### the legitimate interests of a controller may provide a legal basis for processing , provided that the interests or the fundamental rights and freedoms of the data subject are not overriding . this would need careful assessment in particular where the data subject is a child , given that children deserve specific protection . the data subject should have the right to object the processing , on grounds relating to their particular situation and free of charge . to ensure transparency , the controller should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object , and also be obliged to document these legitimate interests . given that it is for the legislator to provide by law the legal basis for public authorities to process data , this legal ground should not apply for the processing by public authorities in the performance of their tasks . ### the legitimate interests of a data subject may provide a legal basis for processing , provided that the interests or the fundamental rights and freedoms of the data subject are not overriding . this would need careful assessment in particular where the data subject is a child , given that children deserve specific protection . the data subject should have the right to object the processing , on grounds relating to their particular situation and free of charge . to ensure transparency , the controller or the third parties to whom the data are sent should be obliged to explicitly inform the data subject on the legitimate interests pursued and on the right to object , and also be obliged to document these legitimate interests . given that it is for the legislator to provide by law the legal basis for public authorities to process data , this legal ground should not apply for the processing by public authorities in the performance of their tasks .


### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a fee for providing the information or taking the action requested , or the controller may not take the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request . ### the information and the actions taken on requests referred to in paragraph 1 shall be free of charge . where requests are manifestly excessive , in particular because of their repetitive character , the controller may charge a reasonable fee for providing the information or taking the action requested . in that case , the controller shall bear the burden of proving the manifestly excessive character of the request .


### where more than one controller or processor is involved in the processing , each controller or processor shall be jointly and severally liable for the entire amount of the damage . ### where more than one controller is involved in the processing , each controller shall be jointly and severally liable for the entire amount of the damage to the extent that the joint controllers ' respective liability has not been determined in the legal arrangement referred to in article 24 . in the case of a group of undertakings , the entire group shall be liable as a single economic entity .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying other reasons of public interest in the area of public health as referred to in point of paragraph 1 , as well as criteria and requirements for the safeguards for the processing of personal data for the purposes referred to in paragraph 1 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying other reasons of public interest in the area of public health as referred to in point of paragraph 1 .


### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . ### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . a single assessment shall be sufficient to address a set of processing operations that present similar risks .


### consent shall not provide a legal basis for the processing , where there is a significant imbalance between the position of the data subject and the controller . ### consent of an employee shall not provide a legal basis for the processing of data by the employer when the consent has not been given freely . the lawfulness of the processing shall be assessed in accordance with points to of article 6 and with article 6 to . the individual consent according to point of article 6 can be replaced by collective agreements as legal basis , in particular by collective bargaining agreements or works council agreements .


### any supervisory authority or the european data protection board may request that any matter shall be dealt with in the consistency mechanism , in particular where a supervisory authority does not submit a draft measure referred to in paragraph 2 or does not comply with the obligations for mutual assistance in accordance with article 55 or for joint operations in accordance with article 56 . ### any supervisory authority or the european data protection board may request that any matter shall be dealt with in the consistency mechanism , in particular where the competent authority does not submit a draft measure referred to in paragraph 2 or does not comply with the obligations for mutual assistance in accordance with article 55 or for joint operations in accordance with article 56 .


### the european data protection board shall elect a chair and two deputy chairpersons from amongst its members . one deputy chairperson shall be the european data protection supervisor , unless he or she has been elected chair . ### the european data protection board shall elect a chair and at least two deputy chairpersons from amongst its members .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted specifying the technical standars to give consent ; specifyng conditions of icon - based mode for provision of information ; specifying the criteria and conditions for fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; criteria and requirements for verification of the responsibility of the controller ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; codes of conduct ; criteria and requirements for certification mechanisms ; the adequate level of protection afforded by a third country or an international organisation ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level in particular with the european data protection board . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### the controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this regulation . ### having regard to the state of the art , the nature of personal data processing and the type of the organization , both at the time of the determination of the means for processing and at the time of the processing itself , appropriate and demonstrable technical and organizational measures should be implemented in such a way that the processing will meet the requirements of this regulation and ensures the protection of the rights of the data subject by design .


### the controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this regulation . ### the controller shall adopt appropriate policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this regulation .


### the controller shall have transparent and easily accessible policies with regard to the processing of personal data and for the exercise of data subjects ' rights . ### the controller shall observe transparency and accessibility criteria with regard to the processing of personal data and for the exercise of data subjects ' rights . to that end it may disseminate those criteria by framing policies to be made known to all data subjects .


### assist the controller in ensuring compliance with the obligations pursuant to articles 30 to 34 ; ### insofar as this is possible given the nature of processing , the information available to the processor and his ability to assist with reasonable effort , an agreement on how compliance will be ensured with the obligations pursuant to articles 30 to 34 ;


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid for two years after the entry into force of this regulation , or until amended , replaced or repealed by that supervisory authority .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of specifying the criteria and conditions in relation to the consent of a child ; criteria and requirements for the information to the data subject and in relation to the right of access ; criteria and requirements in relation to the responsibility of the controller ; a processor ; criteria and requirements for the documentation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; transfers by way of binding corporate rules ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .


### keeping the documentation pursuant to article 28 ; ### independent management oversight of processing of personal data to ensure the existence and effectiveness of the technical and organizational measures ;


### within the limits of this regulation , personal data may be processed for historical , statistical or scientific research purposes only if : ### within the limits of this regulation , personal data may be processed for historical , statistical or scientific purposes only if :


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### every data subject shall have the right not to be subject to a decision that produces adverse legal effects or adversely affects this data subject , and which is based solely or predominantly on automated processing intended to evaluate certain personal aspects relating to this data subject .


