### the processing of personal data for other purposes should be only allowed where the processing is compatible with those purposes for which the data have been initially collected , in particular where the processing is necessary for historical , statistical or scientific research purposes . where the other purpose is not compatible with the initial one for which the data are collected , the controller should obtain the consent of the data subject for this other purpose or should base the processing on another legitimate ground for lawful processing , in particular where provided by union law or the law of the member state to which the controller is subject . in any case , the application of the principles set out by this regulation and in particular the information of the data subject on those other purposes should be ensured . ### the processing of personal data for other purposes should be only allowed where the processing is compatible with those purposes for which the data have been initially collected , such as where the processing is necessary for historical , statistical or scientific purposes . where the other purpose is not compatible with the initial one for which the data are collected , the controller should obtain the consent of the data subject for this other purpose . in any case , the application of the principles set out by this regulation and in particular the information of the data subject on those other purposes should be ensured .


### derogating from the prohibition on processing sensitive categories of data should also be allowed if done by a law , and subject to suitable safeguards , so as to protect personal data and other fundamental rights , where grounds of public interest so justify and in particular for health purposes , including public health and social protection and the management of health - care services , especially in order to ensure the quality and cost - effectiveness of the procedures used for settling claims for benefits and services in the health insurance system , or for historical , statistical and scientific research purposes . ### derogating from the prohibition on processing sensitive categories of data should also be allowed if done by a law , and subject to suitable safeguards , so as to protect personal data and other fundamental rights , where grounds of public interest so justify and in particular for health purposes , including public health and social protection and the management of health - care services , including information sent via electronic text messages or e - mail to patients regarding appointments at hospitals or clinics , especially in order to ensure the quality and cost - effectiveness of the procedures used for settling claims for benefits and services in the health insurance system , or for historical , statistical and scientific research purposes .


### if the data processed by a controller do not permit the controller to identify a natural person , the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . in case of a request for access , the controller should be entitled to ask the data subject for further information to enable the data controller to locate the personal data which that person seeks . ### if the data processed by a controller do not permit the controller to identify a natural person , the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . in case of a request for access , the controller should be entitled to ask the data subject for further information to enable the data controller to locate the personal data which that person seeks . the data controller should not invoke a possible lack of information to refuse a request of access , when this information can be provided by the data subject to enable such access .


### if the data processed by a controller do not permit the controller to identify a natural person , the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . in case of a request for access , the controller should be entitled to ask the data subject for further information to enable the data controller to locate the personal data which that person seeks . ### if the data processed by a controller do not permit the controller to identify a natural person , the data controller should not be obliged to make use of additional information in order to identify the data subject for the sole purpose of complying with any provision of this regulation . in case of a request for access , the controller should be entitled to ask the data subject for further information to enable the data controller to locate the personal data which that person seeks .


### the principles of fair and transparent processing require that the data subject should be informed in particular of the existence of the processing operation and its purposes , how long the data will be stored , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data . ### the principles of fair and transparent processing require that the data subject should be informed in particular of the existence of the processing operation and its purposes , the criteria enabling determination of how long the data will be stored for each purpose , on the existence of the right of access , rectification or erasure and on the right to lodge a complaint . where the data are collected from the data subject , the data subject should also be informed whether they are obliged to provide the data and of the consequences , in cases they do not provide such data .


### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , for what period , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject . ### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , the criteria which may be used to determine for how long the data will be stored for each purpose , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject .


### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , for what period , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject . ### any person should have the right of access to personal data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the personal data are processed , for what period , which recipients receive the personal data , what is the logic of the personal data that are undergoing the processing and what might be , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property , such as in relation to copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject .


### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , for what period , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . this right should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject . ### any person should have the right of access to data which has been collected concerning them , and to exercise this right easily , in order to be aware and verify the lawfulness of the processing . every data subject should therefore have the right to know and obtain communication in particular for what purposes the data are processed , for what period , which recipients receive the data , what is the logic of the data that are undergoing the processing and what might be , at least when based on profiling , the consequences of such processing . every data subject should furthermore have the right to communication of the personal data undergoing processing and , on electronic request , an electronic copy of the non - commercial data undergoing processing in an interoperable and structured format which allows for further use . these rights should not adversely affect the rights and freedoms of others , including trade secrets or intellectual property and in particular the copyright protecting the software . however , the result of these considerations should not be that all information is refused to the data subject .


### any person should have the right to have personal data concerning them rectified and a ‘ right to be forgotten’ where the retention of such data is not in compliance with this regulation . in particular , data subjects should have the right that their personal data are erased and no longer processed , where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed , where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this regulation . this right is particularly relevant , when the data subject has given their consent as a child , when not being fully aware of the risks involved by the processing , and later wants to remove such personal data especially on the internet . however , the further retention of the data should be allowed where it is necessary for historical , statistical and scientific research purposes , for reasons of public interest in the area of public health , for exercising the right of freedom of expression , when required by law or where there is a reason to restrict the processing of the data instead of erasing them . ### any person should have the right to have personal data concerning them rectified and the right to have such personal data erased where the retention of such data is not in compliance with this regulation . in particular , data subjects should have the right that their personal data are erased and no longer processed , where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed , where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this regulation . this right is particularly relevant , when the data subject has given their consent as a child , when not being fully aware of the risks involved by the processing , and later wants to remove such personal data especially on the internet . however , the further retention of the data should be allowed where it is necessary for historical , statistical and scientific research purposes , for reasons of public interest in the area of public health , for exercising the right of freedom of expression , when required by law or where there is a reason to restrict the processing of the data instead of erasing them . also , the right to erasure shall not apply when the retention of personal data is necessary for the performance of a contract with the data subject , or when there is a regulatory requirement to retain this data , or for the prevention of financial crime .


### any person should have the right to have personal data concerning them rectified and a ‘ right to be forgotten’ where the retention of such data is not in compliance with this regulation . in particular , data subjects should have the right that their personal data are erased and no longer processed , where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed , where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this regulation . this right is particularly relevant , when the data subject has given their consent as a child , when not being fully aware of the risks involved by the processing , and later wants to remove such personal data especially on the internet . however , the further retention of the data should be allowed where it is necessary for historical , statistical and scientific research purposes , for reasons of public interest in the area of public health , for exercising the right of freedom of expression , when required by law or where there is a reason to restrict the processing of the data instead of erasing them . ### any person should have the right to have personal data concerning them rectified and a ‘ right to be forgotten’ where the retention of such data is not in compliance with this regulation . in particular , data subjects should have the right that their personal data are erased and no longer processed , where the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed , where data subjects have withdrawn their consent for processing or where they object to the processing of personal data concerning them or where the processing of their personal data otherwise does not comply with this regulation . this right is particularly relevant , when the data subject has given their consent as a child , when not being fully aware of the risks involved by the processing , and later wants to remove such personal data especially on the internet . however , the further retention of the data should be allowed where it is necessary for historical , statistical , aggregated and scientific research purposes , for reasons of public interest in the area of public health , for the purpose of processing health data for healthcare purposes , for exercising the right of freedom of expression , when required by law or where there is a reason to restrict the processing of the data instead of erasing them .


### to strengthen the ‘ right to be forgotten’ in the online environment , the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform third parties which are processing such data that a data subject requests them to erase any links to , or copies or replications of that personal data . to ensure this information , the controller should take all reasonable steps , including technical measures , in relation to data for the publication of which the controller is responsible . in relation to a third party publication of personal data , the controller should be considered responsible for the publication , where the controller has authorised the publication by the third party . ### to strengthen the right to erasure in the online environment , such right should also be extended in such a way that a controller who has transferred the personal data or made them public without being instructed to do so by the data subject should be obliged to inform third parties which are processing such data that a data subject requests them to erase any links to , or copies or replications of that personal data . to ensure this information , the controller should take all reasonable steps , including technical measures , in relation to data for the publication of which the controller is responsible . in relation to a third party publication of personal data , the controller should be considered responsible for the publication , where the controller has authorised the publication by the third party .


### every natural person should have the right not to be subject to a measure which is based on profiling by means of automated processing . however , such measure should be allowed when expressly authorised by law , carried out in the course of entering or performance of a contract , or when the data subject has given his consent . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject and the right to obtain human intervention and that such measure should not concern a child . ### every data subject should have the right not to be subject to a decision which is based on profiling by means of automated processing and which produces adverse legal effects or adversely affects this data subject . this is not the case for measures relating to a commercial communication , for example in the field of customer relationship management or customer acquisition . however , such decision should be allowed when authorised by law , or when processing is lawful under points to of article 6 . in any case , such processing should be subject to suitable safeguards , including specific information of the data subject and the right to obtain human intervention and that such measure should not concern a child . profiling should not have the effects of discriminating against individuals on the basis , for instance , of race or ethnic origin , religion or sexual orientation , without prejudice to article 9 , paragraph 2 .


### comprehensive responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller ' s behalf should be established . in particular , the controller should ensure and be obliged to demonstrate the compliance of each processing operation with this regulation . ### overall responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller ' s behalf should be established in order to ensure accountability . in particular , the controller should ensure and be obliged to demonstrate the compliance of each processing operation with this regulation . otherwise unnecessary data processing may not be justified on the basis of the need to respect this obligation .


### the protection of the rights and freedoms of data subjects with regard to the processing of personal data require that appropriate technical and organisational measures are taken , both at the time of the design of the processing and at the time of the processing itself , to ensure that the requirements of this regulation are met . in order to ensure and demonstrate compliance with this regulation , the controller should adopt internal policies and implement appropriate measures , which meet in particular the principles of data protection by design and data protection by default . ### to meet consumer and business expectations around the protection of the rights and freedoms of data subjects with regard to the processing of personal data , appropriate organisational measures should be taken , both at the time of the design of the processing and its underlying technologies as well as at the time of the processing itself , to ensure that the requirements of this regulation are met . measures having as an objective to increase consumer information and ease of choice should be encouraged , based on industry cooperation and favouring innovative solutions , products and services . data protection by design is the process by which data protection and privacy are integrated in the development of products and services through both technical and organisational measures . data protection by default means that products and services are by default configured in a way that limits the processing and especially the disclosure of personal data . in particular , personal data should not be disclosed to an unlimited number of persons by default .


### the protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processor , also in relation to the monitoring by and measures of supervisory authorities , requires a clear attribution of the responsibilities under this regulation , including where a controller determines the purposes , conditions and means of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller . ### the protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processor , also in relation to the monitoring by and measures of supervisory authorities , requires a clear attribution of the responsibilities under this regulation , including where a controller determines the purposes of the processing jointly with other controllers or where a processing operation is carried out on behalf of a controller .


### in order to demonstrate compliance with this regulation , the controller or processor should document each processing operation . each controller and processor should be obliged to co - operate with the supervisory authority and make this documentation , on request , available to it , so that it might serve for monitoring those processing operations . ### in order to demonstrate compliance with this regulation , the controller should document each processing operation under its responsibility . each controller should be obliged to co - operate with the supervisory authority and make this documentation , on request , available to it , so that it might serve for monitoring those processing operations .


