European Union: Implemented Regulation (EU) 2016/679 (GDPR) introducing data protection requirements
Description
Implemented Regulation (EU) 2016/679 (GDPR) introducing data protection requirements
On 25 May 2018, the General Data Protection Regulation (GDPR) enters into force. The GDPR introduces new obligations for organisations collecting, storing and processing data, as well as rights for data subjects. The GDPR provides six legal bases fo…
Scope
Policy Area
Data governance
Policy Instrument
Data protection regulation
Regulated Economic Activity
cross-cutting
Implementation Level
supranational
Government Branch
legislature
Government Body
parliament
Complete timeline of this policy change
Hide details
2012-01-25
under deliberation
2016-04-27
adopted
Key regulatory dimensions
Regulated subjects
The businesses, government agencies or individuals affected by this policy or regulatory change.
producer / supplier
1
Type
Private organisation
Economic activity
cross-cutting
Category
All
Policy change by business practice
The detailed activities within the scope of this policy or regulatory change.
personal data: identity: data collection
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: identity: storage (any form)
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: identity: data processing
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Recordkeeping requirement
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
consumer data: location: data collection
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
consumer data: location: storage (any form)
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
consumer data: location: data processing
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Recordkeeping requirement
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: genetic: data collection
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: genetic: storage (any form)
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: genetic: data processing
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Recordkeeping requirement
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: health: data collection
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: health: storage (any form)
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: health: data processing
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Recordkeeping requirement
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: biometric: data collection
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: biometric: storage (any form)
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: biometric: data processing
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
User right to withdraw consent
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Recordkeeping requirement
User right to information about third-parties, with which data has been shared
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: information pertaining to minors: data collection
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Customer age limit
User consent: Opt-in requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: information pertaining to minors: storage (any form)
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Customer age limit
User consent: Opt-in requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: information pertaining to minors: data processing
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Recordkeeping requirement
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Customer age limit
User consent: Opt-in requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: ethnicity: data collection
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: ethnicity: storage (any form)
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: ethnicity: data processing
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Recordkeeping requirement
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: political orientation: data collection
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: political orientation: storage (any form)
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: political orientation: data processing
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Recordkeeping requirement
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: religious beliefs: data collection
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: religious beliefs: storage (any form)
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: religious beliefs: data processing
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Recordkeeping requirement
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Technical standard adherence
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: sexual orientation: data collection
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: sexual orientation: storage (any form)
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: sexual orientation: data processing
Regulatory tool
User right to rectification of personal data
User consent: Other requirement
User right to deletion of personal data
User consent: Permit user opt-out
Preventive security requirement
User right to restriction of personal data processing
Responsive security requirement
Designation of responsible employee
Recordkeeping requirement
Purpose/processing limitation
Duty to appoint compliance officer
Private code of conduct requirement
User notification requirement
Regulator notification requirement
User consent: Opt-in requirement
Regulator cooperation requirements
User right against automated decision making
Complaint mechanism requirement
Sanctions
Restitution of damages
Suspension of business
Fine
Regulated subjects
1
personal data: information that is publicly available: data collection
Regulatory tool
User consent: Permit user opt-out
User right to restriction of personal data processing
Purpose/processing limitation
User notification requirement
User consent: Opt-in requirement
Complaint mechanism requirement
Sanctions
Regulated subjects
1
personal data: information that is publicly available: storage (any form)
Regulatory tool
User consent: Other requirement
User consent: Permit user opt-out
User right to restriction of personal data processing
Recordkeeping requirement
Purpose/processing limitation
User notification requirement
User consent: Opt-in requirement
Complaint mechanism requirement
Sanctions
Regulated subjects
1
personal data: information that is publicly available: data processing
Regulatory tool
User consent: Other requirement
User consent: Permit user opt-out
User right to restriction of personal data processing
Recordkeeping requirement
Purpose/processing limitation
User notification requirement
User consent: Opt-in requirement
Complaint mechanism requirement
Sanctions
Regulated subjects
1