various sectors and different processing operations . ### any controller or processor may request any supervisory authority in the union , for a fixed fee , to certify that the processing of personal data is performed in compliance with this regulation , taking account of the specific features of the various sectors as well as the contexts of and risks represented by the data processing operations .


### the commission may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities , and between supervisory authorities and the european data protection board , in particular the standardised format referred to in paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the european data protection board may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities , and between supervisory authorities and the european data protection board , in particular the standardised format referred to in paragraph 6 .


### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . ### the administrative sanction shall be in each individual case effective , proportionate and dissuasive .


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality , adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the level of protection afforded by this regulation may not be undercut . notwithstanding the previous sentence , where arrangements are made by agreement between employee representatives and the management of the undertaking or of the controlling undertaking of a group of undertakings the level of protection afforded by this regulation may not be significantly undercut . the right of member states , or the social partners via collective agreements , to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .


### before a supervisory authority adopts a measure referred to in paragraph 2 , this supervisory authority shall communicate the draft measure to the european data protection board and the commission . ### before the competent supervisory authority adopts a measure referred to in paragraph 2 , this supervisory authority shall communicate the draft measure to the european data protection board and the commission .


### where more than one controller or processor is involved in the processing , each controller or processor shall be jointly and severally liable for the entire amount of the damage . ### where more than one controller is involved in the processing , each controller shall be liable only to the extent that he is responsible for the event giving rise to the damage and that liability has not already been established in the determination or responsibilities envisaged in article 24 .


### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . where such personal data are being processed , the controller shall provide the following information : ### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . with the exception of data being used for historical , statistical or scientific research purposes the controller shall provide the following information when person data are being processed :


### the controller and the processor shall , following an evaluation of the risks , take the measures referred to in paragraph 1 to protect personal data against accidental or unlawful destruction or accidental loss and to prevent any unlawful forms of processing , in particular any unauthorised disclosure , dissemination or access , or alteration of personal data . ### the measures referred to in paragraph 1 shall at least : ensure that personal data can be accessed only by authorised personnel for legally authorised purposes ; protect personal data stored or transmitted against accidental or unlawful destruction , accidental loss or alteration , and unauthorised or unlawful storage , processing , access or disclosure ; and ensure the implementation of a security policy with respect to the processing of personal data .


### any further information necessary to guarantee fair processing in respect of the data subject , having regard to the specific circumstances in which the personal data are collected . ### any further information which is necessary , having regard to the specific circumstances in which the data are or are to be processed , to enable processing in respect of the data subject to be fair .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### the controller shall provide any information and any communication relating to the processing of personal data to the data subject in an intelligible form , using clear and plain language , adapted to the data subject , in particular for any information addressed specifically to a child . ### the controller shall provide any information and any communication relating to the processing of personal data to the data subject in an intelligible form , using clear and plain language , in particular for any information addressed specifically to a child .


### for compliance with a legal obligation to retain the personal data by union or member state law to which the controller is subject ; member state laws shall meet an objective of public interest , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued ; ### for compliance with or to avoid a breach of a legal obligation to retain the personal data by union or member state law to which the controller is subject ;


### the controller shall implement mechanisms to ensure the verification of the effectiveness of the measures referred to in paragraphs 1 and 2 . if proportionate , this verification shall be carried out by independent internal or external auditors . ### the controller or processor shall , upon request by the competent data protection authority , demonstrate the existence of technical and organizational measures in line with those referred to in paragraphs 1 and 2 .


### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority . ### processing of data relating to criminal convictions or related security measures is carried out either under the supervision of the competent supervisory authority or when the processing is necessary for compliance with or to avoid a breach of an eu or a national legal or regulatory obligation or collective agreements on the labour market to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority .


### this regulation applies to the processing of personal data of data subjects residing in the union by a controller not established in the union , where the processing activities are related to : the offering of goods or services to such data subjects in the union ; or the monitoring of their behaviour . ### this regulation applies to the processing of personal data of data subjects residing in the union by a controller or a processor not established in the union .