### in order to maintain security and to prevent processing in breach of this regulation , the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks . these measures should ensure an appropriate level of security , taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected . when establishing technical standards and organisational measures to ensure security of processing , the commission should promote technological neutrality , interoperability and innovation , and , where appropriate , cooperate with third countries . ### in order to maintain security and to prevent processing in breach of this regulation , the controller or processor should evaluate the risks inherent to the processing and implement measures to mitigate those risks . in particular , the controller or processor should duly take into account the greater risks arising from the processing of personal data of the data subject , due to the sensitive nature of the data . these measures should ensure an appropriate level of security , taking into account the state of the art and the costs of their implementation in relation to the risks and the nature of the personal data to be protected . when establishing technical standards and organisational measures to ensure security of processing , technological neutrality , interoperability and innovation should be promoted , and , where appropriate , cooperate with third countries should be encouraged .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot be achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , addressing such economic loss and social harm should be the first and utmost priority . after that , as soon as the controller becomes aware that a breach , which would have a significantly adverse impact on the protection of the personal data or the privacy of the data subject concerned , has occurred , the controller should notify the breach to the supervisory authority without undue delay . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions , avoiding information overload for the data subject . a breach should be considered as significantly adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation , damage to reputation the notification should describe the nature of the personal data breach as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that a breach which would have a significant impact on the data subject has occurred , the controller should notify the breach to the supervisory authority without undue delay . the individuals whose personal data could be significantly adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as significantly adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### associations or other bodies representing categories of controllers should be encouraged to draw up codes of conduct , within the limits of this regulation , so as to facilitate the effective application of this regulation , taking account of the specific characteristics of the processing carried out in certain sectors . ### associations or other bodies representing categories of controllers should be encouraged to draw up codes of conduct , within the limits of this regulation , so as to facilitate the effective application of this regulation , taking account of the specific characteristics of the processing carried out in certain sectors . such codes should make compliance with this regulation easier for industry .


### the commission may decide with effect for the entire union that certain third countries , or a territory or a processing sector within a third country , or an international organisation , offer an adequate level of data protection , thus providing legal certainty and uniformity throughout the union as regards the third countries or international organisations which are considered to provide such level of protection . in these cases , transfers of personal data to these countries may take place without needing to obtain any further authorisation . ### the commission may decide with effect for the entire union that certain third countries , or a territory or a processing sector within a third country , or an international organisation , offer an adequate level of data protection , thus providing legal certainty and uniformity throughout the union as regards the third countries or international organisations which are considered to provide such level of protection . in these cases , transfers of personal data to these countries may take place without needing to obtain any further authorisation . the commission may also decide , having given notice and a complete justification to the third country , to revoke such a decision .


### the commission may equally recognise that a third country , or a territory or a processing sector within a third country , or an international organisation offers no adequate level of data protection . consequently the transfer of personal data to that third country should be prohibited . in that case , provision should be made for consultations between the commission and such third countries or international organisations . ### the commission may equally recognise that a third country , or a territory or a processing sector within a third country , or an international organisation offers no adequate level of data protection . consequently the transfer of personal data to that third country should be authorised subject to appropriate guarantees or under the derogations set out in this regulation .


### the possibility for the controller or processor to use standard data protection clauses adopted by the commission or by a supervisory authority should neither prevent the possibility for controllers or processors to include the standard data protection clauses in a wider contract nor to add other clauses as long as they do not contradict , directly or indirectly , the standard contractual clauses adopted by the commission or by a supervisory authority or prejudice the fundamental rights or freedoms of the data subjects . ### the possibility for the controller or processor to use standard data protection clauses adopted by the commission or by a supervisory authority should neither prevent the possibility for controllers or processors to include the standard data protection clauses in a wider contract nor to add other clauses as long as they do not contradict , directly or indirectly , the standard contractual clauses adopted by the commission or by a supervisory authority or prejudice the fundamental rights or freedoms of the data subjects . in some scenarios , it may be appropriate to encourage controllers and processors to provide even more robust safeguards via additional contractual commitments that supplement standard data protection clauses .


### these derogations should in particular apply to data transfers required and necessary for the protection of important grounds of public interest , for example in cases of international data transfers between competition authorities , tax or customs administrations , financial supervisory authorities , between services competent for social security matters , or to competent authorities for the prevention , investigation , detection and prosecution of criminal offences . ### these derogations should in particular apply to data transfers required and necessary for the protection of important grounds of public interest , for example in cases of international data transfers between competition authorities , tax or customs administrations , financial supervisory authorities , between services competent for social security matters , between bodies responsible for fighting fraud in sports , or to competent authorities for the prevention , investigation , detection and prosecution of criminal offences . transferring personal data for such important grounds of public interest should only be used for occasional transfers . in each and every case , a careful assessment of all circumstances of the transfer needs to be carried out .


### each supervisory authority should be provided with the adequate financial and human resources , premises and infrastructure , which is necessary for the effective performance of their tasks , including for the tasks related to mutual assistance and co - operation with other supervisory authorities throughout the union . ### each supervisory authority should be provided with the adequate financial and human resources , paying particular attention to ensuring adequate technical skills of staff , premises and infrastructure , which is are necessary for the effective performance of their tasks , including for the tasks related to mutual assistance and co - operation with other supervisory authorities throughout the union .


### the general conditions for the members of the supervisory authority should be laid down by law in each member state and should in particular provide that those members should be either appointed by the parliament or the government of the member state , and include rules on the personal qualification of the members and the position of those members . ### the general conditions for the members of the supervisory authority should be laid down by law in each member state and should in particular provide that those members should be either appointed by the parliament or the government of the member state taking due care to minimise the possibility of political interference , and include rules on the personal qualification of the members , the avoidance of conflicts of interest and the position of those members .


