--- title: "Art. 24 GDPR: Responsibility of the controller" canonical: "https://dposchool.com/gdpr/article/24" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_24" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 24 GDPR · Chapter IV: Controller and processor · Section 1: General obligations # Article 24 GDPR: Responsibility of the controller Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) The controller must implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing complies with the Regulation, taking into account the nature, scope, context and purposes of the processing and the risks. The measures must be reviewed and updated where necessary. ## Official text ### Article 24(1) **1.** Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary. ### Article 24(2) **2.** Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller. ### Article 24(3) **3.** Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 24 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_24) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 74](https://dposchool.com/gdpr/recital/74) - [Recital 75](https://dposchool.com/gdpr/recital/75) - [Recital 76](https://dposchool.com/gdpr/recital/76) - [Recital 77](https://dposchool.com/gdpr/recital/77) ## Court of Justice judgments ### [C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL](https://dposchool.com/gdpr/case/c-492-23) Judgment of 2 December 2025 · ECLI:EU:C:2025:935 An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0492) ### [C-687/21, BL v MediaMarktSaturn Hagen-Iserlohn GmbH](https://dposchool.com/gdpr/case/c-687-21) Judgment of 25 January 2024 · ECLI:EU:C:2024:72 Staff mistakenly handing a document to the wrong person does not by itself show inadequate security measures; compensation is compensatory only; where the wrong recipient demonstrably did not read the data, a purely hypothetical risk of misuse is not damage. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-687/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0687) ### [C-340/21, VB v Natsionalna agentsia za prihodite](https://dposchool.com/gdpr/case/c-340-21) Judgment of 14 December 2023 · ECLI:EU:C:2023:986 A data breach by third parties does not in itself prove that security measures were inadequate; the controller bears the burden of proving appropriateness; fear of misuse after a breach can be non-material damage. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-340/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0340) ### Related (earlier law or other instruments) #### [C-129/21, Proximus NV v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-129-21) Judgment of 27 October 2022 · ECLI:EU:C:2022:833 Instrument: GDPR together with the ePrivacy Directive Consent to appear in phone directories, given once, covers all directory publishers; a request to be removed is an erasure request, and the controller must inform other controllers it supplied. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-129/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0129) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [McDonald’s Polska Sp. z o.o.: PLN 16,932,657](https://dposchool.com/gdpr/fine/uodo-mcdonalds-2025-07) Prezes Urzędu Ochrony Danych Osobowych (Polish Data Protection Authority), Poland · Announced on 21 July 2025 · Appeal status: unknown Outsourced staff scheduling without risk analysis or supervision of the processor, so employee data (names, PESEL or passport numbers, shifts) ended up in a public directory. Not fully confirmed: Decision date not shown on the page (announcement date used). Three fines: PLN 1,632,063 + 13,600,528 + 1,700,066. The processor was fined PLN 183,858 in total. Articles taken from the narrative; the page does not give a single list of infringed articles. [Source: the authority](https://uodo.gov.pl/pl/138/3827) ### [Luka Inc.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-luka-replika-2025-04) Garante per la protezione dei dati personali, Italy · Decision of 10 April 2025 · Appeal status: unknown AI companion chatbot ran with no identified legal basis, an inadequate privacy policy and no effective age verification despite excluding minors. [Source: the authority](https://www.edpb.europa.eu/news/ai-the-italian-supervisory-authority-fines-company-behind-chatbot-replika_en) ### [Enel Energia S.p.A.: EUR 79,107,101](https://dposchool.com/gdpr/fine/garante-enel-energia-2024-02) Garante per la protezione dei dati personali, Italy · Decision of 8 February 2024 · Appeal status: upheld Telemarketing: weak control of sales-agent access let unauthorised agencies place contracts obtained through unlawful calls into the company's systems; failures of security, accountability, privacy by design and processor contracts. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9988710) ### [TikTok Technology Limited: EUR 345,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2023-09) Data Protection Commission (Ireland), Ireland · Decision of 1 September 2023 · Appeal status: under appeal Child users' accounts were public by default, 'Family Pairing' was weak, and children were not told clearly about the settings; the EDPB added a fairness ('dark patterns') finding. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-tiktok-technology-limited-september-2023) ### [Meta Platforms Ireland Limited: EUR 405,000,000](https://dposchool.com/gdpr/fine/dpc-instagram-2022-09) Data Protection Commission (Ireland), Ireland · Decision of 2 September 2022 · Appeal status: under appeal Instagram let 13 to 17 year olds run business accounts that published their phone numbers or emails, and set child accounts to public by default. [Source: the authority](https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-concerning-processing-personal-data-relating-child-users-instagram-social-networking-service) ### [IAB Europe: EUR 250,000](https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02) Autorité de protection des données / Gegevensbeschermingsautoriteit (Belgium), Belgium · Decision of 2 February 2022 · Appeal status: upheld The ad-industry Transparency and Consent Framework processed users' preference strings without a legal basis, with vague information, weak safeguards, no records, no DPIA and no DPO. [Source: the authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr) ### [VODAFONE ESPAÑA, S.A.U.: EUR 6,000,000](https://dposchool.com/gdpr/fine/aepd-vodafone-espana-2021-02) Agencia Española de Protección de Datos (AEPD), Spain · Decision of 11 February 2021 · Appeal status: unknown Telecom operator failed to control the marketing firms calling and texting on its behalf, including processors outside the EU, so people who had objected kept receiving marketing. [Source: the authority](https://www.aepd.es/documento/ps-00059-2020.pdf) ### [TIM S.p.A.: EUR 27,802,946](https://dposchool.com/gdpr/fine/garante-tim-2020-01) Garante per la protezione dei dati personali, Italy · Decision of 15 January 2020 · Appeal status: unknown Aggressive telemarketing: calls to people who had refused or were on internal block lists, marketing without valid consent, and weak control of call-centre partners. Not fully confirmed: Amount, date and name read in the decision (register no. 7 of 15 January 2020). Articles listed are those the decision states for its main finding (section 3.1, which also cites Article 130 of the Italian Code); later sections discuss further provisions (e.g. Articles 12 and 21), so the list may be incomplete. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9256486) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 24 Previous: [Art. 23 GDPR: Restrictions](https://dposchool.com/gdpr/article/23) Next: [Art. 25 GDPR: Data protection by design and by default](https://dposchool.com/gdpr/article/25) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents