### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . ### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to among other things : the nature , gravity , and duration of the breach , the sensitivity of the data in issue , the intentional or negligent character of the infringement , the degree of cooperation or refusal or obstruction to cooperate with any enforcement process , the measures having been taken by the natural or legal person to ensure compliance with relevant obligations , the degree of harm or risk of harm created by the violation , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of cooperation with the supervisory authority in order to remedy the breach .


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### member states may , in accordance with the rules set out in this regulation , and taking into account the principle of proportionality , adopt by legal provisions specific rules regulating the processing of employees ' personal data in the employment context , in particular but not limited to the purposes of the recruitment and job applications within the group of undertakings , the performance of the contract of employment , including discharge of obligations laid down by law and by collective agreements , company agreements and collective agreements in accordance with national law and practice , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . the level of protection afforded by this regulation may not be undercut . notwithstanding the previous sentence , where arrangements are made by agreement between employee representatives and the management of the undertaking or of the controlling undertaking of a group of undertakings the level of protection afforded by this regulation may not be significantly undercut . the right of member states , or the social partners via collective agreements , to provide employees with more favourable protection provisions in respect of the processing of personal data in the employment context shall remain unaffected .


### before a supervisory authority adopts a measure referred to in paragraph 2 , this supervisory authority shall communicate the draft measure to the european data protection board and the commission . ### before the competent supervisory authority adopts a measure referred to in paragraph 2 , this supervisory authority shall communicate the draft measure to the european data protection board and the commission .


### within the limits of this regulation , personal data may be processed for historical , statistical or scientific research purposes only if : ### without prejudice to this regulation , personal data not falling within the categories of data covered by article 8 of this regulation may be processed for historical , statistical or scientific purposes under paragraph 2 of article 6 and point of article 9 only if :


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller ; a processor ; criteria and requirements for the documentation ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . where such personal data are being processed , the controller shall provide the following information : ### the data subject shall have the right to obtain from the controller at any time , on request , confirmation as to whether or not personal data relating to the data subject are being processed . with the exception of data being used for historical , statistical or scientific research purposes the controller shall provide the following information when person data are being processed :


### designating a data protection officer pursuant to article 35 . ### designating a data protection officer pursuant to article 35 , or the obligation and maintenance of certification in accordance with the certification policies defined by the commission .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### the controller shall provide any information and any communication relating to the processing of personal data to the data subject in an intelligible form , using clear and plain language , adapted to the data subject , in particular for any information addressed specifically to a child . ### the controller shall provide any information and any communication relating to the processing of personal data to the data subject in an intelligible form , using clear and plain language , in particular for any information addressed specifically to a child .


### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued . ### the laws of the union and of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , respect the essence of fundamental rights and freedoms , in particular the right to the protection of personal data and be proportionate to the legitimate aim pursued .


### the controller shall implement mechanisms to ensure the verification of the effectiveness of the measures referred to in paragraphs 1 and 2 . if proportionate , this verification shall be carried out by independent internal or external auditors . ### the controller shall implement appropriate mechanisms to ensure the verification of the effectiveness of the measures referred to in paragraphs 1 and 2 . if proportionate , this verification shall be carried out by independent internal or external auditors .


### the supervisory authority shall impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently : does not provide the information , or does provide incomplete information , or does not provide the information in a sufficiently transparent manner , to the data subject pursuant to article 11 , article 12 and article 14 ; does not provide access for the data subject or does not rectify personal data pursuant to articles 15 and 16 or does not communicate the relevant information to a recipient pursuant to article 13 ; does not comply with the right to be forgotten or to erasure , or fails to put mechanisms in place to ensure that the time limits are observed or does not take all necessary steps to inform third parties that a data subjects requests to erase any links to , or copy or replication of the personal data pursuant article 17 ; does not provide a copy of the personal data in electronic format or hinders the data subject to transmit the personal data to another application in violation of article 18 ; does not or not sufficiently determine the respective responsibilities with co - controllers pursuant to article 24 ; does not or not sufficiently maintain the documentation pursuant to article 28 , article 31 , and article 44 ; does not comply , in cases where special categories of data are not involved , pursuant to articles 80 , 82 and 83 with rules in relation to freedom of expression or with rules on the processing in the employment context or with the conditions for processing for historical , statistical and scientific research purposes . ### the supervisory authority may impose a fine up to 500 000 eur , or in case of an enterprise up to 1 % of its annual worldwide turnover , to anyone who , intentionally or negligently : does not provide the information , or does provide incomplete information , or does not provide the information in a sufficiently transparent manner , to the data subject pursuant to article 11 , article 12 and article 14 ; does not provide access for the data subject or does not rectify personal data pursuant to articles 15 and 16 or does not communicate the relevant information to a recipient pursuant to article 13 ; does not comply with the right to be forgotten or to erasure or has not provided a mechanism pursuant article 17a . when determining a fine for a violation as referred to in this section , the supervisory authority shall take into account the extent to which the controller , or the main establishment as referred to in article 22 , has put in place mechanisms for ensuring that the time limits with respect to the retention of the personal data are observed ; hinders the data subject to his user - generated content to another application in violation of article 18 ; does not or not sufficiently determine the respective responsibilities with co - controllers pursuant to article 24 ; does not or not sufficiently maintain the documentation pursuant to article 28 , article 31 , and article 44 ; does not comply , in cases where special categories of data are not involved , pursuant to articles 80 , 82 and 83 with rules in relation to freedom of expression or with rules on the processing in the employment context or with the conditions for processing for historical , statistical and scientific research purposes .


### this regulation applies to the processing of personal data of data subjects residing in the union by a controller not established in the union , where the processing activities are related to : the offering of goods or services to such data subjects in the union ; or the monitoring of their behaviour . ### this regulation applies to the processing of personal data of data subjects residing in the union by a controller or a processor not established in the union .


### the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed ; ### the data are no longer necessary in relation to the purposes for which they were collected or further processed and the legally mandatory minimum retention period has expired ;


### each data subject shall have the right to a judicial remedy obliging the supervisory authority to act on a complaint in the absence of a decision necessary to protect their rights , or where the supervisory authority does not inform the data subject within three months on the progress or outcome of the complaint pursuant to point of article 52 . ### if the supervisory authority has not informed the data subject of the status of a complaint within three months of its being lodged , the complaint will be deemed to have been rejected . the complaint will also be deemed to have been rejected if the supervisory authority has not definitively resolved it within six months .


### the period for which the personal data will be stored ; ### the estimated period for which the personal data will be stored ;


### where personal data are processed for direct marketing purposes , the data subject shall have the right to object free of charge to the processing of their personal data for such marketing . this right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information . ### where personal data are processed in accordance with article 6 , the data subject shall have the right to object free of charge to the processing of their personal data for that purpose . this right shall be explicitly offered to the data subject in an intelligible manner and shall be clearly distinguishable from other information .


### issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in article 57 ; ### issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in article 57 and in article 63a ;


### accurate and kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without delay ; ### accurate and , where necessary , kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without delay ;


### personal data referred to in paragraph 4 may , with the exception of storage , only be processed for purposes of proof , or with the data subject ' s consent , or for the protection of the rights of another natural or legal person or for an objective of public interest . ### personal data referred to in paragraph 4 may , with the exception of storage , only be processed for purposes of proof or for compliance with legal record obligations , or with the data subject ' s consent , or for the protection of the rights of another natural or legal person or for an objective of public interest .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission , in certain limited circumstances . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### does not comply with the right to be forgotten or to erasure , or fails to put mechanisms in place to ensure that the time limits are observed or does not take all necessary steps to inform third parties that a data subjects requests to erase any links to , or copy or replication of the personal data pursuant article 17 ; ### does not comply with a request concerning the right to be forgotten or erasure in accordance with the provisions of this regulation .


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 shall comply with the standards of necessity and proportionality in accordance with article 1 and shall contain specific provisions at least as to the purposes to be pursued by the processing and the determination of the controller .


### any person who has suffered damage as a result of an unlawful processing operation or of an action incompatible with this regulation shall have the right to receive compensation from the controller or the processor for the damage suffered . ### any person who has suffered damage as a result of an unlawful processing operation or of an action incompatible with this regulation shall have the right to receive compensation from the controller for the damage suffered .


### where the commission has taken no decision pursuant to article 41 , a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument . ### where the commission has taken no decision pursuant to article 41 , or decides that a third country , or a territory or a processing sector within that third country , or an international organisation does not ensure an adequate level of protection in accordance with paragraph 5 of this article , a controller or processor may transfer personal data to a third country or an international organisation transferring data on an international basis only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument , and where appropriate pursuant to an impact assessment , where the controller or processor has ensured that the recipient of data in a third country maintains high standards of data protection . these safeguards shall , at least , guarantee the observance of the principles of personal data processing as established in article 5 and guarantee data subject rights as established in chapter iii .


### the representative shall be established in one of those member states where the data subjects whose personal data are processed in relation to the offering of goods or services to them , or whose behaviour is monitored , reside . ### the representative shall be established in one of those member states where the data subjects whose personal data are processed reside .


### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . ### for the purposes of this regulation , the processing of personal data of a child below the age of 13 years would normally require that consent is given or authorised by the child ' s parent or legal representative . the appropriate form for obtaining consent should be based on any risk posed to the child by the amount of data , its type and the nature of the processing . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . the methods to obtain verifiable consent shall not lead to the further processing of personal data which would otherwise not be necessary .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot be achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , addressing such economic loss and social harm should be the first and utmost priority . after that , as soon as the controller becomes aware that a breach , which would have a significantly adverse impact on the protection of the personal data or the privacy of the data subject concerned , has occurred , the controller should notify the breach to the supervisory authority without undue delay . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions , avoiding information overload for the data subject . a breach should be considered as significantly adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation , damage to reputation the notification should describe the nature of the personal data breach as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### where a transfer is based on contractual clauses as referred to in point of paragraph 2 of this article the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the supervisory authority . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . ### where a transfer is based on contractual clauses as referred to in point or of paragraph 2 of this article the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the competent supervisory authority . if the transfer is related to processing activities or substantially affect the free movement of personal data within the union , the competent supervisory authority shall apply the consistency mechanism referred to in article 57 .


### to ensure the compliance with prior authorisations and prior consultations referred to in article 34 ; ### to ensure the compliance with prior consultations referred to in article 34 ;


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context . therefore , in order to regulate the processing of employees’ personal data in the employment context , member states should be able , within the limits of this regulation , to adopt by law specific rules for the processing of personal data in the employment sector . ### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context . therefore , in order to regulate the processing of employees ' personal data in the employment context , member states should be able , within the limits of this regulation , to adopt by law specific rules for the processing of personal data in the employment sector . by virtue of collective agreements , the provisions of the regulation may be disregarded .


### each supervisory authority shall have the power to sanction administrative offences , in particular those referred to in article 79 , and . ### pursuant to article 51 the competent supervisory authority shall have the power to sanction administrative offences , in particular those referred to in article 79 , and .


### if the data subject ' s consent is to be given in the context of a written declaration which also concerns another matter , the requirement to give consent must be presented distinguishable in its appearance from this other matter . ### if the data subject ' s consent is to be given in the context of a written or an electronic declaration which also concerns another matter , the requirement to give consent must be presented distinguishable in its appearance from this other matter .


### the offering of goods or services to such data subjects in the union ; or ### the offering of goods and services to such data subjects in the union , including services provided without financial costs to the individual , or ;


### a transfer may take place where the commission has decided that the third country , or a territory or a processing sector within that third country , or the international organisation in question ensures an adequate level of protection . such transfer shall not require any further authorisation . ### a transfer may take place where international agreements or arrangements between the eu or a member state with a third country are in force or the commission has decided that the third country , or a territory or a processing sector within that third country , or the international organisation in question ensures an adequate level of protection . such transfer shall not require any further authorisation .


### processing is necessary for the purposes of the legitimate interests pursued by a controller , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child . this shall not apply to processing carried out by public authorities in the performance of their tasks . ### without prejudice to the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child , processing is necessary for the purposes of the legitimate interests pursued by a controller , in particular : - direct marketing for its own and similar products and services , - the enforcement of the claims of the controller or of a third party on behalf of which the controller is acting in relation to the data subject , or for preventing or limiting damage by the data subject to the controller this shall not apply to processing carried out by public authorities in the performance of their tasks .


### the controller or processor acting on the controller ' s behalf shall consult the supervisory authority prior to the processing of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where : ### the controller or processor acting on the controller ' s behalf may consult the supervisory authority prior to the processing of special categories of personal data in order to ensure the compliance of the intended processing with this regulation and in particular to mitigate the risks involved for the data subjects where :


### the period for which the personal data will be stored ; ### the estimated period for which the personal data will be stored ;


### these purposes cannot be otherwise fulfilled by processing data which does not permit or not any longer permit the identification of the data subject ; ### these purposes cannot reasonably be achieved by processing data which does not permit or not any longer permit the identification of the data subject ; and


### the supervisory authority shall act with complete independence in exercising the duties and powers entrusted to it . ### the supervisory authorities shall act with complete independence in exercising the duties and powers entrusted to them .


### a delegated act adopted pursuant to article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 33 , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council . ### a delegated act adopted pursuant to article 8 , article 9 , article 12 , article 20 , article 23 , article 30 , article 33 , article 34 , article 39 , article 43 , article 44 , article 79 , and article 82 shall enter into force only if no objection has been expressed either by the european parliament or the council within a period of two months of notification of that act to the european parliament and the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object . that period shall be extended by two months at the initiative of the european parliament or the council .


### a transfer may take place where the commission has decided that the third country , or a territory or a processing sector within that third country , or the international organisation in question ensures an adequate level of protection . such transfer shall not require any further authorisation . ### a transfer may take place where the commission has decided that the third country , or a territory or a processing sector within that third country , or the international organisation in question ensures an adequate level of protection . such transfer shall not require any specific authorisation .


### directive 95 / 46 / ec should be repealed by this regulation . however , commission decisions adopted and authorisations by supervisory authorities based on directive 95 / 46 / ec should remain in force . ### directive 95 / 46 / ec should be repealed by this regulation . however , commission decisions adopted and authorisations by supervisory authorities based on directive 95 / 46 / ec should remain in force . this should be also valid for international agreements or arrangements between the eu or a member state with a third country especially when directive 95 / 46 / ec was already in force .


### the controller shall carry out the erasure without delay , except to the extent that the retention of the personal data is necessary : ### the controller shall carry out the erasure without undue delay , except to the extent that the retention and dissemination of the personal data is necessary :


### ' data subject ' means an identified natural person or a natural person who can be identified , directly or indirectly , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to an identification number , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural or social identity of that person ; ### ' data subject ' means an identified natural person or a natural person who can be identified or singled out , directly or indirectly , alone or in combination with associated data , by means reasonably likely to be used by the controller or by any other natural or legal person , in particular by reference to a unique identifier , location data , online identifier or to one or more factors specific to the physical , physiological , genetic , mental , economic , cultural , social or gender identity or sexual orientation of that person ;


### where a transfer is based on contractual clauses as referred to in point of paragraph 2 of this article the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the supervisory authority . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . ### the controller or processor shall obtain prior authorisation of the contractual clauses according to point of article 34 from the competent supervisory authority for transfers according to this article . if the transfer is related to processing activities which substantially affect the free movement of personal data within the union , the competent supervisory authority shall apply the consistency mechanism referred to in article 57 .


### responsibility of the controller ### overall principle of responsibility of the controller .


### in the absence of an adequacy decision pursuant to article 41 or of appropriate safeguards pursuant to article 42 , a transfer or a set of transfers of personal data to a third country or an international organisation may take place only on condition that : ### in the absence of an adequacy decision pursuant to article 41 ; or where the commission decides that a third country , or a territory or a processing sector within that third country , or an international organisation does not ensure an adequate level of protection in accordance with article 41 ; or in the absence of appropriate safeguards pursuant to article 42 , a transfer or a set of transfers of personal data to a third country or an international organisation may take place only on condition that :


### this regulation applies to the processing of personal data of data subjects residing in the union by a controller not established in the union , where the processing activities are related to : the offering of goods or services to such data subjects in the union ; or the monitoring of their behaviour . ### this regulation applies to the processing of personal data of data subjects residing in the union by a controller or a processor not established in the union .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1 , including conditions for granting and withdrawal , and requirements for recognition within the union and in third countries . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the data protection certification mechanisms referred to in paragraph 1 , including conditions for granting and withdrawal , and requirements for recognition within the union and in third countries , provided such measures are technology neutral .


### the controller or the processor shall ensure that the data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data . ### the controller or the processor shall ensure that the data protection organisation or the data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data .


### within the limits of this regulation , personal data may be processed for historical , statistical or scientific research purposes only if : ### without prejudice to this regulation , personal data not falling within the categories of data covered by article 8 of this regulation may be processed for historical , statistical or scientific purposes under paragraph 2 of article 6 and point of article 9 only if :


### the data subject shall have the right to withdraw his or her consent at any time . the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal . ### the data subject shall have the right to withdraw his or her consent . the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal or in cases where a minimum mandatory term of storage is provided by a european or national law , or data are processed according to european and national regulatory provisions , or for anti - fraud or legal purposes . the data subject has to communicate his willingness to withdraw his or her consent to the processor .


### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior authorisations and consultations , inspections and prompt information on the opening of cases and ensuing developments where data subjects in several member states are likely to be affected by processing operations . ### supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this regulation in a consistent manner , and shall put in place measures for effective co - operation with one another . mutual assistance shall cover , in particular , information requests and supervisory measures , such as requests to carry out prior consultations , inspections and prompt information on the opening of cases and ensuing developments where data subjects in several member states are likely to cause legal effects to the detriment of the data subjects .


### accurate and kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without delay ; ### accurate and where necessary , kept up to date ; every reasonable step must be taken to ensure that personal data that are inaccurate , having regard to the purposes for which they are processed , are erased or rectified without undue delay ;


### examine , on its own initiative or on request of one of its members or on request of the commission , any question covering the application of this regulation and issue guidelines , recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of this regulation ; ### examine , on its own initiative or on request of one of its members , the commission or other stakeholders any question covering the application of this regulation and issue guidelines , recommendations and best practices addressed to the supervisory authorities in order to encourage consistent application of this regulation ;


### at union level , a european data protection board should be set up . it should replace the working party on the protection of individuals with regard to the processing of personal data established by directive 95 / 46 / ec . it should consist of a head of a supervisory authority of each member state and of the european data protection supervisor . the commission should participate in its activities . the european data protection board should contribute to the consistent application of this regulation throughout the union , including by advising the commission and promoting co - operation of the supervisory authorities throughout the union . the european data protection board should act independently when exercising its tasks . ### the european data protection board should strengthen the dialogue with concerned stakeholders such as data subjects’ associations , consumer organisations and other relevant stakeholders . this group of experts and stakeholders should be determined by the board itself and should focus on issues that are of concern to all involved parties and should make the board aware of these issues . further to this , the chair of the board may invite representatives of the european parliament or other relevant bodies to attend the meetings of the board .


### the controller or processor shall designate the data protection officer on the basis of professional qualities and , in particular , expert knowledge of data protection law and practices and ability to fulfil the tasks referred to in article 37 . the necessary level of expert knowledge shall be determined in particular according to the data processing carried out and the protection required for the personal data processed by the controller or the processor . ### the controller or processor shall designate the data protection officer on the basis of professional qualities and , in particular , expert knowledge of data protection law and practices and ability to fulfil the tasks referred to in article 37 , in accordance with strict professional standards . the necessary level of expert knowledge shall be determined in particular according to the data processing carried out and the protection required for the personal data processed by the controller or the processor .


### comprehensive responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller ' s behalf should be established . in particular , the controller should ensure and be obliged to demonstrate the compliance of each processing operation with this regulation . ### overall responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller ' s behalf should be established . in particular , the controller should ensure and be obliged to demonstrate the compliance of each processing operation with this regulation .


### the rule of law , relevant legislation in force , both general and sectoral , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in that country or by that international organisation , as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ; ### the rule of law , relevant legislation in force , both general and sectoral , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in that country or by that international organisation , jurisprudential precedents as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ;


### the european data protection board shall ensure the consistent application of this regulation . to this effect , the european data protection board shall , on its own initiative or at the request of the commission , in particular : ### the european data protection board shall ensure the consistent application of this regulation . to this effect , the european data protection board shall , on its own initiative , at the request of the commission or other stakeholders , in particular :


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot be achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , addressing such economic loss and social harm should be the first and utmost priority . after that , as soon as the controller becomes aware that a breach , which would have a significantly adverse impact on the protection of the personal data or the privacy of the data subject concerned , has occurred , the controller should notify the breach to the supervisory authority without undue delay . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions , avoiding information overload for the data subject . a breach should be considered as significantly adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation , damage to reputation the notification should describe the nature of the personal data breach as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### bodies conducting historical , statistical or scientific research may publish or otherwise publicly disclose personal data only if : the data subject has given consent , subject to the conditions laid down in article 7 ; ### bodies conducting historical , statistical or scientific research may publish or otherwise publicly disclose personal data only if : the data subject has given consent , subject to the conditions laid down in article 7 ; or


### complying with the requirements for prior authorisation or prior consultation of the supervisory authority pursuant to article 34 and ; ### existence of appropriate documentation of data processing to enable compliance with the obligations arising from this regulation ;


### consent should not provide a valid legal ground for the processing of personal data , where there is a clear imbalance between the data subject and the controller . this is especially the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ‘ personal data in the employment context . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject . ### consent should not provide a valid legal ground for the processing of personal data , where there is a clear imbalance between the data subject and the controller . this is especially the case where the data subject is in a situation of dependence from the controller , among others , where personal data are processed by the employer of employees ' personal data in the employment context , or where a controller has a substantial market power with respect to certain products or services and where these products or services are offered on condition of consent to the processing of personal data , or where a unilateral and non - essential change in terms of service gives a data subject no option other than accept the change or abandon an online resource in which they have invested significant time . where the controller is a public authority , there would be an imbalance only in the specific data processing operations where the public authority can impose an obligation by virtue of its relevant public powers and the consent cannot be deemed as freely given , taking into account the interest of the data subject .


### the legitimate interests of a controller may provide a legal basis for processing , provided that the interests or the fundamental rights and freedoms of the data subject are not overriding . this would need careful assessment in particular where the data subject is a child , given that children deserve specific protection . the data subject should have the right to object the processing , on grounds relating to their particular situation and free of charge . to ensure transparency , the controller should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object , and also be obliged to document these legitimate interests . given that it is for the legislator to provide by law the legal basis for public authorities to process data , this legal ground should not apply for the processing by public authorities in the performance of their tasks . ### the legitimate interests of a person may provide a legal basis for processing , provided that the interests or the fundamental rights and freedoms of the data subject are not overriding . this would need careful assessment in particular where the data subject is a child , given that children deserve specific protection . the data subject should have the right to object the processing , on grounds relating to their particular situation and free of charge . to ensure transparency , the controller or the third parties to whom the data are sent should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object , and also be obliged to document these legitimate interests . given that it is for the legislator to provide by law the legal basis for public authorities to process data , this legal ground should not apply for the processing by public authorities in the performance of their tasks .


### in the cases referred to in paragraph 2 , the information to be provided by the controller under article 14 shall include information as to the existence of processing for a measure of the kind referred to in paragraph 1 and the envisaged effects of such processing on the data subject . ### in the cases referred to in paragraph 2 , the information to be provided by the controller under articles14 and 15 shall include information as to the existence of processing for a measure of the kind referred to in paragraph 1 , including the criteria for the processing in question and the envisaged effects of such processing on the data subject .


### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in a freely - available electronic format , the information shall be provided in electronic form which enables the data subject to make subsequent use of it , unless otherwise requested by the data subject .


### in order to demonstrate compliance with this regulation , the controller or processor should document each processing operation . each controller and processor should be obliged to co - operate with the supervisory authority and make this documentation , on request , available to it , so that it might serve for monitoring those processing operations . ### in order to demonstrate compliance with this regulation , the controller or processor should maintain relevant information on the main categories of processing undertaken . each controller and processor should be obliged to co - operate with the supervisory authority and make this documentation , on request , available to it , so that it might assist the supervisory authority in evaluating the compliance of those main categories of processing with this regulation .


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; forms for prior authorisation and prior consultation ; standard form for notification of decision of third country requesting disclosure of the the personal date ; format and procedures for the exchange of information by electronic means on binding corporate rules ; decisions under the consistency mechanism . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level in particular with the european data protection board . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises .


### the data subject withdraws consent on which the processing is based according to point of article 6 , or when the storage period consented to has expired , and where there is no other legal ground for the processing of the data ; ### the data subject withdraws consent on which the processing is based according to point of article 6 , or when the retention period consented to has expired , and where there is no other legal ground for the processing or storage of the data ;


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; standard forms in relation to the responsibility of the controller in respect of the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises .


### make available to the controller and the supervisory authority all information necessary to control compliance with the obligations laid down in this article . ### make available to the controller all information necessary to control compliance with the obligations laid down in this article .


### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages or for other reasons , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . the supervisory authority shall , without delay , communicate those measures , with full reasons , to the european data protection board and to the commission . ### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . this supervisory authority shall , without delay , communicate those measures , with full reasons , to the competent supervisory authority , the european data protection board , the commission and the controller or processor concerned .


### the commission may set out standard forms and procedures for prior authorisations and consultations referred to in paragraphs 1 and 2 , and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may set out standard forms and procedures for prior consultations referred to in paragraph 2 and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 .


### in order to strengthen the judicial protection of the data subject in situations where the competent supervisory authority is established in another member state than the one where the data subject is residing , the data subject may request any body , organisation or association aiming to protect the rights and interests of data subjects in relation to the protection of their data to bring on the data subject ' s behalf proceedings against that supervisory authority to the competent court in the other member state . ### in order to strengthen the judicial protection of the data subject in situations where the competent supervisory authority is established in another member state than the one where the data subject is residing , the data subject may request any body , organisation or association acting in the public interest to bring on the data subject ' s behalf proceedings against that supervisory authority to the competent court in the other member state .


### the public interest referred to in point of paragraph 1 must be recognised in union law or in the law of the member state to which the controller is subject . ### the public interest referred to in point of paragraph 1 must be recognised in international conventions , in union law or in the law of the member state to which the controller is subject . this derogation shall only be used for occasional transfers . in each and every case , a careful assessment of all circumstances of the transfer needs to be carried out .


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### every data subject shall have the right not to be subject to a decision that produces adverse legal effects or adversely affects this data subject , and which is based solely or predominantly on automated processing intended to evaluate certain personal aspects relating to this data subject .


### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued . ### the laws of the union and of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , respect the essence of fundamental rights and freedoms , in particular the right to the protection of personal data and be proportionate to the legitimate aim pursued .


### the controller and the processor shall document in writing the controller ' s instructions and the processor ' s obligations referred to in paragraph 2 . ### the controller and the processor shall document in writing the controller ' s instructions and the processor ' s obligations referred to in paragraph 2 . in this case the requirements of chapter ii are complied for the processor if the controller complies the requirements .


### the examination procedure should be used for the adoption of specifying standard forms in relation to the consent of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism , given that those acts are of general scope . ### the examination procedure should be used for the adoption of specifying standard forms in relation to the consent of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; standard forms in relation to the responsibility of the controller in respect of the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism , given that those acts are of general scope .


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the purposes to be pursued by the processing and the determination of the controller .


### where an objection is upheld pursuant to paragraphs 1 and 2 , the controller shall no longer use or otherwise process the personal data concerned . ### where an objection is upheld pursuant to paragraph 1 , the controller shall inform the data subject of the compelling legitimate grounds which apply in accordance with paragraph 1 or , if he does not do so , he shall no longer use or otherwise process the personal data concerned ; where the objection is upheld pursuant to paragraph 2 , the controller shall no longer use or otherwise process the personal data concerned .


### reasons of public interest in the area of public health , such as protecting against serious cross - border threats to health or ensuring high standards of quality and safety , inter alia for medicinal products or medical devices ; or ### reasons of public interest in the area of public health , such as protecting against serious cross - border threats to health or ensuring high standards of quality and safety , inter alia for medicinal products or medical devices , and if the processing is carried out by a person bound by a confidentiality obligation ; or


### a transfer based on standard data protection clauses or binding corporate rules as referred to in points , or of paragraph 2 shall not require any further authorisation . ### a transfer based on points , , or of paragraph 2 shall not require any further authorisation .


### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority . ### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a register of criminal convictions , whether complete or not , shall be kept only under the control of official authority .


### any damage which a person may suffer as a result of unlawful processing should be compensated by the controller or processor , who may be exempted from liability if they prove that they are not responsible for the damage , in particular where he establishes fault on the part of the data subject or in case of force majeure . ### any damage which a person may suffer as a result of unlawful processing should be compensated by the controller or processor , who may be exempted from liability if they prove that they are not responsible for the damage , in particular where he establishes fault on the part of the data subject or in case of force majeure . in the event of joint and several liability , a processor which has made amends for damage done to the person concerned may appeal against the controller for reimbursement if it has acted in conformity with the legal act binding it to the controller .


### the public interest referred to in point of paragraph 1 must be recognised in union law or in the law of the member state to which the controller is subject . ### the public interest referred to in point of paragraph 1 must be recognised in international conventions , union law or in the law of the member state to which the controller is subject .


### each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them . ### each natural or legal person shall have the right to take legal action against decisions of a supervisory authority concerning them or affecting them in any way .


### conduct investigations either on its own initiative or on the basis of a complaint or on request of another supervisory authority , and inform the data subject concerned , if the data subject has addressed a complaint to this supervisory authority , of the outcome of the investigations within a reasonable period ; ### conduct investigations either on its own initiative , on the basis of a complaint , on request of another supervisory authority or following a police complaint , and inform the data subject concerned , if the data subject has addressed a complaint to this supervisory authority , of the outcome of the investigations within a reasonable period ;


### where the commission decides pursuant to paragraph 5 , any transfer of personal data to the third country , or a territory or a processing sector within that third country , or the international organisation in question shall be prohibited , without prejudice to articles 42 to 44 . at the appropriate time , the commission shall enter into consultations with the third country or international organisation with a view to remedying the situation resulting from the decision made pursuant to paragraph 5 of this article . ### where the commission decides pursuant to paragraph 5 , any transfer of personal data to the third country , or a territory or a processing sector within that third country , or the international organisation in question shall be restricted under the terms of articles 42 to 44 . at the appropriate time , the commission shall enter into consultations with the third country or international organisation with a view to remedying the situation resulting from the decision made pursuant to paragraph 5 of this article .


### performing a data protection impact assessment pursuant to article 33 ; ### existence of proper policies , instructions or other guidelines to guide data processing needed to comply with the regulation as well as procedures and enforcement to make such guidelines effective ;


### the controller shall implement mechanisms for ensuring that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals . ### where the data subject is given a choice regarding the processing of personal data , the controller shall ensure that , by default , only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected or retained beyond the minimum necessary for those purposes , both in terms of the amount of the data and the time of their storage . in particular , those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals and that data subjects are able to control the distribution of their personal data .


### where a processing operation is to be carried out on behalf of a controller , the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures . ### where a processing operation is to be carried out on behalf of a controller and involves the processing of data that would permit the processor to reasonably identify the data subject , the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures .


### where applicable , that the controller intends to transfer to a third country or international organisation and on the level of protection afforded by that third country or international organisation by reference to an adequacy decision by the commission ; ### where applicable , that the controller intends to transfer to a third country or international organisation and the existence or absence of an adequacy decision by the commission ;


### in order to ensure the consistent application of this regulation throughout the union , a consistency mechanism for co - operation between the supervisory authorities themselves and the commission should be established . this mechanism should in particular apply where a supervisory authority intends to take a measure as regards processing operations that are related to the offering of goods or services to data subjects in several member states , , or to the monitoring such data subjects , or that might substantially affect the free flow of personal data . it should also apply where any supervisory authority or the commission requests that the matter should be dealt with in the consistency mechanism . this mechanism should be without prejudice to any measures that the commission may take in the exercise of its powers under the treaties . ### in order to ensure the consistent application of this regulation throughout the union , a consistency mechanism for co - operation between the supervisory authorities themselves and the commission should be established . this mechanism should in particular apply where the competent supervisory authority intends to take a measure as regards processing operations that are related to the offering of goods or services to data subjects in several member states , or to the monitoring such data subjects , or that might substantially affect the free flow of personal data . it should also apply where any supervisory authority or the commission requests that the matter should be dealt with in the consistency mechanism . this mechanism should be without prejudice to any measures that the commission may take in the exercise of its powers under the treaties .


### if the data subject ' s consent is to be given in the context of a written declaration which also concerns another matter , the requirement to give consent must be presented distinguishable in its appearance from this other matter . ### if the data subject ' s consent is to be given in the context of a written declaration which also concerns another matter , the requirement to give consent must be presented distinguishable in its appearance from this other matter . the permission of the data subject may be sought electronically , particularly in the context of information society services .


### processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract ; ### processing is necessary for the performance of a contract or of collective agreements and company - level agreements , to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract .


### the period for which the personal data will be stored ; ### the period for which the personal data will be stored , or if this is not possible , the criteria used to determine this period ;


### where the commission has taken no decision pursuant to article 41 , a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument . ### where the commission has taken no decision pursuant to article 41 , or decides that a third country , or a territory or a processing sector within that third country , or an international organisation does not ensure an adequate level of protection in accordance with article 41 , a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has adduced appropriate safeguards with respect to the protection of personal data in a legally binding instrument .


### every natural person should have the right not to be subject to a measure which is based on profiling by means of automated processing . however , such measure should be allowed when expressly authorised by law , carried out in the course of entering or performance of a contract , or when the data subject has given his consent . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject and the right to obtain human intervention and that such measure should not concern a child . ### every natural person should have the right not to be subject to a measure which is based on profiling by means of automated processing and which produces legal effects concerning that natural person or significantly affects that natural person . actual effects should be comparable in their intensity to legal effects to fall under the scope of this regulation . this is not the case for measures relating to commercial communication , like for example in the field of customer relationship management or customer acquisition . however , a measure based on profiling by automated data processing and which produces legal effects concerning a natural person or significantly affects a natural person should be allowed when expressly authorised by law , carried out in the course of entering or performance of a contract , or when the data subject has given his consent . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject and the right to obtain human intervention and that such measure should not concern a child .


### the principles of protection should apply to any information concerning an identified or identifiable person . to determine whether a person is identifiable , account should be taken of all the means likely reasonably to be used either by the controller or by any other person to identify the individual . the principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable . ### the principles of protection should apply only to specific information concerning an identified or identifiable person . to determine whether a person is identifiable , account should be taken : only of those means likely to be used by the controller or by any other natural or legal person to identify the individual , and of the likeliness of a person being identified . the principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable from the data , taking full account of the technological ' state of the art ' and technological trends .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object at any time to the processing of personal data which is based on points and of article 6 .


### if the data subject ' s consent is to be given in the context of a written declaration which also concerns another matter , the requirement to give consent must be presented distinguishable in its appearance from this other matter . ### if the data subject ' s consent is to be given in the context of a written declaration which also concerns another matter , the requirement to give consent must be presented conspicuously in its appearance .


### the transfer is necessary for important grounds of public interest ; or ### the transfer is necessary for important grounds of public interest for example in cases of international data transfers between competition authorities , tax or customs administrations , financial supervisory authorities , between services competent for social security matters , or to competent authorities for the prevention , investigation , detection and prosecution of criminal offences ; or


### each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them . ### each controller , processor or other natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them .


### processed under the responsibility and liability of the controller , who shall ensure and demonstrate for each processing operation the compliance with the provisions of this regulation . ### processed under the responsibility and liability of the controller , who shall ensure and , if required to do so , demonstrate compliance of the controller ' s processing with the provisions of this regulation to the supervisory authority having competence under article 51 .


### these derogations should in particular apply to data transfers required and necessary for the protection of important grounds of public interest , for example in cases of international data transfers between competition authorities , tax or customs administrations , financial supervisory authorities , between services competent for social security matters , or to competent authorities for the prevention , investigation , detection and prosecution of criminal offences . ### these derogations should in particular apply to data transfers required and necessary for the protection of important grounds of public interest , for example in cases of international data transfers between competition authorities , tax or customs administrations , financial supervisory authorities , between services competent for social security matters , between bodies responsible for fighting fraud in sports , or to competent authorities for the prevention , investigation , detection and prosecution of criminal offences . transferring personal data for such important grounds of public interest should only be used for occasional transfers . in each and every case , a careful assessment of all circumstances of the transfer needs to be carried out .