### the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed ; ### the data are no longer necessary in relation to the purposes for which they were collected or further processed and the legally mandatory minimum retention period has expired ;


### the period for which the personal data will be stored ; ### the estimated period for which the personal data will be stored ;


### the controller no longer needs the personal data for the accomplishment of its task but they have to be maintained for purposes of proof ; ### the controller no longer needs the personal data for the accomplishment of its task but they have to be maintained for the purpose of defending legal claims ;


### the commission may lay down standard forms for providing the information referred to in paragraphs 1 to 3 , taking into account the specific characteristics and needs of various sectors and data processing situations where necessary . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of laying down standard forms for providing the information referred to in paragraphs 1 to 3 , taking into account the specific characteristics and needs of various sectors and data processing situations where necessary .


### processing is necessary for compliance with a legal obligation to which the controller is subject ; ### processing is necessary for compliance with or to avoid breach of an eu or national legal obligation or legal right to which a controller is subject including the performance of a task carried out for assessing creditworthiness or for fraud prevention and detection purposes .


### the supervisory authority referred to in paragraph 1 and the supervisory authority competent under article 51 shall take account of the opinion of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format . ### the supervisory authority referred to in paragraph 1 and the supervisory authorities competent under article 51 shall take the utmost account of the opinions of the european data protection board and shall within two weeks after the information on the opinion by the chair of the european data protection board , electronically communicate to the chair of the european data protection board and to the commission whether it maintains or amends its draft measure and , if any , the amended draft measure , using a standardised format .


### where the personal data are not collected from the data subject , the controller shall inform the data subject , in addition to the information referred to in paragraph 1 , from which source the personal data originate . ### where the personal data are collected from the data subject , the direct controller shall , at the time when the data are collected or immediately thereafter , inform the data subject , in addition to the information referred to in paragraph 1 , whether the provision of personal data is obligatory or voluntary , as well as the possible consequences of failure to provide such data ; the direct controller shall , after the first communication pursuant to paragraph 3 , provide the information pursuant to paragraph 1 once a year , provided that changes have occurred in the information since it was last communicated .


### are legally binding and apply to and are enforced by every member within the controller ' s or processor ' s group of undertakings , and include their employees ; ### are legally binding and apply to and are enforced by every member within the controller ' s or processor ' s group of undertakings and their subcontractors that is included in the scope of the binding corporate rules , and include their employees ;


### for reasons of public interest in the area of public health in accordance with article 81 ; ### for reasons of public interest in the area of public health and health purposes in accordance with article 81 ;


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 shall comply with the standards of necessity and proportionality in accordance with article 1 and shall contain specific provisions at least as to the purposes to be pursued by the processing and the determination of the controller .


### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ; ### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage and technical and organizational measures are put in place to limit access to the data only for the purposes of historical , statistical and scientific research ;


### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority . ### processing of data relating to criminal convictions or related security measures is carried out either under the control and permission of the supervisory authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards for the fundamental rights and interests of the data subject . a complete register of criminal convictions shall be kept only under the control of official authority .


### the controller shall provide the information referred to in paragraphs 1 , 2 and 3 : at the time when the personal data are obtained from the data subject ; or where the personal data are not collected from the data subject , at the time of the recording or within a reasonable period after the collection , having regard to the specific circumstances in which the data are collected or otherwise processed , or , if a disclosure to another recipient is envisaged , and at the latest when the data are first disclosed . ### if the personal data are not collected from the data subject , the indirect controller shall , at the minimum , inform the direct controller of the purposes for which he is processing the personal data , stating his identity and contact details . this shall be done at the time when the personal data are collected or within a reasonable period thereafter , taking into account the specific circumstances in which the data are collected or otherwise processed . article 20 shall apply in addition to this provision .


### any person who has suffered damage as a result of an unlawful processing operation or of an action incompatible with this regulation shall have the right to receive compensation from the controller or the processor for the damage suffered . ### any person who has suffered damage as a result of an unlawful processing operation or of an action incompatible with this regulation shall have the right to receive compensation from the controller for the damage suffered .


### the representative shall be established in one of those member states where the data subjects whose personal data are processed in relation to the offering of goods or services to them , or whose behaviour is monitored , reside . ### the representative shall be established in one of those member states where the data subjects whose personal data are processed reside .


### the controller or processor acting on the controller ' s behalf shall consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where : ### the controller shall consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation where :


### the controller shall bear the burden of proof for the data subject ' s consent to the processing of their personal data for specified purposes . ### where data is processed pursuant to article 6 paragraph 1 the controller shall bear the burden of proof for the data subject ' s consent to the processing of their personal data .


### consent shall not provide a legal basis for the processing , where there is a significant imbalance between the position of the data subject and the controller . ### consent shall not provide a legal basis for the processing , where there is a significant imbalance or coercive relationship between the position of the data subject and the controller . the patient - healthcare provider relationship is not considered a significantly imbalanced or coercive relationship .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### in the case referred to in point of paragraph 5 , the controller shall provide appropriate measures to protect the data subject ' s legitimate interests . ### paragraph 3 shall not apply where : it proves impossible to provide the information or providing it would involve a disproportionate effort ; or the data subject already has the information referred to in paragraph 1 .


### collected for specified , explicit and legitimate purposes and not further processed in a way incompatible with those purposes ; ### collected for specified , explicit and legitimate purposes and not further processed in a way incompatible with those purposes , where the purpose of further processing is not compatible with the one for which the personal data have been collected , the processing must have a legal basis at least in one of the grounds referred to in article 6 to , as well as respect all other dispositions of this regulation ;


### where the supervisory authority is of the opinion that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . ### where the supervisory authority is of the opinion that the intended processing referred to in paragraph 2 would not comply with this regulation it shall within a maximum period of 6 weeks following the request for consultation make appropriate recommendations to the data controller . this period may be extended for a further month , taking into account the complexity of the intended processing . where the extended period applies , the controller of processor shall be informed within one month of receipt of the request of the reasons for the delay .


### within the limits of this regulation , member states may adopt specific rules to set out the investigative powers by the supervisory authorities laid down in article 53 in relation to controllers or processors that are subjects under national law or rules established by national competent bodies to an obligation of professional secrecy or other equivalent obligations of secrecy , where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy . these rules shall only apply with regard to personal data which the controller or processor has received from or has obtained in an activity covered by this obligation of secrecy . ### member states may adopt by law : exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v for the processing of personal data that are subject to an obligation of professional secrecy or another equivalent obligation of secrecy of the controller or processor , within the limits of this regulation , specific rules to set out the investigative powers by the supervisory authorities laid down in article 53 in relation to controllers or processors that are subjects under national law or rules established by national competent bodies to an obligation of professional secrecy or other equivalent obligations of secrecy , where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy . these rules shall only apply with regard to personal data which the controller or processor has received from or has obtained in an activity covered by this obligation of secrecy .


### the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected , having regard to the state of the art and the costs of their implementation . ### having regard to the state of technological development and the cost of implementation , the controller must implement appropriate technical and organisational measures to ensure a level of security in relation to the processing personal data that is appropriate to : the harm that might result from unauthorised or unlawful processing or accidental loss , destruction or damage as mentioned in article 5 , and the nature and scope of the data to be processed .


### the controller or processor acting on the controller ' s behalf shall consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where : ### the controller or processor acting on the controller ' s behalf may consult the supervisory authority prior to the processing of special categories of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where :


### the implementing act shall specify its geographical and sectoral application , and , where applicable , identify the supervisory authority mentioned in point of paragraph 2 . ### the delegated act shall specify its territorial application , and identify the supervisory authority mentioned in point of paragraph 2 .


### the period for which the personal data will be stored ; ### the estimated period for which the personal data will be stored ;


### these purposes cannot be otherwise fulfilled by processing data which does not permit or not any longer permit the identification of the data subject ; ### these purposes cannot reasonably be achieved by processing data which does not permit or not any longer permit the identification of the data subject ; and


### the significance and envisaged consequences of such processing , at least in the case of measures referred to in article 20 . ### where the processing by automatic means of personal data of which that individual is the data subject for the purpose of evaluating matters relating to him such as , for example , his performance at work , his creditworthiness , his reliability or his conduct , has constituted or is likely to constitute the sole basis for any decision significantly affecting him , to be informed by the data controller of the logic involved in that decision - taking .


### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within one week after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within one month by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authority competent under article 51 of the opinion and make it public . ### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within two weeks after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within two months by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authorities competent under article 51 of the opinion and make it public .


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to [ articles xxx ] shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of four months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .


### where a transfer is based on contractual clauses as referred to in point of paragraph 2 of this article the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the supervisory authority . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . ### where the relevant safeguards are provided for on the basis of contractual clauses as referred to in point of paragraph 2 of this article the controller or processor shall ensure compliance of the intended processing with this regulation and mitigate any risks involved for the data subject . the supervisory authority shall support the compliance of the regulation by providing guidance and advice under this provision . if the processing concerns data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the edpb shall provide guidance to ensure consistent application of the regulation , taking into account the specific circumstances of individual member states .


### any further information necessary to guarantee fair processing in respect of the data subject , having regard to the specific circumstances in which the personal data are collected . ### any further information which is necessary , having regard to the specific circumstances in which the data are or are to be processed , to enable processing in respect of the data subject to be fair .


### processing of data concerning health is necessary for health purposes and subject to the conditions and safeguards referred to in article 81 ; or ### processing of personal data intended to reveal information concerning health is necessary for purposes of preventative or occupational medicine , medical diagnosis , the provision of care or treatment or the management of health - care services , where those data are processed by a health professional subject to the obligation of professional secrecy or another person also subject to an equivalent obligation of confidentiality under member state law or rules established by national competent bodies ; or


### the commission may lay down standard forms and specifying standard procedures for the communication referred to in paragraph 2 , including the electronic format . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of laying down standard forms and specifying standard procedures for the communication referred to in paragraph 2 , including the electronic format . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises .


### where personal data relating to a data subject are collected , the controller shall provide the data subject with at least the following information : ### where personal data relating to a data subject are collected , the controller shall provide or make readily available to the data subject at least the following information :


### the controller shall carry out the erasure without delay , except to the extent that the retention of the personal data is necessary : ### the controller shall carry out the erasure without undue delay , except to the extent that the retention and dissemination of the personal data is necessary :


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified or singled out , directly or indirectly , alone or in combination with associated data , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to a unique identifier , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural , social or gender identity or sexual orientation of that person ;


### where a transfer is based on contractual clauses as referred to in point of paragraph 2 of this article the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the supervisory authority . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . ### the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the competent supervisory authority for transfers according to this article . if the transfer is related to processing activities which substantially affect the free movement of personal data within the union , the competent supervisory authority shall apply the consistency mechanism referred to in article 57 .


### the controller or the processor shall communicate the name and contact details of the data protection officer to the supervisory authority and to the public . ### the controller or the processor shall make available the name and contact details of the data protection officer to the supervisory authority and to the public .


### in the absence of an adequacy decision pursuant to article 41 or of appropriate safeguards pursuant to article 42 , a transfer or a set of transfers of personal data to a third country or an international organisation may take place only on condition that : ### in the absence of an adequacy decision pursuant to article 41 ; or where the commission decides that a third country , or a territory or a processing sector within that third country , or an international organisation does not ensure an adequate level of protection in accordance with article 41 ; or in the absence of appropriate safeguards pursuant to article 42 , a transfer or a set of transfers of personal data to a third country or an international organisation may take place only on condition that :


### this regulation applies to the processing of personal data of data subjects residing in the union by a controller not established in the union , where the processing activities are related to : the offering of goods or services to such data subjects in the union ; or the monitoring of their behaviour . ### this regulation applies to the processing of personal data of data subjects residing in the union by a controller or a processor not established in the union .


### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . where such personal data are being processed , the controller shall provide the following information : ### the data subject shall have the right to obtain from the controller , on request , confirmation as to whether or not personal data relating to the data subject are being processed . where such personal data are being processed , the controller shall provide the following information :


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1 , including conditions for granting and withdrawal , and requirements for recognition within the union and in third countries . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1 , including conditions for granting and withdrawal , and requirements for recognition within the union and in third countries , provided such measures are technology neutral .