### the controller shall document any personal data breaches , comprising the facts surrounding the breach , its effects and the remedial action taken . this documentation must enable the supervisory authority to verify compliance with this article . the documentation shall only include the information necessary for that purpose . ### the controller shall document any personal data breaches , comprising the facts surrounding the breach , its effects and the remedial action taken . this documentation must enable the supervisory authority to verify compliance with this article and with article 30 . the documentation shall only include the information necessary for that purpose .


### right to be forgotten and to erasure ### right to erasure


### in the case of a personal data breach , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours . ### in the case of a personal data breach , when the breach is likely to adversely affect the protection of the personal data or privacy of the data subject , the controller shall without undue delay and , where feasible , not later than 24 hours after having become aware of it , notify the personal data breach to the supervisory authority . the notification to the supervisory authority shall be accompanied by a reasoned justification in cases where it is not made within 24 hours .


### the significance and envisaged consequences of such processing , at least in the case of measures referred to in article 20 . ### the significance and envisaged consequences of such processing .


### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 13 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology . ### for the purposes of this regulation , in relation to the offering of information society services directly to a child , the processing of personal data of a child below the age of 15 years shall only be lawful if and to the extent that consent is given or authorised by the child ' s parent or custodian . the controller shall make reasonable efforts to obtain verifiable consent , taking into consideration available technology .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for tasks , certification , status , powers and resources of the data protection officer referred to in paragraph 1 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying the criteria and requirements for the certification and status of the data protection officer .


### subject to the other provisions of this regulation , a person may be subjected to a measure of the kind referred to in paragraph 1 only if the processing : is carried out in the course of the entering into , or performance of , a contract , where the request for the entering into or the performance of the contract , lodged by the data subject , has been satisfied or where suitable measures to safeguard the data subject ' s legitimate interests have been adduced , such as the right to obtain human intervention ; or is expressly authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests ; or is based on the data subject ' s consent , subject to the conditions laid down in article 7 and to suitable safeguards . ### subject to the other provisions of this regulation , a data subject may be subject to a decision of the kind referred to in paragraph 1 if the processing : is authorized by a union or member state law which also lays down suitable measures to safeguard the data subject ' s legitimate interests ; or is lawful pursuant to points to of article 6 of this regulation ; with due regard to article 9 , paragraph 2 , profiling shall not have the effect of discriminating against individuals on the basis , for instance , of race or ethnic origin , religion or sexual orientation .


### the transfer is necessary for the establishment , exercise or defence of legal claims ; or ### the transfer is necessary for the establishment , exercise or defence of legal or administrative claims ; or


### derogations ### other legitimate grounds for international transfers


### the controller and the processor shall designate a data protection officer in any case where : ### the controller and the processor shall designate a data protection organisation or data protection officer in any case where :


### each supervisory authority shall be empowered to impose administrative sanctions in accordance with this article . ### the supervisory authority competent under article&#160 ; 51 shall be empowered to impose administrative sanctions in accordance with this article .


### each supervisory authority shall be empowered to impose administrative sanctions in accordance with this article . ### each competent supervisory authority , shall be empowered to impose administrative sanctions in accordance with this article .


### complying with the requirements for prior authorisation or prior consultation of the supervisory authority pursuant to article 34 and ; ### complying with the requirements for prior authorisation of the supervisory authority pursuant to article 34 ;


### processing is necessary for the purposes of the legitimate interests pursued by a controller , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child . this shall not apply to processing carried out by public authorities in the performance of their tasks . ### processing is necessary for the purposes of the legitimate interests pursued by , or on behalf of a controller or a processor , or by a third party or parties in whose interest the data is processed , including for the security of processing , except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data , in particular where the data subject is a child . the interest or fundamental rights and freedoms of the data subject shall not over - ride processing carried out by public authorities in the performance of their tasks or enterprises in the exercise of their legal obligations , and in order to safeguard against fraudulent behaviour .


### in order to ensure correct and consistent application of this regulation , the commission may request that any matter shall be dealt with in the consistency mechanism . ### in order to ensure correct and consistent application of this regulation , the commission may , acting on its own behalf , and shall at the request of a stakeholder , request that any matter shall be dealt with in the consistency mechanism .


### the controller shall carry out the erasure without delay , except to the extent that the retention of the personal data is necessary : ### the controller shall carry out the erasure without undue delay , except to the extent that the retention and dissemination of the personal data is necessary :


### the examination procedure should be used for the adoption of specifying standard forms in relation to the consent of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism , given that those acts are of general scope . ### the examination procedure should be used for the adoption of specifying standard forms in relation to the consent of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; standard forms in relation to the responsibility of the controller to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism , given that those acts are of general scope .


### the data are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort ; or ### the data are not collected from the data subject and the provision of such information proves impossible or would involve a disproportionate effort and generate excessive administrative burden , especially when the processing is carried out by a sme as defined in commission recommendation 2003 / 361 / ec of 6 may 2003 concerning the definition of micro , small and medium - sized enterprises1 ; or _____________ 1 oj l 124 , 20 . 5 . 2003 , p . 36 .


### the commission may lay down standard forms and specifying standard procedures for the communication referred to in paragraph 2 , including the electronic format . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission may specify standard procedures for the communication referred to in paragraph 2 . in doing so , the commission shall take the appropriate measures for micro , small and medium - sized enterprises . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 .


### processed under the responsibility and liability of the controller , who shall ensure and demonstrate for each processing operation the compliance with the provisions of this regulation . ### processed under the responsibility and liability of the controller , who shall ensure and , if required to do so , demonstrate compliance of the controller ' s processing with the provisions of this regulation to the supervisory authority having competence under article 51 .


### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the intentional or negligent character of the infringement , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . ### the administrative sanction shall be in each individual case effective , proportionate and dissuasive . the amount of the administrative fine shall be fixed with due regard to the nature , gravity and duration of the breach , the sensitivity of the personal data at issue , the intentional or negligent character of the infringement , the degree of harm or risk of significant harm created by the violation , the degree of responsibility of the natural or legal person and of previous breaches by this person , the technical and organisational measures and procedures implemented pursuant to article 23 and the degree of co - operation with the supervisory authority in order to remedy the breach . while some discretion is granted in the imposition of such sanctions to take into account the circumstances outlined above and other facts specific to the situation , divergences in the application of administrative sanctions may be subject to review pursuant to the consistency mechanism .


### bodies conducting historical , statistical or scientific research may publish or otherwise publicly disclose personal data only if : ### bodies conducting historical , statistical , aggregated or scientific research may publish or otherwise publicly disclose personal data only if :


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### a data subject shall have the right not to be subject to a measure which adversely affects this data subject , both offline and online which is based solely on automated processing of data intended to evaluate certain personal aspects relating to a data subject or to analyse or predict in particular the data subject ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour .


### where the personal data are not collected from the data subject , at the time of the recording or within a reasonable period after the collection , having regard to the specific circumstances in which the data are collected or otherwise processed , or , if a disclosure to another recipient is envisaged , and at the latest when the data are first disclosed . ### where the personal data are not collected from the data subject , at the time of the recording or within a reasonable period after the collection , having regard to the specific circumstances in which the data are collected or otherwise processed , or , if a disclosure to another recipient is envisaged , and at the latest when the data are first disclosed ; or , if the data shall be used for communication with the person concerned , at the latest at the time of the first communication to that person .


### standard data protection clauses adopted by a supervisory authority in accordance with the consistency mechanism referred to in article 57 when declared generally valid by the commission pursuant to point of article 62 ; or ### standard data protection clauses , between the controller or processor and the recipient , that can be a sub - processor , of the data outside the union , which may include standard terms for onward transfers outside the union , adopted by a supervisory authority in accordance with the consistency mechanism referred to in article 57 when declared generally valid by the commission pursuant to point of article 62 ; or


### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in a freely - available electronic format , the information shall be provided in electronic form which enables the data subject to make subsequent use of it , unless otherwise requested by the data subject .


### the controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function . the data protection officer shall directly report to the management of the controller or the processor . ### the controller or processor shall ensure that the data protection organisation or the data protection officer performs the duties and tasks independently .


### the identity and the contact details of the controller and , if any , of the controller ' s representative and of the data protection officer ; ### the contact details of the controller and , if any , of the controller ' s representative and of the data protection officer ;


### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ; ### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of articles 81 and 83 and if a periodic review is carried out to assess the necessity to continue the storage ;


### ‘ representative’ means any natural or legal person established in the union who , explicitly designated by the controller , acts and may be addressed by any supervisory authority and other bodies in the union instead of the controller , with regard to the obligations of the controller under this regulation ; ### ‘ representative’ means any natural or legal person established in the union who , explicitly designated by the controller , acts instead of the controller , with regard to the obligations of the controller under this regulation ;


### any body , organisation or association which aims to protects the rights and interests of data subjects in relation to the protection of their data and is constituted according to the law of a member state should have the right to lodge a complaint with a supervisory authority or exercise the right to a judicial remedy on behalf of data subjects , or to lodge , independently of a data subject ' s complaint , an own complaint where it considers that a personal data breach has occurred . ### any body , organisation or association which aims to protects the rights and interests of data subjects in relation to the protection of their data and is constituted according to the law of a member state should have the right to lodge a complaint with a supervisory authority or exercise the right to a judicial remedy on behalf of data subjects . every person has the right to lodge , independently of a data subject ' s complaint , an own complaint where it considers that a personal data breach has occurred .


### processing is necessary for compliance with a legal obligation to which the controller is subject ; ### processing is necessary for compliance with a legal or contractual obligation based in union or national law of a member state , regulatory rule , guidance , industry code of practice , either domestically or internationally or for a permission of supervisory requirement or a different legal rule to which the controller is subject including the requirements of supervisory authorities ;


### the controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function . the data protection officer shall directly report to the management of the controller or the processor . ### the data protection organisation or data protection officer shall perform his or her duties and tasks independently and shall directly report to the management of the controller or the processor .


### the controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this regulation . ### having regard to the state of the art , the nature of personal data processing and the type of the organisation , both at the time of the determination of the means for processing and at the time of the processing itself , appropriate and demonstrable technical and organisational measures shall be implemented in such a way that the processing will meet the requirements of this regulation and ensures the protection of the rights of the data subject by design .