### where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union takes place in more than one member state , one single supervisory authority should be competent for monitoring the activities of the controller or processor throughout the union and taking the related decisions , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors . ### where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union takes place in more than one member state , one single supervisory authority should be competent for monitoring the processing activities of the controller or processor throughout the union and taking the related decisions , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors . by way of derogation from article 51 , when the processing of personal data is not mainly carried out by the main establishment , but by one of the other establishments of the controller or processor situated in the european union , the competent supervisory authority for those processing operations shall be that of the member state where that other establishment is situated . in keeping with the provisions of chapter vii , this derogation shall be without prejudice to the right of the supervisory authority of the member state where the main establishment is situated to require an additional declaration .


### where the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union takes place in more than one member state , one single supervisory authority should be competent for monitoring the activities of the controller or processor throughout the union and taking the related decisions , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors . ### where the processing of personal data takes place in more than one member state , one single supervisory authority should be competent for monitoring the activities of the controller or processor throughout the union and taking the related decisions , in order to increase the consistent application , provide legal certainty and reduce administrative burden for such controllers and processors .


### in order to ensure the consistent application of this regulation throughout the union , a consistency mechanism for co - operation between the supervisory authorities themselves and the commission should be established . this mechanism should in particular apply where a supervisory authority intends to take a measure as regards processing operations that are related to the offering of goods or services to data subjects in several member states , , or to the monitoring such data subjects , or that might substantially affect the free flow of personal data . it should also apply where any supervisory authority or the commission requests that the matter should be dealt with in the consistency mechanism . this mechanism should be without prejudice to any measures that the commission may take in the exercise of its powers under the treaties . ### in order to ensure the consistent application of this regulation throughout the union , a consistency mechanism for co - operation between the supervisory authorities themselves and the commission should be established . this mechanism should in particular apply where a supervisory authority intends to take a measure as regards processing operations that are related to the offering of goods or services to data subjects in several member states , or to the monitoring of such data subjects , or that might substantially affect the free flow of personal data . it should also apply where any supervisory authority or the commission requests that the matter should be dealt with in the consistency mechanism . furthermore , the data subjects should have the right to obtain consistency , if they deem a measure by a data protection authority of a member state has not fulfilled this criterion . this mechanism should be without prejudice to any measures that the commission may take in the exercise of its powers under the treaties .


### at union level , a european data protection board should be set up . it should replace the working party on the protection of individuals with regard to the processing of personal data established by directive 95 / 46 / ec . it should consist of a head of a supervisory authority of each member state and of the european data protection supervisor . the commission should participate in its activities . the european data protection board should contribute to the consistent application of this regulation throughout the union , including by advising the commission and promoting co - operation of the supervisory authorities throughout the union . the european data protection board should act independently when exercising its tasks . ### the european data protection board should strengthen the dialogue with concerned stakeholders such as data subjects’ associations , consumer organisations and other relevant stakeholders . this group of experts and stakeholders should be determined by the board itself and should focus on issues that are of concern to all involved parties and should make the board aware of these issues . further to this , the chair of the board may invite representatives of the european parliament or other relevant bodies to attend the meetings of the board .


### every data subject should have the right to lodge a complaint with a supervisory authority in any member state and have the right to a judicial remedy if they consider that their rights under this regulation are infringed or where the supervisory authority does not react on a complaint or does not act where such action is necessary to protect the rights of the data subject . ### every data subject should have the right to lodge a complaint with a supervisory authority in any member state and have the right to a judicial remedy if they consider that their rights under this regulation are infringed or where the supervisory authority does not react on a complaint or does not act where such action is necessary to protect the rights of the data subject . if the data subject deems consistency is not fulfilled , a complaint to the european data protection board can be filed .


### any damage which a person may suffer as a result of unlawful processing should be compensated by the controller or processor , who may be exempted from liability if they prove that they are not responsible for the damage , in particular where he establishes fault on the part of the data subject or in case of force majeure . ### any damage which a person may suffer as a result of unlawful processing should be compensated by the controller , who may be exempted from liability if they prove that they are not responsible for the damage , in particular where he establishes fault on the part of the data subject or in case of force majeure .


### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context . therefore , in order to regulate the processing of employees’ personal data in the employment context , member states should be able , within the limits of this regulation , to adopt by law specific rules for the processing of personal data in the employment sector . ### the general principles on the protection of individuals with regard to the processing of personal data should also be applicable to the employment context . therefore , in order to regulate the processing of employees ' personal data in the employment context , member states should be able , within the limits of this regulation , to adopt by law specific rules for the processing of personal data in the employment sector . by virtue of collective agreements , the provisions of the regulation may be disregarded .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted specifying the technical formats for giving consent ; specifying conditions of modes based on icons and other graphic features for provision of information ; specifying the criteria and conditions for fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; criteria and requirements for verification of the responsibility of the controller ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; codes of conduct ; criteria and requirements for certification mechanisms ; the adequate level of protection afforded by a third country or an international organisation ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level and in particular with the european data protection board . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission . in implementing the provisions of this regulation , it should be ensured that no mandatory requirements for specific technical features are imposed on products and services , including terminal or other electronic communications equipment , which could impede the placing of equipment on the market and the free circulation of such equipment in and between member states . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises in consultation with the parties concerned , as these measures should not overly burden those enterprises .


### this regulation shall be without prejudice to the application of directive 2000 / 31 / ec , in particular of the liability rules of intermediary service providers in articles 12 to 15 of that directive . ### this regulation shall be without prejudice to the application of directive 2000 / 31 / ec , in particular of the liability rules of intermediary service providers in articles 12 to 15 of that directive , as well as to the specific provisions of union law or law of member states related to processing of data , especially with regard to legally protected interests , when they provide for a stricter protection than the provisions of this regulation ;


### this regulation applies to the processing of personal data wholly or partly by automated means , and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system . ### this regulation applies to the processing of personal data wholly or partly by automated means , without discrimination between such processing means and the technology used , and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system .


### this regulation applies to the processing of personal data wholly or partly by automated means , and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system . ### this regulation applies &#8211 ; without any discrimination over the methods used &#8211 ; to the processing of personal data wholly or partly by automated means , and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system .


### this regulation applies to the processing of personal data wholly or partly by automated means , and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system . ### this regulation applies to the processing of personal data wholly or partly by automated means , without discrimination between such processing means , and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system .


### by the member states when carrying out activities which fall within the scope of chapter 2 of the treaty on european union ; ### by the member states when carrying out activities which fall within the scope of chapter 2 of title v of the treaty on european union ;


### this regulation applies to the processing of personal data of data subjects residing in the union by a controller not established in the union , where the processing activities are related to : ### this regulation applies to the processing of personal data of data subjects domiciled in the union by a controller not established in the union , where the processing activities are related to :


### this regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the union . ### this regulation applies to the processing of personal data in the union or in a place where the national law of a member state applies by virtue of international law .


### ' the data subject ' s consent ' means any freely given specific , informed and explicit indication of his or her wishes by which the data subject , either by a statement or by a clear affirmative action , signifies agreement to personal data relating to them being processed ; ### ‘ the data subject ' s consent’ means any freely given specific , informed and unambiguous indication of his or her wishes by which the data subject signifies agreement to personal data relating to them being processed . silence or inactivity does not in itself indicate consent ;


### ' controller ' means the natural or legal person , public authority , agency or any other body which alone or jointly with others determines the purposes , conditions and means of the processing of personal data ; where the purposes , conditions and means of processing are determined by union law or member state law , the controller or the specific criteria for his nomination may be designated by union law or by member state law ; ### ‘ controller’ means the natural or legal person , public authority , agency or any other body which alone or jointly with others determines the purposes of the processing of personal data ; where the purposes , conditions and means of processing are determined by union law or member state law , the controller or the specific criteria for his nomination may be designated by union law or by member state law ;


### ‘ main establishment’ means as regards the controller , the place of its establishment in the union where the main decisions as to the purposes , conditions and means of the processing of personal data are taken ; if no decisions as to the purposes , conditions and means of the processing of personal data are taken in the union , the main establishment is the place where the main processing activities in the context of the activities of an establishment of a controller in the union take place . as regards the processor , ' main establishment ' means the place of its central administration in the union ; ### ‘ main establishment’ means both as regards the controller and as regards the processor , the place constituting its official seat in the union , if that is the place where the main decisions of the institution , enterprise , or group are taken , or the latter place , if different ;


### ‘ binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a member state of the union for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings ; ### ‘ binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a member state of the union for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings in or outside the union ;


### processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract ; ### processing is necessary for the performance of a contract or of collective agreements and company - level agreements , to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract .


### processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller ; ### processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller ; or in the public interest ,


### processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract ; ### processing is necessary for the performance or execution of a contract or of collective agreements and company - level agreements , to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract ;


### processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller in the field of employment law in so far as it is authorised by union law or member state law providing for adequate safeguards ; or ### processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller in the field of employment law in so far as it is authorised by union law , member state law , or collective agreements on the labour market providing for adequate safeguards ; or


### the processing relates to personal data which are manifestly made public by the data subject ; or ### the processing relates to personal data which are manifestly made public by the data subject or which are freely transferred to the controller on the initiative of data subject and which are processed for the specific purpose determined by data subject and in his interest ; or


### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state law which shall provide for suitable measures to safeguard the data subject ' s legitimate interests ; or ### processing and sharing is necessary for the performance of a task carried out in the public interest , on the basis of union law , member state law , international conventions to which the union or a member state is a party , which shall provide for suitable measures to safeguard the data subject ' s fundamental rights and legitimate interests ; or


### processing of data concerning health is necessary for health purposes and subject to the conditions and safeguards referred to in article 81 ; or ### processing and sharing of data concerning health is necessary for health purposes , including for historical , statistical or scientific research and subject to the conditions and safeguards referred to in article 81 ; or


### processing is necessary for historical , statistical or scientific research purposes subject to the conditions and safeguards referred to in article 83 ; or ### processing and sharing is necessary for historical , statistical or scientific research purposes subject to the conditions and safeguards referred to in article 83 ; or


### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , trade - union membership , and the processing of genetic data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited . ### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , trade - union membership and activities , and the processing of genetic data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited . in particular , this would include safeguards to prevent the blacklisting of workers , for example in relation to their trade union activities or health and safety representative roles .


### processing is necessary for the performance of a task carried out in the public interest , on the basis of union law , or member state law which shall provide for suitable measures to safeguard the data subject ' s legitimate interests ; or ### processing is necessary for the performance of a task carried out in the public interest , on the basis of international conventions to which the eu or a member state is a party , union law , or member state law which shall provide for suitable measures to safeguard the data subject ' s legitimate interests ; or


### processing of data concerning health is necessary for health purposes and subject to the conditions and safeguards referred to in article 81 ; or ### processing of data concerning health and insurance is necessary for health purposes and subject to the conditions and safeguards referred to in article 81 ; or


### processing is necessary for historical , statistical or scientific research purposes subject to the conditions and safeguards referred to in article 83 ; o ### processing is necessary for historical , statistical or scientific research purposes or for preliminary official or administrative investigation to determine biological parentage , subject to the conditions and safeguards referred to in article 83 ; o


### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority . ### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , for the prevention or detection of fraud , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority .


### the controller shall have transparent and easily accessible policies with regard to the processing of personal data and for the exercise of data subjects ' rights . ### the controller shall have transparent policies with regard to the processing of personal data and for the exercise of data subjects ' rights and on request for this purpose shall provide to everybody the information set out in points through of article 28 in an appropriate manner .


### the controller shall have transparent and easily accessible policies with regard to the processing of personal data and for the exercise of data subjects ' rights . ### the controller shall observe transparency and accessibility criteria with regard to the processing of personal data and for the exercise of data subjects ' rights . to that end it may disseminate those criteria by framing policies to be made known to all data subjects .


### rights in relation to recipients ### notification requirement in the event of rectification and erasure


### the existence of the right to request from the controller rectification or erasure of personal data concerning the data subject or to object to the processing of such personal data ; ### the existence of the right to request from the controller rectification in accordance with article 16 or erasure of personal data concerning the data subject or to object to the processing of such personal data ;


### the data subject objects to the processing of personal data pursuant to article 19 ; ### the data subject objects to the processing of personal data pursuant to article 19 , and the objection is upheld ;


### the data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data , especially in relation to personal data which are made available by the data subject while he or she was a child , where one of the following grounds applies : ### the data subject has the right to obtain from the controller the erasure of personal data relating to them and the abstention from further processing of such data , unless the data controller is a public authority or an entity commissioned by a public authority or otherwise acting on the behalf of the public authority , including in relation to personal data which are made available by the data subject while he or she was a child , where one of the following grounds applies :


### the processing is unlawful and the data subject opposes their erasure and requests the restriction of their use instead ; ### the data are no longer required for the purpose of storage but they cannot be deleted on account of statutory , statutes - based or contractual periods for which they are required to be kept ;


### personal data referred to in paragraph 4 may , with the exception of storage , only be processed for purposes of proof , or with the data subject ' s consent , or for the protection of the rights of another natural or legal person or for an objective of public interest . ### personal data blocked pursuant to paragraph 4 may , with the exception of storage , only be processed : with the data subject ' s consent ; if they are to be used for scientific purposes ; to overcome a lack of evidence ; or where this is essential for other reasons in the overriding interest of the controller or of a third party ; and it would be permissible to process the data for this purpose if they were not blocked .


### the data subject shall have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain from the controller a copy of data undergoing processing in an electronic and structured format which is commonly used and allows for further use by the data subject . ### the data subject shall have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain , on request , from the controller , where technically feasible a copy of data undergoing processing in an electronic , interoperable and structured format which is commonly used and allows for further use by the data subject .


### where the data subject has provided the personal data and the processing is based on consent or on a contract , the data subject shall have the right to transmit those personal data and any other information provided by the data subject and retained by an automated processing system , into another one , in an electronic format which is commonly used , without hindrance from the controller from whom the personal data are withdrawn . ### where the data subject has provided the personal data and the processing is based on consent or on a contract , the data subject shall have the right to transmit those personal data and any other information provided by the data subject , where technically feasible and retained by an automated processing system .


### the commission may specify the electronic format referred to in paragraph 1 and the technical standards , modalities and procedures for the transmission of personal data pursuant to paragraph 2 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the electronic format , related functionalities and procedures for the transmission of personal data pursuant to paragraph 2 , shall be determined by the controller by reference to the most appropriate industry standards available or as defined by industry stakeholders or standardisation bodies . the commission shall promote and assist industry , stakeholders and standardisation bodies in the mapping and adoption of technical standards , modalities and procedures for the transmission of personal data pursuant to paragraph 2 .


### right to data portability ### right to obtain data


### the data subject shall have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain from the controller a copy of data undergoing processing in an electronic and structured format which is commonly used and allows for further use by the data subject . ### the data subject shall , unless it would require a disproportionate effort by the data controller , have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain from the controller a copy of data undergoing processing .


### the data subject shall have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain from the controller a copy of data undergoing processing in an electronic and structured format which is commonly used and allows for further use by the data subject . ### the data subject shall have the right , where personal data are processed by electronic means and in a structured format , to obtain from the controller a copy of data undergoing processing in an electronic and structured format which is commonly used and allows for further use by the data subject . where the format requested by the data subject differs from the processing format , the controller may impose a charge for conversion at a level which may not exceed the cost of the service provided at market prices .


### the data subject shall have the right , where personal data are processed by electronic means and in a structured and commonly used format , to obtain from the controller a copy of data undergoing processing in an electronic and structured format which is commonly used and allows for further use by the data subject . ### where the data subject has provided the personal data and where personal data are processed by electronic means , the data subject shall have the right to obtain from the controller a copy of the provided personal data in an electronic and structured format which is commonly used and allows for further use by the data subject , without hindrance from the controller from whom the personal data are withdrawn .


### where the data subject has provided the personal data and the processing is based on consent or on a contract , the data subject shall have the right to transmit those personal data and any other information provided by the data subject and retained by an automated processing system , into another one , in an electronic format which is commonly used , without hindrance from the controller from whom the personal data are withdrawn . ### where the data subject has provided the personal data and the processing is based on consent or on a contract , the data subject shall have the right to transmit those personal data and any other information provided by the data subject and retained by an automated processing system , into another one , in an electronic format which is commonly used , without hindrance from the controller from whom the personal data are withdrawn . the controller from whom the personal data are withdrawn shall delete those data , unless their continued processing is covered by another legal provision in force . union and member state laws may regulate cases where there is a legal obligation to store data , based on objectives of public interest proportionate to the aim pursued , and respecting the essence of the right to the protection of personal data .


### where the data subject has provided the personal data and the processing is based on consent or on a contract , the data subject shall have the right to transmit those personal data and any other information provided by the data subject and retained by an automated processing system , into another one , in an electronic format which is commonly used , without hindrance from the controller from whom the personal data are withdrawn . ### where the data subject has provided the personal data and the processing is based on consent or on a contract , the data subject shall have the right to transmit those personal data retained by an automated processing system , into another one , in an electronic format which is commonly used , with the exception of data prejudicial to business confidentiality which are provided in the form of hard copies , without hindrance from the controller from whom the personal data are withdrawn .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object in the cases of points , and of article 6 on predominant , and protection - worthy grounds relating to their particular situation , at any time to the processing of their personal data . in the case of a justified objection the processing by the controller may no longer refer to this data


### restrictions ### extensions and restrictions


### union or member state law may restrict by way of a legislative measure the scope of the obligations and rights provided for in points to of article 5 and articles 11 to 20 and article 32 , when such a restriction constitutes a necessary and proportionate measure in a democratic society to safeguard : ### union or member state law may extend or restrict by way of a legislative measure the scope of the obligations and rights provided for in points to of article 5 and articles 11 to 20 and article 32 , when such an extension or restriction constitutes a necessary and proportionate measure in a democratic society to safeguard :


### having regard to the state of the art and the cost of implementation , the controller shall , both at the time of the determination of the means for processing and at the time of the processing itself , implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject . ### where required , mandatory measures may be adopted to ensure that categories of goods or services are designed and have default settings meeting the requirements of this regulation relating to the protection of individuals with regard to the processing of personal data . such measures shall be based on standardisation pursuant to [ regulation . . . / 2012 of the european parliament and of the council on european standardisation , amending council directives 89 / 686 / eec and 93 / 15 / eec and directives 94 / 9 / ec , 94 / 25 / ec , 95 / 16 / ec , 97 / 23 / ec , 98 / 34 / ec , 2004 / 22 / ec , 2007 / 23 / ec , 2009 / 23 / ec and 2009 / 105 / ec of the european parliament and of the council and repealing decision 87 / 95 / eec and decision no 1673 / 2006 / ec ] .


### data protection by design and by default ### data protection by design


### where a processing operation is to be carried out on behalf of a controller , the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures . ### where a processing operation is to be carried out on behalf of a controller and which involves the processing of data that would permit the processor to reasonably identify the data subject , the controller shall choose a processor providing sufficient guarantees to implement appropriate technical and organisational measures and procedures in such a way that the processing will meet the requirements of this regulation and ensure the protection of the rights of the data subject , in particular in respect of the technical security measures and organizational measures governing the processing to be carried out and shall ensure compliance with those measures . the controller remains solely responsible for ensuring compliance with the requirements of this regulation .


### the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected , having regard to the state of the art and the costs of their implementation . ### the controller and the processor shall implement appropriate technical and organisational measures , including pseudonymisation , to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected , having regard to the state of the art and the costs of their implementation . notwithstanding the first subparagraph , the controller and the processor shall only be burdened with measures that are proportionate to the risk of data processing reflected by the nature of the personal data to be processed .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a major personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours .


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### where a personal data breach is likely to have a significant adverse effect on the interests , rights and freedoms of the data subjects , especially their right to privacy , the controller , after having become aware of it , shall without unreasonable delay notify the personal data breach to the supervisory authority .


### pursuant to point of article 26 , the processor shall alert and inform the controller immediately after the establishment of a personal data breach . ### the processor shall alert and inform the controller immediately after the establishment of a personal data breach .


### the communication to the data subject referred to in paragraph 1 shall describe the nature of the personal data breach and contain at least the information and the recommendations provided for in points and of article 31 . ### the communication to the data subject referred to in paragraph 1 shall be comprehensive , clear and understandable by any individual and shall describe the nature of the personal data breach and contain at least the information and the recommendations provided for in points , and of article 31 .


### the communication of a personal data breach to the data subject shall not be required if the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible to any person who is not authorised to access it . ### the communication of a personal data breach to the data subject shall not be required if the data breach has not produced significant harm and the controller has implemented appropriate technological protection measures , and that those measures where applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible , unusable or anonymised to any person who is not authorised access to it .


### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . ### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , or where processing takes place as a public sector infrastructure project the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data .


### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . ### where processing operations are likely to present high degree of risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller shall carry out an assessment of the impact of the envisaged processing operations on the rights and freedoms of the data subjects , especially their right to privacy .


### designation of the data protection officer ### designation of the data protection organisation or data protection officer


### the controller or the processor shall ensure that the data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data . ### the executive management of the controller or the processor shall support the data protection organisation or data protection officer in performing their duties and shall provide staff , premises , equipment and any other resources necessary to carry out the roles and duties referred to in article 37 .


### position of the data protection officer ### position of the data protection organisation or the data protection officer


### the controller or the processor shall ensure that the data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data . ### the controller or the processor shall ensure that the data protection organisation or data protection officer is properly and in a timely manner involved in all issues which relate to the protection of personal data .


### the controller or the processor shall support the data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 . ### the controller or the processor shall support the data protection organisation or the data protection officer in performing the tasks and shall provide staff , premises , equipment and any other resources necessary to carry out the duties and tasks referred to in article 37 .


### the rule of law , relevant legislation in force , both general and sectoral , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in that country or by that international organisation , as well as effective and enforceable rights including effective administrative and judicial redress for data subjects , in particular for those data subjects residing in the union whose personal data are being transferred ; ### the level of penetration and consolidation of the rule of law , relevant legislation in force , both general and sectoral , including concerning public security , defence , national security and criminal law , the professional rules and security measures which are complied with in the field of the protection of personal data in that country or by that international organisation , as well as access to justice and the effectiveness and enforceability of rights , including the right to action and redress in both administrative and judicial matters , in particular for those data subjects residing in the union whose personal data are being transferred ;


### contractual clauses between the controller or processor and the recipient of the data authorised by a supervisory authority in accordance with paragraph 4 . ### contractual clauses between the controller or processor and the recipient of the data authorised by a supervisory authority in accordance with paragraph 4 ; or


### binding corporate rules in accordance with article 43 ; or ### binding corporate rules in accordance with article 38b ; or


### standard data protection clauses adopted by a supervisory authority in accordance with the consistency mechanism referred to in article 57 when declared generally valid by the commission pursuant to point of article 62 ; or ### standard data protection clauses adopted by a supervisory authority in accordance with the consistency mechanism referred to in article 57 when declared generally valid by the commission pursuant to point of article 62 ;


### standard data protection clauses adopted by a supervisory authority in accordance with the consistency mechanism referred to in article 57 when declared generally valid by the commission pursuant to point of article 62 ; or ### standard data protection clauses adopted by a supervisory authority in accordance with the consistency mechanism referred to in article 57 , between the controller or the data processor and the recipient of the data , who may also be a subprocessor , outside the eea , which may also comprise standard conditions for the forwarding of data outside the eea , when these standard data protection clauses have been declared generally valid by the commission in accordance with the examination procedure referred to in article 87 ; or


### contractual clauses between the controller or processor and the recipient of the data authorised by a supervisory authority in accordance with paragraph 4 . ### contractual clauses between the controller or processor and the recipient of the data in accordance with paragraph 4 .


### the transfer is necessary for the establishment , exercise or defence of legal claims ; o ### the transfer is necessary for the establishment , exercise or defence of legal or administrative claims ;


### the members and the staff of the supervisory authority shall be subject , both during and after their term of office , to a duty of professional secrecy with regard to any confidential information which has come to their knowledge in the course of the performance of their official duties . ### the members and the staff of the supervisory authority shall be bound , both during and after their term of office , by the obligation for professional secrecy with regard to any confidential information in conformity with national legislation and practice which has come to their knowledge in the course of their performance of their official duties .


### each supervisory authority shall exercise , on the territory of its own member state , the powers conferred on it in accordance with this regulation . ### each supervisory authority shall exercise , on the territory of its own member state , the powers conferred on it in accordance with this regulation . data processing by a public authority are supervised only by the supervisory authority of that member state .


### each supervisory authority shall have the power to bring violations of this regulation to the attention of the judicial authorities and to engage in legal proceedings , in particular pursuant to article 74 and article 75 . ### each supervisory authority shall have the power to bring violations of this regulation to the attention of the judicial authorities and to engage in legal proceedings , in particular pursuant to article 75 .


### each supervisory authority must draw up an annual report on its activities . the report shall be presented to the national parliament and shall be made be available to the public , the commission and the european data protection board . ### each supervisory authority must draw up an annual report on its activities . the report shall be presented to the parliament concerned and / or the other authorities specified under national legislation and shall be made available to the public , the commission and the european data protection board .


### no fee shall be charged for any action taken following a request for mutual assistance . ### no fee shall be charged to the requesting supervisory authority for any action taken following a request for mutual assistance .


### where a supervisory authority does not act within one month on request of another supervisory authority , the requesting supervisory authorities shall be competent to take a provisional measure on the territory of its member state in accordance with article 51 and shall submit the matter to the european data protection board in accordance with the procedure referred to in article 57 . ### where a supervisory authority does not act within one month of the time limit referred to in paragraph 2 on request of another supervisory authority , the requesting supervisory authorities shall be competent to take a provisional measure on the territory of its member state in accordance with article 51 and shall submit the matter to the european data protection board in accordance with the procedure referred to in article 57 . where no definitive measure is yet possible because the assistance is not yet completed , the requesting supervisory authority may take interim measures under article 53 in the territory of its member state .


### in cases where data subjects in several member states are likely to be affected by processing operations , a supervisory authority of each of those member states shall have the right to participate in the joint investigative tasks or joint operations , as appropriate . the competent supervisory authority shall invite the supervisory authority of each of those member states to take part in the respective joint investigative tasks or joint operations and respond to the request of a supervisory authority to participate in the operations without delay . ### in cases where data subjects in several member states are likely to be adversely affected by processing operations , a supervisory authority of each of those member states shall have the right to participate in the joint investigative tasks or joint operations , as appropriate . the competent supervisory authority shall respond to the request of a supervisory authority to participate in the operations without delay .


### before a supervisory authority adopts a measure referred to in paragraph 2 , this supervisory authority shall communicate the draft measure to the european data protection board and the commission . ### before the competent supervisory authority adopts a measure referred to in paragraph 2 , this competent supervisory authority shall communicate the draft measure to the european data protection board and the commission .


### relates to processing activities which are related to the offering of goods or services to data subjects in several member states , or to the monitoring of their behaviour ; or ### relates to processing activities of personal data which are related to the offering of goods or services specifically targeted at data subjects in several member states , in accordance of article 3 and where the controller has not designated a representative in the union ; or


### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or any supervisory authority or the commission so requests within one week after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within one month by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authority competent under article 51 of the opinion and make it public . ### the european data protection board shall issue an opinion on the matter , if the european data protection board so decides by simple majority of its members or the commission so requests within one week after the relevant information has been provided according to paragraph 5 . the opinion shall be adopted within one month by simple majority of the members of the european data protection board . the chair of the european data protection board shall inform , without undue delay , the supervisory authority referred to , as the case may be , in paragraphs 1 and 3 , the commission and the supervisory authority competent under article 51 of the opinion and make it public .


### where the supervisory authority concerned intends not to follow the opinion of the commission , it shall inform the commission and the european data protection board thereof within the period referred to in paragraph 1 and provide a justification . in this case the draft measure shall not be adopted for one further month . ### where the supervisory authority concerned intends not to follow the opinion of the commission , it shall inform the commission and the european data protection board thereof within the period referred to in paragraph 1 and provide a justification .