### within the limits of this regulation , personal data may be processed for historical , statistical or scientific research purposes only if : ### without prejudice to this regulation , personal data not falling within the categories of data covered by article 8 of this regulation may be processed for historical , statistical or scientific purposes under paragraph 2 of article 6 and point of article 9 only if :


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality , adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the level of protection afforded by this regulation may not be undercut . notwithstanding the previous sentence , where arrangements are made by agreement between employee representatives and the management of the undertaking or of the controlling undertaking of a group of undertakings the level of protection afforded by this regulation may not be significantly undercut . the right of member states , or the social partners via collective agreements , to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .


### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior authorisations and consultations , inspections and prompt information on the opening of cases and ensuing developments where data subjects in several member states are likely to be affected by processing operations . ### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior consultations , inspections and prompt information on the opening of cases and ensuing developments where data subjects in several member states are likely to cause legal effects to the detriment of the data subjects .


### accurate and kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without delay ; ### accurate and where necessary , kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without undue delay ;


### examine , on its own initiative or on request of one of its members or on request of the commission , any question covering the application of this regulation and issue guidelines , recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of this regulation ; ### examine , on its own initiative or on request of one of its members , the commission or other stakeholders any question covering the application of this regulation and issue guidelines , recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of this regulation ;


### the rule of law , relevant legislation in force , both general and sectoral , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in that country or by that international organisation , as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ; ### the rule of law , relevant legislation in force , both general and sectoral , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in that country or by that international organisation , jurisprudential precedents as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ;


### the recipients or categories of recipients of the personal data ; ### where applicable , the recipients or categories of recipients of the personal data outside the controller or the group of undertakings of which the controller is member ;


### the european data protection board shall ensure the consistent application of this regulation . to this effect , the european data protection board shall , on its own initiative or at the request of the commission , in particular : ### the european data protection board shall ensure the consistent application of this regulation . to this effect , the european data protection board shall , on its own initiative , at the request of the commission or other stakeholders , in particular :


### where the supervisory authority is of the opinion that the intended processing does not comply with this regulation , in particular where risks are insufficiently identified or mitigated , it shall prohibit the intended processing and make appropriate proposals to remedy such incompliance . ### where the supervisory authority is of the opinion that the intended processing referred to in paragraph 2 would not comply with this regulation it shall within a maximum period of 6 weeks following the request for consultation make appropriate recommendations to the data controller . this period may be extended for a further month , taking into account the complexity of the intended processing . where the extended period applies , the controller of processor shall be informed within one month of receipt of the request of the reasons for the delay .


### in the case referred to in point of paragraph 5 , the controller shall provide appropriate measures to protect the data subject ' s legitimate interests . ### paragraph 3 shall not apply where : it proves impossible to provide the information or providing it would involve a disproportionate effort ; or the data subject already has the information referred to in paragraph 1 .


### processing of personal data concerning health which is necessary for historical , statistical or scientific research purposes , such as patient registries set up for improving diagnoses and differentiating between similar types of diseases and preparing studies for therapies , is subject to the conditions and safeguards referred to in article 83 . ### processing of personal data concerning health which is necessary for historical , statistical or scientific research purposes , shall be permitted only with the consent of the data subject , and shall be subject to the conditions and safeguards referred to in article 83 .


### complying with the requirements for prior authorisation or prior consultation of the supervisory authority pursuant to article 34 and ; ### existence of appropriate documentation of data processing to enable compliance with the obligations arising from this regulation ;


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### every natural person shall have the right not to be subject to a measure which produces a legal effect concerning this natural person or significantly affects this natural person , and which is based solely or predominantly on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . such automated processing may include the application of web analysing tools , tracking for assessing user behaviour , the creation of motion profiles by mobile applications , or the creation of personal profiles by social networks .


### the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected , having regard to the state of the art and the costs of their implementation . ### having regard to the state of technological development and the cost of implementation , the controller must implement appropriate technical and organisational measures to ensure a level of security in relation to the processing personal data that is appropriate to : the harm that might result from unauthorised or unlawful processing or accidental loss , destruction or damage as mentioned in article 5 , and the nature and scope of the data to be processed .


### other public interests of the union or of a member state , in particular an important economic or financial interest of the union or of a member state , including monetary , budgetary and taxation matters and the protection of market stability and integrity ; ### other public interests of the union or of a member state , in particular an important economic or financial interest of the union or of a member state ;


### the controller shall provide the information referred to in paragraphs 1 , 2 and 3 : at the time when the personal data are obtained from the data subject ; or where the personal data are not collected from the data subject , at the time of the recording or within a reasonable period after the collection , having regard to the specific circumstances in which the data are collected or otherwise processed , or , if a disclosure to another recipient is envisaged , and at the latest when the data are first disclosed . ### if the personal data are not collected from the data subject , the indirect controller shall , at the minimum , inform the direct controller of the purposes for which he is processing the personal data , stating his identity and contact details . this shall be done at the time when the personal data are collected or within a reasonable period thereafter , taking into account the specific circumstances in which the data are collected or otherwise processed . article 20 shall apply in addition to this provision .


### when the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay . ### when the personal data breach causes or is likely to cause significant adverse effect on the privacy of the data subject and minimizing of the harm requires action by data subjects , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay unless this is disproportionally difficult . when communication to data subjects would risk causing further serious harm to the protection of the personal data or privacy of the data subject , the controller may , after consulting with the supervisory authority , delay communication to data subjects until such risk no longer prevails .


### the controller and the processor shall , following an evaluation of the risks , take the measures referred to in paragraph 1 to protect personal data against accidental or unlawful destruction or accidental loss and to prevent any unlawful forms of processing , in particular any unauthorised disclosure , dissemination or access , or alteration of personal data . ### the measures referred to in paragraph 1 shall at least : ensure that personal data can be accessed only by authorised personnel for legally authorised purposes ; protect personal data stored or transmitted against accidental or unlawful destruction , accidental loss or alteration , and unauthorised or unlawful storage , processing , access or disclosure ; and ensure the implementation of a security policy with respect to the processing of personal data .


### make available to the controller and the supervisory authority all information necessary to control compliance with the obligations laid down in this article . ### make available to the controller all information necessary to control compliance with the obligations laid down in this article .


### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages or for other reasons , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . the supervisory authority shall , without delay , communicate those measures , with full reasons , to the european data protection board and to the commission . ### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . this supervisory authority shall , without delay , communicate those measures , with full reasons , to the competent supervisory authority , the european data protection board , the commission and the controller or processor concerned .


### the commission may set out standard forms and procedures for prior authorisations and consultations referred to in paragraphs 1 and 2 , and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may set out standard forms and procedures for prior consultations referred to in paragraph 2 and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 .


### the public interest referred to in point of paragraph 1 must be recognised in union law or in the law of the member state to which the controller is subject . ### the public interest referred to in point of paragraph 1 must be recognised in international conventions , in union law or in the law of the member state to which the controller is subject . this derogation shall only be used for occasional transfers . in each and every case , a careful assessment of all circumstances of the transfer needs to be carried out .


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### every data subject shall have the right not to be subject to a decision that produces adverse legal effects or adversely affects this data subject , and which is based solely or predominantly on automated processing intended to evaluate certain personal aspects relating to this data subject .


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the purposes to be pursued by the processing and the determination of the controller .


### complying with the requirements for prior authorisation or prior consultation of the supervisory authority pursuant to article 34 and ; ### the existence of appropriate documentation of data processing that enables compliance with the obligations arising from this regulation ;


### where the controller or the processor is a public authority or body , the data protection officer may be designated for several of its entities , taking account of the organisational structure of the public authority or body . ### where the controller or the processor is a public authority or body , the data protection officer may be designated for several of its entities , taking account of the organisational structure of the public authority or body . member states may adopt specific rules to provide for the designation of a data protection officer for groups of public - office holders .


### the commission may lay down standard forms for providing the information referred to in paragraphs 1 to 3 , taking into account the specific characteristics and needs of various sectors and data processing situations where necessary . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of laying down standard forms for providing the information referred to in paragraphs 1 to 3 , taking into account the specific characteristics and needs of various sectors and data processing situations where necessary .


### a transfer based on standard data protection clauses or binding corporate rules as referred to in points , or of paragraph 2 shall not require any further authorisation . ### a transfer based on points , , or of paragraph 2 shall not require any further authorisation .


### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned . ### the assessment shall contain at least a general description of the envisaged processing operations , an assessment of the risks to the rights and freedoms of data subjects , the measures envisaged to address the risks , safeguards , security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation , taking into account the rights and legitimate interests of data subjects and other persons concerned and also taking into account modern technologies and methods that can improve citizens ' privacy .


### designating a data protection officer pursuant to article 35 . ### the existence of a data protection officer , as outlined in article 4 , or other staff supported with adequate resources to oversee the implementation of measures defined in this article and to monitor compliance with this regulation . the sufficient organizational independence of the data protection officer or other staff shall be ensured ;


### at union level , a european data protection board should be set up . it should replace the working party on the protection of individuals with regard to the processing of personal data established by directive 95 / 46 / ec . it should consist of a head of a supervisory authority of each member state and of the european data protection supervisor . the commission should participate in its activities . the european data protection board should contribute to the consistent application of this regulation throughout the union , including by advising the commission and promoting co - operation of the supervisory authorities throughout the union . the european data protection board should act independently when exercising its tasks . ### at union level , a european data protection board should be set up . it should replace the working party on the protection of individuals with regard to the processing of personal data established by directive 95 / 46 / ec . it should consist of a head of a supervisory authority of each member state and of the european data protection supervisor . the european data protection board should contribute to the consistent application of this regulation throughout the union , including by advising the commission and promoting co - operation of the supervisory authorities throughout the union . the european data protection board should act independently when exercising its tasks .


### the data subject objects to the processing of personal data pursuant to article 19 ; ### the data subject has successfully objected to the processing of personal data pursuant to article 19 ;


### the purposes of the processing for which the personal data are intended , including the contract terms and general conditions where the processing is based on point of article 6 and the legitimate interests pursued by the controller where the processing is based on point of article 6 ; ### the purpose or purposes for which the data are intended to be processed ; and


### performing a data protection impact assessment pursuant to article 33 ; ### existence of proper policies , instructions or other guidelines to guide data processing needed to comply with the regulation as well as procedures and enforcement to make such guidelines effective ;


### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority . ### processing of data relating to criminal convictions or related security measures is carried out either under the control and permission of the supervisory authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards for the fundamental rights and interests of the data subject . a complete register of criminal convictions shall be kept only under the control of official authority .


### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state law which shall provide for suitable measures to safeguard the data subject ' s legitimate interests ; or ### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state ; or


### union or member state law may restrict by way of a legislative measure the scope of the obligations and rights provided for in points to of article 5 and articles 11 to 20 and article 32 , when such a restriction constitutes a necessary and proportionate measure in a democratic society to safeguard : ### union or member state law may restrict or extend by way of a legislative measure the scope of the obligations and rights provided for in points to of article 5 and articles 11 to 19 and article 32 , when such a restriction or extension constitutes a necessary and proportionate measure in a democratic society to safeguard :


### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context . therefore , in order to regulate the processing of employees ' personal data in the employment context , member states should be able , within the limits of this regulation , to adopt by law specific rules for the processing of personal data in the employment sector . ### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context . member states should be able to regulate the processing of employees ' personal data in the employment context in accordance with the rules and minimum standards set out in this regulation . where a statutory basis is provided in the member state in question for the regulation of employment matters by agreement between employee representatives and the management of the undertaking or the controlling undertaking of a group of undertakings or under directive 2009 / 38 / ec of the european parliament and of the council of 6 may 2009 on the establishment of a european works council or a procedure in community - scale undertakings and community - scale groups of undertakings for the purposes of informing and consulting employees1 , the processing of personal data in an employment context may also be regulated by such an agreement ; in this particular case there is the possibility for derogations and exceptions in accordance with national law and practices . ________________ 1 oj l 122 , 16 . 5 . 2009 , p . 28 .


### where a processing operation is to be carried out on behalf of a controller , the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures . ### where a processing operation is to be carried out on behalf of a controller and involves the processing of data that would permit the processor to reasonably identify the data subject , the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures .


### the controller or the processor shall ensure that any other professional duties of the data protection officer are compatible with the person ' s tasks and duties as data protection officer and do not result in a conflict of interests . ### the controller or the processor shall ensure that any other professional duties of the data protection officer or data protection officers are compatible with the person ' s or persons ' tasks and duties as data protection officer and do not result in a conflict of interests .