### within the limits of this regulation , personal data may be processed for historical , statistical or scientific research purposes only if : ### personal data may be processed for historical , statistical or scientific research purposes only if :


### the member states and the commission shall encourage , in particular at european level , the establishment of data protection certification mechanisms and of data protection seals and marks , allowing data subjects to quickly assess the level of data protection provided by controllers and processors . the data protection certifications mechanisms shall contribute to the proper application of this regulation , taking account of the specific features of the various sectors and different processing operations . ### the member states and the commission shall encourage , in particular at european level , the establishment of data protection certification mechanisms and of data protection seals and marks , allowing data subjects to quickly assess the level of data protection provided by controllers and processors . the data protection certifications mechanisms shall contribute to the proper application of this regulation , taking account of the specific features of the various sectors and different processing operations . the responsibility for a corresponding certification act should be transferred to independent and qualified auditors . such an auditor shall be : accredited by a national supervisory authority ; and be responsible for the rewarding process of a corresponding privacy certificate ; and liable for consequences resulting in the inadequate reward of the data protection certificate .


### the controller or processor shall provide the supervisory authority with the data protection impact assessment provided for in article 33 and , on request , with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards . ### the controller shall provide the supervisory authority , on request , with the data protection impact assessment pursuant to article 33 and with any other information to allow the supervisory authority to make an assessment of the compliance of the processing and in particular of the risks for the protection of personal data of the data subject and of the related safeguards .


### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages or for other reasons , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . the supervisory authority shall , without delay , communicate those measures , with full reasons , to the european data protection board and to the commission . ### in exceptional circumstances , where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects , when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages , by way of derogation from the procedure referred to in article 58 , it may immediately adopt provisional measures with a specified period of validity . this supervisory authority shall , without delay , communicate those measures , with full reasons , to the competent supervisory authority , the european data protection board , the commission and the controller or processor concerned .


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### every data subject shall have the right to request not to be subject to a measure which adversely affects this data subject and which is based solely on automated processing of data intended to evaluate , analyse or predict the data subject ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour .


### relates to processing activities which are related to the offering of goods or services to data subjects in several member states , or to the monitoring of their behaviour ; or ### relates to processing activities of personal data which are related to the offering of goods or services to data subjects in several member states when the non - eea controller or processor does not name a representative in the territory of the eea ; or it


### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . ### where a controller determines the purposes , conditions and means of the processing of personal data jointly with others , the joint controllers shall determine their respective responsibilities for compliance with the obligations under this regulation , in particular as regards the procedures and mechanisms for exercising the rights of the data subject , by means of an arrangement between them . to ensure that data subjects may exercise their right to object to this arrangement , it must be documented and data subjects must have been notified in advance ; otherwise , the above rights may be exercised in full in relation to any of the controllers , who shall be responsible for ensuring that the conditions laid down by law are fully complied with .


### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ; personal data may be stored for longer periods insofar as the data will be processed solely for historical , statistical or scientific research purposes in accordance with the rules and conditions of article 83 and if a periodic review is carried out to assess the necessity to continue the storage ; ### kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed , without prejudice to the provisions of article 83 ;


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid for two years after the entry into force of this regulation , or until amended , replaced or repealed by that supervisory authority .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object , on grounds relating to their particular situation , unless the controller demonstrates legitimate interests which override the interests of the data subject . there shall be no right to object where the processing is required by law .


### processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller ; ### processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in the third party to which the data are transferred ;


### when the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay . ### when the personal data breach is likely to have a significantly adverse impact on the protection of the personal data or privacy of the data subject , for example identity theft or fraud , physical harm , significant humiliation or damage to the reputation , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject in a clear and concise manner and without undue delay .


### data enabling the attribution of information to an identified or identifiable data subject is kept separately from the other information as long as these purposes can be fulfilled in this manner . ### data enabling the attribution of information to an identified or identifiable data subject is kept separately from the other information as long as these purposes can be fulfilled in this manner . personal data processed as part of a preliminary official or administrative investigation for the determination of natural filiation shall only be disclosed to those concerned as and when appropriate and without prejudice to any statutory criminal proceedings .


### the data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data , especially in relation to personal data which are made available by the data subject while he or she was a child , where one of the following grounds applies : ### the data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of personal data which are made available by the data subject itself , where one of the following grounds applies :


### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries . therefore , member states should adopt legislative measures , which should lay down exemptions and derogations which are necessary for the purpose of balancing these fundamental rights . such exemptions and derogations should be adopted by the member states on general principles , on the rights of the data subject , on controller and processor , on the transfer of data to third countries or international organisations , on the independent supervisory authorities and on co - operation and consistency . this should not , however , lead member states to lay down exemptions from the other provisions of this regulation . in order to take account of the importance of the right to freedom of expression in every democratic society , it is necessary to interpret notions relating to that freedom , such as journalism , broadly . therefore , member states should classify activities as ‘ journalistic’ for the purpose of the exemptions and derogations to be laid down under this regulation if the object of these activities is the disclosure to the public of information , opinions or ideas , irrespective of the medium which is used to transmit them . they should not be limited to media undertakings and may be undertaken for profit - making or for non - profit making purposes . ### the processing of personal data solely for journalistic purposes , or for the purposes of artistic or literary expression should qualify for exemption from the requirements of certain provisions of this regulation in order to reconcile the right to the protection of personal data with the right to freedom of expression , and notably the right to receive and impart information , as guaranteed in particular by article 11 of the charter of fundamental rights of the european union . this should apply in particular to processing of personal data in the audiovisual field and in news archives and press libraries .


### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , trade - union membership , and the processing of genetic data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited . ### the processing of personal data , revealing race or ethnic origin , political opinions , religion or philosophical beliefs , sexual orientation or gender identity , trade - union membership and activities , and the processing of genetic data or data concerning health or sex life or criminal convictions , or related security measures shall be prohibited .


### the carrying out of processing by a processor shall be governed by a contract or other legal act binding the processor to the controller and stipulating in particular that the processor shall : ### the carrying out of processing by a processor shall be governed by a contract or other legal act binding the processor to the controller . the controller and the processor shall be free to determine their respective roles and responsibilities with respect to the requirements of this regulation , and shall provide for the following :


### hand over all results to the controller after the end of the processing and not process the personal data otherwise ; ### hand over all results to the controller after the end of the processing , not process the personal data otherwise and delete existing copies without prejudice to union or member state laws ;


### the communication of a personal data breach to the data subject shall not be required if the controller demonstrates to the satisfaction of the supervisory authority that it has implemented appropriate technological protection measures , and that those measures were applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible to any person who is not authorised to access it . ### the communication of a personal data breach to the data subject shall not be required if the data breach has not produced significant harm and the controller has implemented appropriate technological protection measures , and that those measures where applied to the data concerned by the personal data breach . such technological protection measures shall render the data unintelligible , unusable or anonymised to any person who is not authorised access to it .


### the controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this regulation . ### the controller shall adopt policies and implement appropriate measures to ensure and be able to demonstrate that the processing of personal data is performed in compliance with this regulation . those measures shall be proportionate to the size of the controller , the nature of the data being processed and the impact of such processing on the data subjects .


### processing of personal data which is necessary for the purposes of historical , statistical or scientific research shall be lawful subject to the conditions and safeguards referred to in article 83 . ### subsequent processing of personal data which is necessary for the purposes of historical , statistical or scientific research shall be lawful subject to the conditions and safeguards referred to in article 83 .


### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller or the processor acting on the controller ' s behalf shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . ### where processing operations present specific risks to the rights and freedoms of data subjects by virtue of their nature , their scope or their purposes , the controller shall carry out an assessment of the impact of the envisaged processing operations on the protection of personal data . a single assessment shall be sufficient to address a set of processing operations that present similar risks . smes shall only be required to perform an impact assessment after their third year of incorporation where data processing is deemed as a core activity of their business .


### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others , respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued . ### the law of the member state must meet an objective of public interest or must be necessary to protect the rights and freedoms of others . the law of the member state must also respect the essence of the right to the protection of personal data in this regulation and in international treaties to which the member state is party . finally the member state shall evaluate and decide if national legislation is proportionate to the legitimate aim pursued or if a legitimate aim could be achieved using less privacy invasive solutions .


### each data subject shall have the right to a judicial remedy obliging the supervisory authority to act on a complaint in the absence of a decision necessary to protect their rights , or where the supervisory authority does not inform the data subject within three months on the progress or outcome of the complaint pursuant to point of article 52 . ### the claim shall be understood to have been rejected if , three months after the complaint was lodged by the subject , the supervisory authority has not informed the subject of the progress of the complaint . the claim shall also be understood to have been rejected if , six months after the complaint was lodged , the authority has not definitively resolved the complaint .


### the commission may set out standard forms and procedures for prior authorisations and consultations referred to in paragraphs 1 and 2 , and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 . ### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of setting out standard forms and procedures for prior consultations referred to in paragraph 2 , and standard forms and procedures for informing the supervisory authorities pursuant to paragraph 6 .


### associations and other bodies representing categories of controllers or processors in one member state which intend to draw up codes of conduct or to amend or extend existing codes of conduct may submit them to an opinion of the supervisory authority in that member state . the supervisory authority may give an opinion whether the draft code of conduct or the amendment is in compliance with this regulation . the supervisory authority shall seek the views of data subjects or their representatives on these drafts . ### associations and other bodies representing categories of controllers or processors in one member state which intend to draw up codes of conduct or to amend or extend existing codes of conduct may submit them to an opinion of the supervisory authority in that member state . the supervisory authority shall without undue delay give an opinion whether the draft code of conduct or the amendment is in compliance with this regulation . the supervisory authority shall seek the views of data subjects or their representatives on these drafts .


### standard data protection clauses adopted by the commission . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 ; or ### standard data protection clauses adopted by the commission between the controller or the data processor and the recipient of the data , who may also be a subprocessor , outside the eea , which may also comprise standard conditions for the forwarding of data outside the eea . those implementing acts shall be adopted in accordance with the examination procedure referred to in article 87 ; or


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain in force for no longer than two years from the entry into force of this regulation or until amended , replaced or repealed by the supervisory authority .


### each data subject shall have the right to a judicial remedy obliging the supervisory authority to act on a complaint in the absence of a decision necessary to protect their rights , or where the supervisory authority does not inform the data subject within three months on the progress or outcome of the complaint pursuant to point of article 52 . ### if the supervisory authority has not informed the data subject of the status of a complaint within three months of its being lodged , the complaint will be deemed to have been rejected . the complaint will also be deemed to have been rejected if the supervisory authority has not definitively resolved it within six months .


### to monitor the performance of the data protection impact assessment by the controller or processor and the application for prior authorisation or prior consultation , if required pursuant articles 33 and 34 ; ### to monitor the performance of the data protection impact assessment by the controller or processor and the application for prior consultation , if required pursuant articles 33 and 34 ;


### adequate , relevant , and limited to the minimum necessary in relation to the purposes for which they are processed ; they shall only be processed if , and as long as , the purposes could not be fulfilled by processing information that does not involve personal data ; ### adequate , relevant , and not excessive in relation to the purposes for which they are processed ; they shall only be processed if , and as long as , the purposes could not be fulfilled by processing information that does not involve personal data ;


### when the personal data breach is likely to adversely affect the protection of the personal data or privacy of the data subject , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay . ### when the personal data breach is likely to adversely affect the protection of the personal data , the privacy , the right or the legitimate interests of the data subject , the controller shall , after the notification referred to in article 31 , communicate the personal data breach to the data subject without undue delay . a breach shall be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation .


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission ' s exercise of implementing powers . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission . in implementing the provisions of this regulation , it should be ensured that no mandatory requirements for specific technical features are imposed on products and services , including terminal or other electronic communications equipment , which could impede the placing of equipment on the market and the free circulation of such equipment in and between member states . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises in consultation with the parties concerned , as these measures should not overly burden those enterprises .


### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , trade - union membership , and the processing of genetic data or data concerning health or sex life or criminal convictions or related security measures shall be prohibited . ### the processing of personal data , revealing race or ethnic origin , political opinions , religion or beliefs , trade - union membership , and the processing of genetic data or data concerning health or sex life or criminal convictions , criminal offences , including offences and matters which have not lead to conviction , significant social problems , or related security measures shall be prohibited .


### the controller or processor shall ensure that the data protection officer performs the duties and tasks independently and does not receive any instructions as regards the exercise of the function . the data protection officer shall directly report to the management of the controller or the processor . ### the data protection organisation or data protection officer shall perform his or her tasks independently and shall directly report to the executive management of the controller or the processor .


### processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation , association or any other non - profit - seeking body with a political , philosophical , religious or trade - union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that body without the consent of the data subjects ; or ### processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation , association , organizations on the labour market or any other non - profit - seeking body with a political , philosophical , religious or trade - union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the data are not disclosed outside that body without the consent of the data subjects ; or


### prior authorisation and prior consultation ### prior consultation


### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority . ### processing of data relating to criminal convictions or related security measures is carried out either under the control of official authority or when the processing is necessary for compliance with a legal or regulatory obligation or orders and recommendations of competent organizations as well as the requirements of supervisory authorities to which a controller is subject , or for the performance of a task carried out for important public interest reasons , and in so far as authorised by union law or member state law providing for adequate safeguards . a complete register of criminal convictions shall be kept only under the control of official authority .


### the purposes of the processing for which the personal data are intended , including the contract terms and general conditions where the processing is based on point of article 6 and the legitimate interests pursued by the controller where the processing is based on point of article 6 ; ### the purposes of the processing for which the personal data are intended ;


### tasks of the data protection officer ### tasks of the data protection organisation or the data protection officer


### this regulation should not apply to processing of personal data by a natural person , which are exclusively personal or domestic , such as correspondence and the holding of addresses , and without any gainful interest and thus without any connection with a professional or commercial activity . the exemption should also not apply to controllers or processors which provide the means for processing personal data for such personal or domestic activities . ### this regulation should not apply to processing of personal data by a person , which are exclusively personal or domestic , such as correspondence and the holding of addresses , and without any gainful interest and thus without any connection with a professional or commercial activity , and which does not involve making such data accessible to an indefinite number of people . the exemption should also not apply to controllers or processors which provide the means for processing personal data for such personal or domestic activities .


### in particular , any legislative measure referred to in paragraph 1 shall contain specific provisions at least as to the objectives to be pursued by the processing and the determination of the controller . ### in particular , any legislative measure referred to in paragraph 1 must be necessary and proportionate in a democratic society and shall contain specific provisions at least as to : the objectives to be pursued by the processing ; the determination of the controller ; the specific purposes and means of processing ; the categories of persons authorised to process the data ; the procedure to be followed for the processing ; the safeguards to prevent abuse ; the right of data subjects to be informed about the restriction .


### member states shall provide for exemptions or derogations from the provisions on the general principles in chapter ii , the rights of the data subject in chapter iii , on controller and processor in chapter iv , on the transfer of personal data to third countries and international organisations in chapter v , the independent supervisory authorities in chapter vi and on co - operation and consistency in chapter vii for the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression . ### chapter ii , chapter iii , chapter iv , chapter v , chapter vi , chapter vii as well as articles 73 , 74 , 76 and 79 of chapter viii shall not apply to the processing of personal data carried out solely for journalistic purposes or the purpose of artistic or literary expression in order to reconcile the right to the protection of personal data with the rules governing freedom of expression .


### a transfer based on standard data protection clauses or binding corporate rules as referred to in points , or of paragraph 2 shall not require any further authorisation . ### a transfer based on points , or or of paragraph 2 shall not require any further authorisation .


### every natural person shall have the right not to be subject to a measure which produces legal effects concerning this natural person or significantly affects this natural person , and which is based solely on automated processing intended to evaluate certain personal aspects relating to this natural person or to analyse or predict in particular the natural person ' s performance at work , economic situation , location , health , personal preferences , reliability or behaviour . ### every data subject shall have the right not to be subject to a decision that produces adverse legal effects or adversely affects this data subject , and which is based solely or predominantly on automated processing intended to evaluate certain personal aspects relating to this data subject .


### the delegation of power referred to in article 6 , article 8 , article 9 , article 12 , article 14 , article 15 , article 17 , article 20 , article 22 , article 23 , article 26 , article 28 , article 30 , article 31 , article 32 , article 336 ) , article 34 , article 35 , article 37 , article 39 , article 43 , article 44 , article 79 , article 81 , article 82 and article 83 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force . ### the delegation of power referred to in article 7 , article 11 , article 12 , article 14 , article 17 , article 22 , article 31 , article 32 , article 33 , article 38 , article 39 , article 41 , article 41 , article 79 , article 81 and article 82 may be revoked at any time by the european parliament or by the council . a decision of revocation shall put an end to the delegation of power specified in that decision . it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein . it shall not affect the validity of any delegated acts already in force .


### the commission shall be empowered to adopt delegated acts in accordance with article 86 for the purpose of further specifying : ### the commission shall be empowered to adopt delegated acts in accordance with article 86 , after requesting an opinion of the european data protection board , for the purpose of further specifying :


### the supervisory authority shall impose a fine up to 1 000 000 eur or , in case of an enterprise up to 2 % of its annual worldwide turnover , to anyone who , intentionally or negligently : processes personal data without any or sufficient legal basis for the processing or does not comply with the conditions for consent pursuant to articles 6 , 7 and 8 ; processes special categories of data in violation of articles 9 and 81 ; does not comply with an objection or the requirement pursuant to article 19 ; does not comply with the conditions in relation to measures based on profiling pursuant to article 20 ; does not adopt internal policies or does not implement appropriate measures for ensuring and demonstrating compliance pursuant to articles 22 , 23 and 30 ; does not designate a representative pursuant to article 25 ; processes or instructs the processing of personal data in violation of the obligations in relation to processing on behalf of a controller pursuant to articles 26 and 27 ; does not alert on or notify a personal data breach or does not timely or completely notify the data breach to the supervisory authority or to the data subject pursuant to articles 31 and 32 ; does not carry out a data protection impact assessment pursuant or processes personal data without prior authorisation or prior consultation of the supervisory authority pursuant to articles 33 and 34 ; does not designate a data protection officer or does not ensure the conditions for fulfilling the tasks pursuant to articles 35 , 36 and 37 ; misuses a data protection seal or mark in the meaning of article 39 ; carries out or instructs a data transfer to a third country or an international organisation that is not allowed by an adequacy decision or by appropriate safeguards or by a derogation pursuant to articles 40 to 44 ; does not comply with an order or a temporary or definite ban on processing or the suspension of data flows by the supervisory authority pursuant to article 53 ; does not comply with the obligations to assist or respond or provide relevant information to , or access to premises by , the supervisory authority pursuant to article 28 , article 29 , article 34 and article 53 ; does not comply with the rules for safeguarding professional secrecy pursuant to article 84 . ### the supervisory authority may impose a fine up to 1 000 000 eur or , in case of an enterprise up to 2 % of its annual worldwide turnover , to anyone who , intentionally or negligently : processes personal data without any or sufficient legal basis for the processing or does not comply with the conditions for consent pursuant to articles 6 , 7 and 8 ; processes special categories of data in violation of articles 9 and 81 ; does not comply with an objection or the requirement pursuant to article 19 ; does not comply with the conditions in relation to measures based on profiling pursuant to article 20 ; does not designate a representative pursuant to article 25 ; does not alert on or notify a personal data breach or does not timely or completely notify the data breach to the supervisory authority or to the data subject pursuant to articles 31 and 32 ; misuses a data protection seal or mark in the meaning of article 39 ; carries out or instructs a data transfer to a third country or an international organisation that is not allowed by an adequacy decision or by appropriate safeguards or by a derogation pursuant to articles 40 to 44 ; does not comply with an order or a temporary or definite ban on processing or the suspension of data flows by the supervisory authority pursuant to article 53 ; does not comply with the obligations to assist or respond or provide relevant information to , or access to premises by , the supervisory authority pursuant to article 28 , article 29 , article 34 and article 53 ; does not comply with the rules for safeguarding professional secrecy pursuant to article 84 .


### the controller or the processor shall designate a data protection officer for a period of at least two years . the data protection officer may be reappointed for further terms . during their term of office , the data protection officer may only be dismissed , if the data protection officer no longer fulfils the conditions required for the performance of their duties . ### during their term of office , the data protection officer may only be dismissed , if the data protection officer no longer fulfils the conditions required for the performance of their duties or for serious failure in this connection .


### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay and , where feasible , within 24 hours . where this cannot achieved within 24 hours , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay . ### a personal data breach may , if not addressed in an adequate and timely manner , result in substantial economic loss and social harm , including identity fraud , to the individual concerned . therefore , as soon as the controller becomes aware that such a breach has occurred , the controller should notify the breach to the supervisory authority without undue delay . where this cannot be achieved within a reasonable time period , an explanation of the reasons for the delay should accompany the notification . the individuals whose personal data could be adversely affected by the breach should be notified without undue delay in order to allow them to take the necessary precautions . a breach should be considered as adversely affecting the personal data or privacy of a data subject where it could result in , for example , identity theft or fraud , physical harm , significant humiliation or damage to reputation . the notification should describe the nature of the personal data breach as well as recommendations as well as recommendations for the individual concerned to mitigate potential adverse effects . notifications to data subjects should be made as soon as reasonably feasible , and in close cooperation with the supervisory authority and respecting guidance provided by it or other relevant authorities . for example , the chance for data subjects to mitigate an immediate risk of harm would call for a prompt notification of data subjects whereas the need to implement appropriate measures against continuing or similar data breaches may justify a longer delay .


### within the limits of this regulation , member states may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship . ### without prejudice to this regulation , member states or collective agreement among employers and employees may adopt by law specific rules regulating the processing of employees ' personal data in the employment context , in particular for the purposes of the recruitment , the performance of the contract of employment , including discharge of obligations laid down by law or by collective agreements , management , planning and organisation of work , criminal conviction , health and safety at work , and for the purposes of the exercise and enjoyment , on an individual or collective basis , of rights and benefits related to employment , and for the purpose of the termination of the employment relationship .


### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission for : specifying standard forms in relation to the processing of personal data of a child ; standard procedures and forms for exercising the rights of data subjects ; standard forms for the information to the data subject ; standard forms and procedures in relation to the right of access ; the right to data portability ; standard forms in relation to the responsibility of the controller to data protection by design and by default and to the documentation ; specific requirements for the security of processing ; the standard format and the procedures for the notification of a personal data breach to the supervisory authority and the communication of a personal data breach to the data subject ; standards and procedures for a data protection impact assessment ; forms and procedures for prior authorisation and prior consultation ; technical standards and mechanisms for certification ; the adequate level of protection afforded by a third country or a territory or a processing sector within that third country or an international organisation ; disclosures not authorized by union law ; mutual assistance ; joint operations ; decisions under the consistency mechanism . those powers should be exercised in accordance with regulation no 182 / 2011 of the european parliament and of the council of 16 february 2011 laying down the rules and general principles concerning mechanisms for control by the member states of the commission’s exercise of implementing powers46 . in this context , the commission should consider specific measures for micro , small and medium - sized enterprises . ### in order to ensure uniform conditions for the implementation of this regulation , implementing powers should be conferred on the commission . in implementing the provisions of this regulation , it should be ensured that no mandatory requirements for specific technical features are imposed on products and services , including terminal or other electronic communications equipment , which could impede the placing of equipment on the market and the free circulation of such equipment in and between member states .


### the controller shall communicate any rectification or erasure carried out in accordance with articles 16 and 17 to each recipient to whom the data have been disclosed , unless this proves impossible or involves a disproportionate effort . ### any rectification or erasure carried out in accordance with articles 16 and 17 is extended to each recipient to whom the data have been disclosed without the control of the data subject .


### where the appropriate safeguards with respect to the protection of personal data are not provided for in a legally binding instrument , the controller or processor shall obtain prior authorisation for the transfer , or a set of transfers , or for provisions to be inserted into administrative arrangements providing the basis for such transfer . such authorisation by the supervisory authority shall be in accordance with point of article 34 . if the transfer is related to processing activities which concern data subjects in another member state or other member states , or substantially affect the free movement of personal data within the union , the supervisory authority shall apply the consistency mechanism referred to in article 57 . authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain valid , until amended , replaced or repealed by that supervisory authority . ### authorisations by a supervisory authority on the basis of article 26 of directive 95 / 46 / ec shall remain in force for no longer than two years from the entry into force of this regulation or until amended , replaced or repealed by the supervisory authority .


### the right to lodge a complaint to the supervisory authority and the contact details of the supervisory authority ; ### the right to lodge a complaint to the supervisory authority ;


### each supervisory authority shall have the power : ### the competent supervisory authority shall have the power :


### act only on instructions from the controller , in particular , where the transfer of the personal data used is prohibited ; ### the processor shall act only on instructions from the controller , in particular , where the transfer of the personal data used is prohibited ;


### relates to processing activities which are related to the offering of goods or services to data subjects in several member states , or to the monitoring of their behaviour ; or ### relates to processing activities of personal data which are related to the offering of goods or services to data subjects in several member states when the controller or processor outside of the union does not name a representative in the territory of the union ;


### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , unless otherwise requested by the data subject . ### the data subject shall have the right to obtain from the controller communication of the personal data undergoing processing . where the data subject makes the request in electronic form , the information shall be provided in electronic form , with the exception of data prejudicial to business confidentiality , which shall be provided in the form of a hard copy .


### the data subject shall have the right to object , on grounds relating to their particular situation , at any time to the processing of personal data which is based on points , and of article 6 , unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subject . ### the data subject shall have the right to object , on grounds relating to their particular situation , unless the controller demonstrates legitimate interests which override the interests of the data subject . there shall be no right to object where the processing is required by law .


### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted in respect of lawfulness of processing ; specifying the criteria and conditions in relation to the consent of a child ; processing of special categories of data ; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; measures based on profiling ; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by default ; a processor ; criteria and requirements for the documentation and the security of processing ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; designation and tasks of the data protection officer ; codes of conduct ; criteria and requirements for certification mechanisms ; criteria and requirements for transfers by way of binding corporate rules ; transfer derogations ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council . ### in order to fulfil the objectives of this regulation , namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to ensure the free movement of personal data within the union , the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union should be delegated to the commission . in particular , delegated acts should be adopted specifying the technical formats for giving consent ; specifying conditions of modes based on icons and other graphic features for provision of information ; specifying the criteria and conditions for fees for exercising the rights of the data subject ; criteria and requirements for the information to the data subject and in relation to the right of access ; the right to be forgotten and to erasure ; criteria and requirements for verification of the responsibility of the controller ; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority , and on the circumstances where a personal data breach is likely to adversely affect the data subject ; the criteria and conditions for processing operations requiring a data protection impact assessment ; the criteria and requirements for determining a high degree of specific risks which require prior consultation ; codes of conduct ; criteria and requirements for certification mechanisms ; the adequate level of protection afforded by a third country or an international organisation ; administrative sanctions ; processing for health purposes ; processing in the employment context and processing for historical , statistical and scientific research purposes . it is of particular importance that the commission carry out appropriate consultations during its preparatory work , including at expert level and in particular with the european data protection board . the commission , when preparing and drawing - up delegated acts , should ensure a simultaneous , timely and appropriate transmission of relevant documents to the european parliament and council .