GDPR
General Data Protection Regulation — European Parliament / Council
Also known as: General Data Protection Regulation, Regulation (EU) 2016/679, GDPR 2016/679
At a glance
- Status
- In force
- Next deadline
- in 14 days
- Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date source
- Who must comply
- Any organisation that processes personal data in the context of an EU establishment, wherever the processing happens, and organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there. source
- How it is assessed
- The controller must be able to demonstrate compliance itself (accountability, Article 5(2)). source
- Authority
- Adopted by the European Parliament and the Council. Enforced by the independent national supervisory authorities (DPAs) of each Member State; the European Data Protection Board (EDPB) issues guidelines and adopts binding decisions when DPAs disagree in cross-border cases. source
- Last change
EU regulation on data protection and privacy for all individuals within the European Union and European Economic Area. Compliance is shaped by EDPB guidelines and enforcement decisions.
Recent changes
-
Info
Norwegian DPA fines Xandr EUR 8.6 million for unlawful processing of personal data
The Norwegian DPA has fined Xandr Inc. EUR 8.6 million for unlawfully processing personal data of Grindr users, including advertising IDs, IP addresses, and sexual orientation …
-
Low
EDPB publishes statement on data protection challenges of smart glasses
The European Data Protection Board has published a statement and report examining the data protection risks posed by smart glasses, which contain cameras and microphones connected …
-
Info
Italian DPA fines Wind Tre EUR 16.7 million for unlawful telemarketing and GDPR breaches
The Italian Data Protection Authority has issued a final decision imposing an administrative fine of EUR 16.7 million on Wind Tre S.p.A. for multiple GDPR violations. …
-
Info
Italian DPA fines Wind Tre EUR 16.7 million for unlawful telemarketing and data protection breaches
The Italian Data Protection Authority issued a definitive administrative fine of EUR 16.7 million against Wind Tre S.p.A. following an investigation into unlawful telemarketing practices and …
-
Info
Italian DPA fines Emirates EUR 180,000 for transparency violations in health data processing
The Italian DPA fined Emirates EUR 180,000 for infringements of GDPR Articles 5, 12, and 13 in processing passengers' health data through MEDIF forms for fitness-to-fly …
-
Info
Italian DPA fines BBVA EUR 5.5 million for failing to respect customer's objection to direct marketing
The Italian Data Protection Authority fined BBVA EUR 5,508,000 for failing to give effect to a customer's objection to direct marketing through the bank's mobile app, …
-
Info
Italian DPA fines security company EUR 39,000 for failing to respond to employee data access requests
The Italian DPA (Garante) fined La Patria S.p.A. EUR 39,000 for breaching Articles 12, 13, and 15 of the GDPR after the company failed to respond …
-
Info
Italian DPA fines IQVIA EUR 7,000,000 for unlawful processing of patients' health data
The Italian Data Protection Authority fined IQVIA Solutions Italy EUR 7,000,000 for unlawfully processing health data of approximately one million patients from 800 general practitioners' practices …
-
Info
Italian DPA fines Emirates EUR 180,000 for insufficient transparency on passengers' health data processing
The Italian Data Protection Authority fined Emirates EUR 180,000 for infringements under GDPR Articles 12 and 13 relating to the processing of passengers' health data collected …
-
Info
Italian DPA fines BBVA EUR 5,508,000 for failing to respect customer's objection to direct marketing
The Italian DPA fined BBVA EUR 5,508,000 for failing to respect a customer's objection to direct marketing, which continued for seven months despite the customer exercising …
-
Info
Swedish DPA fines Miljödata EUR 160,000 for insufficient technical and organisational measures
The Swedish Data Protection Authority (IMY) has imposed an administrative fine of approximately EUR 160,000 against Miljödata, an IT service provider, for violating Article 32 GDPR …
-
Info
Hellenic DPA publishes decision on E.E.T.A.A. data breach involving Ministry of Social Cohesion and Family…
The Hellenic Data Protection Authority issued a decision on a major data breach affecting E.E.T.A.A.'s information systems used by the Ministry of Social Cohesion and Family …
-
Info
Swedish DPA fines Miljödata EUR 160,000 for insufficient technical and organisational security measures
Swedish DPA (IMY) fined Miljödata SEK 1,800,000 (approximately EUR 160,000) for violating Article 32(1) GDPR following a cyberattack in August 2025 that compromised personal data of …
-
Info
Hellenic DPA fines Ministry and processor for data breach involving outdated systems and inadequate security
The Hellenic Data Protection Authority issued administrative fines totalling EUR 350,000 following a large-scale personal data breach affecting the Ministry of Social Cohesion and Family Affairs …
-
Info
Dutch DPA fines Uber EUR 824,990,000 for unlawful automated decision-making and insufficient information on…
The Dutch data protection authority (Autoriteit Persoonsgegevens) has imposed an administrative fine of EUR 824,990,000 on Uber for violating GDPR Article 22 by making fully automated …
-
Info
Greek DPA imposes fine on company for GDPR violation
The Greek Data Protection Authority (DPA) issued Decision 19 on 5 October 2026, imposing a fine on a company for violating GDPR provisions. This decision binds …
-
Info
Irish Data Protection Commission fines Google EUR 403 million for location data processing violations
The Irish Data Protection Commission has issued a final decision imposing administrative fines totalling EUR 403 million on Google Ireland Limited following an inquiry into Google's …
-
Info
Irish DPC fines Google €403 million for unlawful location data processing
The Irish Data Protection Commission (DPC) has issued a final decision imposing administrative fines totalling €403 million on Google Ireland Limited following an inquiry into the …
-
Info
Irish Data Protection Commission fines Google EUR 403 million for unlawful location data processing
The Irish Data Protection Commission issued a final decision fining Google EUR 403 million for breaching GDPR requirements in processing location data through three specific features. …
-
Info
Spanish DPA fines Securitas Direct EUR 100,000 for directing data subjects to chargeable telephone number
The Spanish DPA (AEPD) found Securitas Direct in breach of Article 12(2) GDPR for directing data subjects to exercise their rights through a chargeable 902 telephone …
-
Info
Spanish DPA fines Securitas Direct EUR 100,000 for charging data subjects to exercise rights
The Spanish Data Protection Authority (AEPD) fined Securitas Direct EUR 100,000 for directing data subjects to a paid 902 telephone number to exercise their rights of …
-
Info
Spanish DPA fines Securitas Direct €100,000 for directing data subjects to chargeable phone number for rights…
The Spanish Data Protection Authority (AEPD) imposed a €100,000 fine on Securitas Direct for violating Article 12 GDPR by directing data subjects to a chargeable 902 …
-
Info
Spanish DPA fines Securitas Direct EUR 100,000 for directing data subjects to chargeable number for rights…
The Spanish Data Protection Authority (AEPD) imposed a EUR 100,000 fine on Securitas Direct for directing data subjects to a chargeable 902 telephone number to exercise …
-
Medium
EDPB adopts harmonised fining methodology and final DSA-GDPR guidelines
The European Data Protection Board has adopted guidelines establishing a harmonised five-step methodology for Data Protection Authorities to use when deciding whether to impose administrative fines …
-
Info
CNIL fines EXTIA EUR 300,000 for failure to process erasure requests
The French Data Protection Authority (CNIL) imposed an administrative fine of EUR 300,000 on EXTIA, an IT and engineering company, for breaches of Articles 12 and …
-
Info
CNIL fines EXTIA €300,000 for failure to process erasure requests and inform data subjects
The French Data Protection Authority (CNIL) issued an administrative fine of €300,000 to EXTIA on 21 July 2026 for breaches of Articles 12 and 17 of …
-
Info
CNIL imposes EUR 300,000 fine on EXTIA for failure to process data subject erasure requests
The French Data Protection Authority (CNIL) issued an administrative fine of EUR 300,000 against EXTIA, an IT and engineering consulting firm, for systematic failures to respect …
-
Info
CNIL fines Hôpital Privé de la Loire EUR 500,000 for data security failures and breach notification violations
The French Data Protection Authority (CNIL) fined Hôpital Privé de la Loire EUR 500,000 following a 2025 data breach that exposed personal and health data of …
-
Info
CNIL fines Hôpital Privé de la Loire 500,000 EUR for inadequate security and data breach notification failures
The French Data Protection Authority (CNIL) fined Hôpital Privé de la Loire 500,000 EUR for GDPR violations following a summer 2025 data breach that exposed the …
-
Info
CNIL fines Hôpital Privé de la Loire EUR 500,000 for health data breach
The French Data Protection Authority (CNIL) has fined Hôpital Privé de la Loire EUR 500,000 following a data breach in summer 2025 that exposed personal and …
-
Info
DPC announces EUR 645,000 fine against HSE for data protection failings in document storage
The Data Protection Commission has issued a final decision against Ireland's Health Service Executive (HSE) following an inquiry into two unauthorized access incidents at psychiatric hospital …
-
Info
DPC issues €645,000 fine to HSE for inadequate storage and breach notification failures
The Data Protection Commission has issued a final decision against the Health Service Executive (HSE) following an inquiry into two unauthorised access incidents to paper medical …
-
Info
CNIL fines MOBIUS SOLUTIONS LTD €1 million for data breach and GDPR violations
The French Data Protection Authority (CNIL) fined MOBIUS SOLUTIONS LTD €1 million on 11 December 2025 following a data breach notification from DEEZER in November 2022 …
-
Info
CNIL fines NEXPUBLICA FRANCE €1.7 million for insufficient data security measures
The CNIL fined NEXPUBLICA FRANCE €1.7 million for breaching Article 32 of the GDPR by failing to implement adequate technical and organizational security measures for its …
-
Info
CNIL fines FREE MOBILE and FREE €42 million for data breach affecting 24 million subscribers
The CNIL issued combined fines of €42 million against FREE MOBILE and FREE following a January 2026 decision regarding an October 2024 data breach that exposed …
-
Info
France Travail fined €5 million for inadequate data security
France Travail, a French public employment service, was fined €5 million by CNIL for inadequate technical and organisational security measures that failed to prevent a 2024 …
That is the last 90 days. Sign in to read further back.
Key dates
Add these dates to your calendar- in 14 days Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date
- in 144 days Regulation (EU) 2025/2518 starts to apply to cross-border complaints lodged and ex officio investigations opened after this date
- in 243 days EDPB and AMLA to develop Joint Guidelines clarifying how organizations can share information to fight financial crime while protecting personal data under Article 75 of the AML Regulation
- European Parliament committee approves the text agreed with the Council on the small mid-caps omnibus, COM(2025) 501
- Coreper letter confirms the interinstitutional agreement on the small mid-caps omnibus, COM(2025) 501
- EDPB launches its 2026 coordinated enforcement action on transparency and information duties (Articles 12-14), with 25 DPAs taking part
- Regulation (EU) 2025/2518 on cross-border enforcement procedure enters into force
Show 6 earlier dates
- Regulation (EU) 2025/2518 published in the Official Journal (L series)
- Regulation (EU) 2025/2518 adopted - additional procedural rules for cross-border GDPR enforcement (complaints, investigations, right to be heard, access to the file, EDPB dispute resolution); the GDPR text is unchanged
- Commission proposes GDPR amendments in the Digital Omnibus, COM(2025) 837
- Commission proposes the small mid-caps omnibus, COM(2025) 501, amending GDPR Article 30(5)
- GDPR starts to apply in all Member States
- GDPR enters into force (twentieth day after publication in OJ L 119, 4 May 2016)
Amendments
-
Digital Omnibus proposal, COM(2025) 837 Draft
Commission proposal whose Article 3 amends the GDPR text directly. source
More
- Cookie and terminal-equipment rules move from the ePrivacy Directive into a new GDPR Article 88a, and a new Article 88b requires websites to respect automated, machine-readable consent signals (for example from browsers) once standards exist.
- A new Article 88c lets controllers rely on legitimate interest to process personal data for developing and operating AI systems and models.
- Article 22 is reworded so that a solely automated decision can be "necessary" for a contract even if it could be taken otherwise.
- Article 13 information duties no longer apply where the person can be assumed to have the information already (with exceptions).
- It also narrows "personal data" for entities without means to identify the person, lets controllers refuse abusive access requests, limits breach notification to high-risk breaches with a 96-hour deadline via a single entry point, and introduces EU-wide DPIA lists.
- Not adopted; awaiting a committee decision in the European Parliament.
-
Small mid-caps omnibus proposal (Omnibus IV), COM(2025) 501 Draft
Commission proposal amending Article 30(5): the exemption from keeping records of processing activities would cover all organisations with fewer than 750 employees (today 250), unless their processing is likely to result in a high risk. source
More
- Interinstitutional agreement reached (Coreper letter 26 June 2026, committee approval 2 July 2026); not yet voted in plenary or published.
-
Regulation (EU) 2016/679 (as corrected 2018) ErrataCurrent text
Corrigendum 32016R0679R(02), published in all official languages including English in OJ L 127 of 23 May 2018, two days before the GDPR began to apply. source
More
- It is the latest correction to the English text.
-
Regulation (EU) 2016/679 Major version
The General Data Protection Regulation, published in OJ L 119 of 4 May 2016. source
More
- It repealed Directive 95/46/EC, entered into force on 24 May 2016 and has applied since 25 May 2018.
Who it applies to
The GDPR covers the processing of personal data by automated means, and manual processing where the data sits in a filing system (Article 2).
- EU establishment
- It applies to controllers and processors established in the EU regardless of where processing takes place (Article 3). source
- Outside the EU
- It applies to non-EU organisations that offer goods or services to people in the EU or monitor their behaviour in the EU (Article 3). source
- Excluded
- Purely personal or household activity and activity outside the scope of Union law are excluded. source
How compliance is assessed
The controller must be able to demonstrate compliance itself (accountability, Article 5(2)).
- Certificate or audit
- No certificate or audit is required. source
- Records
- Keep records of processing activities (Article 30; organisations under 250 staff are exempt unless the processing is risky, not occasional or involves special categories or criminal data). source
- Impact assessment
- Run a data protection impact assessment before high-risk processing (Article 35). source
- Data protection officer
- Appoint a data protection officer for public bodies and where core activities require regular and systematic monitoring of individuals on a large scale or large-scale processing of special-category or criminal data (Article 37). source
- Breach notification
- Notify personal data breaches to the authority within 72 hours where feasible (Article 33). source
- Certification
- GDPR certification schemes under Article 42 exist but are voluntary. source
Enforcement and penalties
Each Member State's supervisory authority (DPA) investigates and fines.
Up to EUR 10 million or 2%
Under Article 83, for breaches of controller and processor duties such as security, DPIA, DPO and breach notification (Articles 8, 11, 25-39, 42, 43). For an undertaking, 2% of worldwide annual turnover of the preceding year if that is higher. source
Up to EUR 20 million or 4%
Under Article 83, for breaches of the core principles, lawful basis, consent, special categories, data subject rights (Articles 12-22), international transfers and non-compliance with an authority's order. For an undertaking, 4% if higher. source
- Cross-border cases
- In cross-border cases the authority of the main establishment leads under the one-stop-shop, and the EDPB adopts binding decisions when authorities disagree (Article 65). source
- Public authorities
- Whether and how far public authorities can be fined is left to each Member State (Article 83(7)). source
- Calculating fines
- The EDPB's Guidelines 04/2022 set out how fines are calculated. source
- Fine or other powers
- The EDPB's Guidelines 04/2026 (17 September 2026) set out how DPAs decide whether to fine or use other corrective powers. source
- Procedure from 2027
- From 2 April 2027, Regulation (EU) 2025/2518 sets common procedural rules for these cross-border cases. source
Recent fines
Documents
- Law text Regulation (EU) 2016/679 (General Data Protection Regulation)
- Law text Regulation (EU) 2025/2518 - additional procedural rules on GDPR enforcement
- Law text Digital Omnibus proposal COM(2025) 837 (amends the GDPR; not adopted)
- Law text Small mid-caps omnibus proposal COM(2025) 501 (amends GDPR Article 30; not adopted)
- Guidance EDPB Guidelines 04/2022 on the calculation of administrative fines (v2.1)
Show 1 more document
Frequently asked questions
What changed in the GDPR in 2025?
The GDPR text itself did not change. Regulation (EU) 2025/2518, adopted 26 November 2025 and in force since 1 January 2026, adds procedural rules for cross-border enforcement (complaints, investigations, the right to be heard, EDPB dispute resolution); it applies from 2 April 2027. Two Commission proposals to amend the GDPR text were also published: the small mid-caps omnibus, COM(2025) 501 (21 May 2025), raising the Article 30 records exemption to organisations under 750 employees, and the Digital Omnibus, COM(2025) 837 (19 November 2025). Neither had been adopted as of October 2026. source
Has the Digital Omnibus changed the GDPR?
Not yet. The Commission proposed GDPR amendments in the Digital Omnibus, COM(2025) 837, on 19 November 2025. As of October 2026 the European Parliament lists the file 2025/0360(COD) as awaiting a committee decision, so none of the proposed changes apply. source
What is the maximum GDPR fine?
EUR 20 million or, for an undertaking, 4% of total worldwide annual turnover of the preceding financial year, whichever is higher, for breaches of the core principles, data subject rights, transfer rules or an authority's order. Other controller and processor duties carry up to EUR 10 million or 2%. Fines on public authorities depend on each Member State's law (Article 83(7)). source
What GDPR fines were issued in 2026?
Among those the EDPB reported: the Dutch DPA fined Uber EUR 824,990,000 for fully automated deactivation of drivers (October 2026; Uber has appealed, no final judicial decision yet); the Irish DPC fined Google EUR 403,000,000 over location data processing (final decision 21 September 2026); and the Norwegian DPA fined Xandr EUR 8,600,000 for processing Grindr users' data in real-time bidding without a legal basis (final decision 2 October 2026). source
Is GDPR certification mandatory?
No. Article 42 certification is voluntary. Compliance is shown by the organisation itself through accountability: records of processing, DPIAs for high-risk processing and a DPO where Article 37 requires one. source
How fast must a data breach be reported under the GDPR?
Without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. source
Verified against official sources on 17 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to GDPR (RSS)