--- title: "Art. 10 GDPR: Processing of personal data relating to criminal convictions and offences" canonical: "https://dposchool.com/gdpr/article/10" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_10" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 10 GDPR · Chapter II: Principles # Article 10 GDPR: Processing of personal data relating to criminal convictions and offences Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) Personal data relating to criminal convictions and offences may be processed only under the control of official authority or when authorised by Union or Member State law with appropriate safeguards. A comprehensive register of criminal convictions may be kept only under the control of official authority. ## Official text Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 10 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_10) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 55](https://dposchool.com/gdpr/recital/55) ## Court of Justice judgments ### [C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others](https://dposchool.com/gdpr/case/c-474-24) Judgment of 14 July 2026 · ECLI:EU:C:2026:579 Publishing the names and sanctions of athletes who broke anti-doping rules falls within the GDPR; it is not in principle health data unless the substance or method reveals health information; national law may require publication if it allows an individual balancing and excludes recreational athletes, vulnerable persons and whistleblowers. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-474/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0474) ### [C-439/19, Proceedings brought by B](https://dposchool.com/gdpr/case/c-439-19) Judgment of 22 June 2021 · ECLI:EU:C:2021:504 Penalty points for traffic offences are data on criminal offences under Art. 10; the GDPR precludes a law making them publicly available without the requester showing a specific interest, or passing them on to businesses for reuse. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-439/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0439) ### Related (earlier law or other instruments) #### [C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)](https://dposchool.com/gdpr/case/c-136-17) Judgment of 24 September 2019 · ECLI:EU:C:2019:773 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) The ban on processing sensitive and criminal-offence data applies to search engines when they handle delisting requests; they must in principle delist such links unless a strict balancing, including the public's interest in the information, justifies keeping them. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-136/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0136) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [Google LLC: SEK 75,000,000](https://dposchool.com/gdpr/fine/imy-google-2020-03) Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection), Sweden · Decision of 10 March 2020 · Appeal status: reduced Failed to remove search results in time under the right to be forgotten, and told website owners about removals, which discouraged people from asking. [Source: the authority](https://www.imy.se/tillsyner/google/) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter II](https://dposchool.com/gdpr/chapter/2) / Article 10 Previous: [Art. 9 GDPR: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) Next: [Art. 11 GDPR: Processing which does not require identification](https://dposchool.com/gdpr/article/11) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents