--- title: "GDPR full text: articles and recitals" canonical: "https://dposchool.com/gdpr" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" language: "en" publisher: "DPO School" --- # GDPR Navigator The full text of the General Data Protection Regulation (Regulation (EU) 2016/679), one page per article and per recital. Text as of 28 October 2026. Taken from EUR-Lex, as corrected. [About this navigator](https://dposchool.com/gdpr/about) ## Chapters and articles ### [Chapter I: General provisions](https://dposchool.com/gdpr/chapter/1) - [Article 1 Subject-matter and objectives](https://dposchool.com/gdpr/article/1) - [Article 2 Material scope](https://dposchool.com/gdpr/article/2) - [Article 3 Territorial scope](https://dposchool.com/gdpr/article/3) - [Article 4 Definitions](https://dposchool.com/gdpr/article/4) ### [Chapter II: Principles](https://dposchool.com/gdpr/chapter/2) - [Article 5 Principles relating to processing of personal data](https://dposchool.com/gdpr/article/5) - [Article 6 Lawfulness of processing](https://dposchool.com/gdpr/article/6) - [Article 7 Conditions for consent](https://dposchool.com/gdpr/article/7) - [Article 8 Conditions applicable to child's consent in relation to information society services](https://dposchool.com/gdpr/article/8) - [Article 9 Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) - [Article 10 Processing of personal data relating to criminal convictions and offences](https://dposchool.com/gdpr/article/10) - [Article 11 Processing which does not require identification](https://dposchool.com/gdpr/article/11) ### [Chapter III: Rights of the data subject](https://dposchool.com/gdpr/chapter/3) #### Section 1: Transparency and modalities - [Article 12 Transparent information, communication and modalities for the exercise of the rights of the data subject](https://dposchool.com/gdpr/article/12) #### Section 2: Information and access to personal data - [Article 13 Information to be provided where personal data are collected from the data subject](https://dposchool.com/gdpr/article/13) - [Article 14 Information to be provided where personal data have not been obtained from the data subject](https://dposchool.com/gdpr/article/14) - [Article 15 Right of access by the data subject](https://dposchool.com/gdpr/article/15) #### Section 3: Rectification and erasure - [Article 16 Right to rectification](https://dposchool.com/gdpr/article/16) - [Article 17 Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) - [Article 18 Right to restriction of processing](https://dposchool.com/gdpr/article/18) - [Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing](https://dposchool.com/gdpr/article/19) - [Article 20 Right to data portability](https://dposchool.com/gdpr/article/20) #### Section 4: Right to object and automated individual decision-making - [Article 21 Right to object](https://dposchool.com/gdpr/article/21) - [Article 22 Automated individual decision-making, including profiling](https://dposchool.com/gdpr/article/22) #### Section 5: Restrictions - [Article 23 Restrictions](https://dposchool.com/gdpr/article/23) ### [Chapter IV: Controller and processor](https://dposchool.com/gdpr/chapter/4) #### Section 1: General obligations - [Article 24 Responsibility of the controller](https://dposchool.com/gdpr/article/24) - [Article 25 Data protection by design and by default](https://dposchool.com/gdpr/article/25) - [Article 26 Joint controllers](https://dposchool.com/gdpr/article/26) - [Article 27 Representatives of controllers or processors not established in the Union](https://dposchool.com/gdpr/article/27) - [Article 28 Processor](https://dposchool.com/gdpr/article/28) - [Article 29 Processing under the authority of the controller or processor](https://dposchool.com/gdpr/article/29) - [Article 30 Records of processing activities](https://dposchool.com/gdpr/article/30) - [Article 31 Cooperation with the supervisory authority](https://dposchool.com/gdpr/article/31) #### Section 2: Security of personal data - [Article 32 Security of processing](https://dposchool.com/gdpr/article/32) - [Article 33 Notification of a personal data breach to the supervisory authority](https://dposchool.com/gdpr/article/33) - [Article 34 Communication of a personal data breach to the data subject](https://dposchool.com/gdpr/article/34) #### Section 3: Data protection impact assessment and prior consultation - [Article 35 Data protection impact assessment](https://dposchool.com/gdpr/article/35) - [Article 36 Prior consultation](https://dposchool.com/gdpr/article/36) #### Section 4: Data protection officer - [Article 37 Designation of the data protection officer](https://dposchool.com/gdpr/article/37) - [Article 38 Position of the data protection officer](https://dposchool.com/gdpr/article/38) - [Article 39 Tasks of the data protection officer](https://dposchool.com/gdpr/article/39) #### Section 5: Codes of conduct and certification - [Article 40 Codes of conduct](https://dposchool.com/gdpr/article/40) - [Article 41 Monitoring of approved codes of conduct](https://dposchool.com/gdpr/article/41) - [Article 42 Certification](https://dposchool.com/gdpr/article/42) - [Article 43 Certification bodies](https://dposchool.com/gdpr/article/43) ### [Chapter V: Transfers of personal data to third countries or international organisations](https://dposchool.com/gdpr/chapter/5) - [Article 44 General principle for transfers](https://dposchool.com/gdpr/article/44) - [Article 45 Transfers on the basis of an adequacy decision](https://dposchool.com/gdpr/article/45) - [Article 46 Transfers subject to appropriate safeguards](https://dposchool.com/gdpr/article/46) - [Article 47 Binding corporate rules](https://dposchool.com/gdpr/article/47) - [Article 48 Transfers or disclosures not authorised by Union law](https://dposchool.com/gdpr/article/48) - [Article 49 Derogations for specific situations](https://dposchool.com/gdpr/article/49) - [Article 50 International cooperation for the protection of personal data](https://dposchool.com/gdpr/article/50) ### [Chapter VI: Independent supervisory authorities](https://dposchool.com/gdpr/chapter/6) #### Section 1: Independent status - [Article 51 Supervisory authority](https://dposchool.com/gdpr/article/51) - [Article 52 Independence](https://dposchool.com/gdpr/article/52) - [Article 53 General conditions for the members of the supervisory authority](https://dposchool.com/gdpr/article/53) - [Article 54 Rules on the establishment of the supervisory authority](https://dposchool.com/gdpr/article/54) #### Section 2: Competence, tasks and powers - [Article 55 Competence](https://dposchool.com/gdpr/article/55) - [Article 56 Competence of the lead supervisory authority](https://dposchool.com/gdpr/article/56) - [Article 57 Tasks](https://dposchool.com/gdpr/article/57) - [Article 58 Powers](https://dposchool.com/gdpr/article/58) - [Article 59 Activity reports](https://dposchool.com/gdpr/article/59) ### [Chapter VII: Cooperation and consistency](https://dposchool.com/gdpr/chapter/7) #### Section 1: Cooperation - [Article 60 Cooperation between the lead supervisory authority and the other supervisory authorities concerned](https://dposchool.com/gdpr/article/60) - [Article 61 Mutual assistance](https://dposchool.com/gdpr/article/61) - [Article 62 Joint operations of supervisory authorities](https://dposchool.com/gdpr/article/62) #### Section 2: Consistency - [Article 63 Consistency mechanism](https://dposchool.com/gdpr/article/63) - [Article 64 Opinion of the Board](https://dposchool.com/gdpr/article/64) - [Article 65 Dispute resolution by the Board](https://dposchool.com/gdpr/article/65) - [Article 66 Urgency procedure](https://dposchool.com/gdpr/article/66) - [Article 67 Exchange of information](https://dposchool.com/gdpr/article/67) #### Section 3: European data protection board - [Article 68 European Data Protection Board](https://dposchool.com/gdpr/article/68) - [Article 69 Independence](https://dposchool.com/gdpr/article/69) - [Article 70 Tasks of the Board](https://dposchool.com/gdpr/article/70) - [Article 71 Reports](https://dposchool.com/gdpr/article/71) - [Article 72 Procedure](https://dposchool.com/gdpr/article/72) - [Article 73 Chair](https://dposchool.com/gdpr/article/73) - [Article 74 Tasks of the Chair](https://dposchool.com/gdpr/article/74) - [Article 75 Secretariat](https://dposchool.com/gdpr/article/75) - [Article 76 Confidentiality](https://dposchool.com/gdpr/article/76) ### [Chapter VIII: Remedies, liability and penalties](https://dposchool.com/gdpr/chapter/8) - [Article 77 Right to lodge a complaint with a supervisory authority](https://dposchool.com/gdpr/article/77) - [Article 78 Right to an effective judicial remedy against a supervisory authority](https://dposchool.com/gdpr/article/78) - [Article 79 Right to an effective judicial remedy against a controller or processor](https://dposchool.com/gdpr/article/79) - [Article 80 Representation of data subjects](https://dposchool.com/gdpr/article/80) - [Article 81 Suspension of proceedings](https://dposchool.com/gdpr/article/81) - [Article 82 Right to compensation and liability](https://dposchool.com/gdpr/article/82) - [Article 83 General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) - [Article 84 Penalties](https://dposchool.com/gdpr/article/84) ### [Chapter IX: Provisions relating to specific processing situations](https://dposchool.com/gdpr/chapter/9) - [Article 85 Processing and freedom of expression and information](https://dposchool.com/gdpr/article/85) - [Article 86 Processing and public access to official documents](https://dposchool.com/gdpr/article/86) - [Article 87 Processing of the national identification number](https://dposchool.com/gdpr/article/87) - [Article 88 Processing in the context of employment](https://dposchool.com/gdpr/article/88) - [Article 89 Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes](https://dposchool.com/gdpr/article/89) - [Article 90 Obligations of secrecy](https://dposchool.com/gdpr/article/90) - [Article 91 Existing data protection rules of churches and religious associations](https://dposchool.com/gdpr/article/91) ### [Chapter X: Delegated acts and implementing acts](https://dposchool.com/gdpr/chapter/10) - [Article 92 Exercise of the delegation](https://dposchool.com/gdpr/article/92) - [Article 93 Committee procedure](https://dposchool.com/gdpr/article/93) ### [Chapter XI: Final provisions](https://dposchool.com/gdpr/chapter/11) - [Article 94 Repeal of Directive 95/46/EC](https://dposchool.com/gdpr/article/94) - [Article 95 Relationship with Directive 2002/58/EC](https://dposchool.com/gdpr/article/95) - [Article 96 Relationship with previously concluded Agreements](https://dposchool.com/gdpr/article/96) - [Article 97 Commission reports](https://dposchool.com/gdpr/article/97) - [Article 98 Review of other Union legal acts on data protection](https://dposchool.com/gdpr/article/98) - [Article 99 Entry into force and application](https://dposchool.com/gdpr/article/99) ## Recitals The 173 recitals explain the reasons for the articles. [All recitals](https://dposchool.com/gdpr/recitals) ## Judgments, guidance and fines - [Court of Justice judgments](https://dposchool.com/gdpr/cases) - [EDPB guidance](https://dposchool.com/gdpr/guidance) - [Fines](https://dposchool.com/gdpr/fines) This is reference material, not legal advice. Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents