# GDPR Navigator (DPO School)

> The full English text of the General Data Protection Regulation, Regulation (EU) 2016/679, one page per article and recital, with ids for every paragraph and point. Text retrieved from the Publications Office of the European Union on 2026-10-28, as corrected (OJ L 127, 23.5.2018). Only the text published in the Official Journal is authentic. Articles, recitals, judgments, guidance and fines: Reviewed by Sergio Maldonado Elvira on 29 October 2026. Reference material, not legal advice.

## Pages

- [Home and chapter index](https://dposchool.com/gdpr)
- [All recitals](https://dposchool.com/gdpr/recitals)
- [About, source and licence, method and review](https://dposchool.com/gdpr/about)
- Articles: https://dposchool.com/gdpr/article/{1-99}, e.g. [Article 6](https://dposchool.com/gdpr/article/6); paragraph and point ids as fragments, e.g. https://dposchool.com/gdpr/article/6#4-a
- Recitals: https://dposchool.com/gdpr/recital/{1-173}, e.g. [Recital 47](https://dposchool.com/gdpr/recital/47)
- Chapters: https://dposchool.com/gdpr/chapter/{1-11}
- [Court of Justice judgments](https://dposchool.com/gdpr/cases): one page per judgment, https://dposchool.com/gdpr/case/{case number}, e.g. https://dposchool.com/gdpr/case/c-474-24
- [EDPB guidance](https://dposchool.com/gdpr/guidance): guidelines, recommendations and opinions, and WP29 documents endorsed by the EDPB
- [Fines](https://dposchool.com/gdpr/fines): fines imposed by supervisory authorities, in the currency imposed

## JSON (static, no key needed)

- [Index](https://dposchool.com/gdpr/api/v1/index.json): chapters, sections, every article and recital with its page and JSON address
- Article: https://dposchool.com/gdpr/api/v1/articles/{1-99}.json, e.g. [Article 6](https://dposchool.com/gdpr/api/v1/articles/6.json): text, paragraphs and points with ids, related recitals, source and dates
- Recital: https://dposchool.com/gdpr/api/v1/recitals/{1-173}.json, e.g. [Recital 47](https://dposchool.com/gdpr/api/v1/recitals/47.json)
- Judgment: https://dposchool.com/gdpr/api/v1/cases/{case number}.json, e.g. https://dposchool.com/gdpr/api/v1/cases/c-474-24.json
- Guidance: https://dposchool.com/gdpr/api/v1/guidance/{id}.json, e.g. https://dposchool.com/gdpr/api/v1/guidance/edpb-04-2026.json
- Fine: https://dposchool.com/gdpr/api/v1/fines/{id}.json, e.g. https://dposchool.com/gdpr/api/v1/fines/dt-xandr-2026-10.json
- The index lists every published judgment, guidance document and fine with its page and JSON address.

## Chapters

- [Chapter I: General provisions](https://dposchool.com/gdpr/chapter/1): Articles 1 to 4
- [Chapter II: Principles](https://dposchool.com/gdpr/chapter/2): Articles 5 to 11
- [Chapter III: Rights of the data subject](https://dposchool.com/gdpr/chapter/3): Articles 12 to 23
- [Chapter IV: Controller and processor](https://dposchool.com/gdpr/chapter/4): Articles 24 to 43
- [Chapter V: Transfers of personal data to third countries or international organisations](https://dposchool.com/gdpr/chapter/5): Articles 44 to 50
- [Chapter VI: Independent supervisory authorities](https://dposchool.com/gdpr/chapter/6): Articles 51 to 59
- [Chapter VII: Cooperation and consistency](https://dposchool.com/gdpr/chapter/7): Articles 60 to 76
- [Chapter VIII: Remedies, liability and penalties](https://dposchool.com/gdpr/chapter/8): Articles 77 to 84
- [Chapter IX: Provisions relating to specific processing situations](https://dposchool.com/gdpr/chapter/9): Articles 85 to 91
- [Chapter X: Delegated acts and implementing acts](https://dposchool.com/gdpr/chapter/10): Articles 92 to 93
- [Chapter XI: Final provisions](https://dposchool.com/gdpr/chapter/11): Articles 94 to 99

## Markdown (one file per page)

- Every page with text has a Markdown twin: its address plus ".md", e.g. https://dposchool.com/gdpr/article/6.md; the home page is https://dposchool.com/gdpr/index.md. Each file has YAML front matter (title, canonical, source, source_note, text_as_of, last_reviewed where the page states a review, language, publisher), the text as on the page with a heading for every paragraph and point (e.g. "Article 6(1)(f)"), and the page's links as absolute URLs.
- [Home and chapter index](https://dposchool.com/gdpr/index.md)
- [All recitals](https://dposchool.com/gdpr/recitals.md)
- [Chapter I: General provisions](https://dposchool.com/gdpr/chapter/1.md)
- [Chapter II: Principles](https://dposchool.com/gdpr/chapter/2.md)
- [Chapter III: Rights of the data subject](https://dposchool.com/gdpr/chapter/3.md)
- [Chapter IV: Controller and processor](https://dposchool.com/gdpr/chapter/4.md)
- [Chapter V: Transfers of personal data to third countries or international organisations](https://dposchool.com/gdpr/chapter/5.md)
- [Chapter VI: Independent supervisory authorities](https://dposchool.com/gdpr/chapter/6.md)
- [Chapter VII: Cooperation and consistency](https://dposchool.com/gdpr/chapter/7.md)
- [Chapter VIII: Remedies, liability and penalties](https://dposchool.com/gdpr/chapter/8.md)
- [Chapter IX: Provisions relating to specific processing situations](https://dposchool.com/gdpr/chapter/9.md)
- [Chapter X: Delegated acts and implementing acts](https://dposchool.com/gdpr/chapter/10.md)
- [Chapter XI: Final provisions](https://dposchool.com/gdpr/chapter/11.md)

## Markdown: articles

- [Article 1: Subject-matter and objectives](https://dposchool.com/gdpr/article/1.md)
- [Article 2: Material scope](https://dposchool.com/gdpr/article/2.md)
- [Article 3: Territorial scope](https://dposchool.com/gdpr/article/3.md)
- [Article 4: Definitions](https://dposchool.com/gdpr/article/4.md)
- [Article 5: Principles relating to processing of personal data](https://dposchool.com/gdpr/article/5.md)
- [Article 6: Lawfulness of processing](https://dposchool.com/gdpr/article/6.md)
- [Article 7: Conditions for consent](https://dposchool.com/gdpr/article/7.md)
- [Article 8: Conditions applicable to child's consent in relation to information society services](https://dposchool.com/gdpr/article/8.md)
- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9.md)
- [Article 10: Processing of personal data relating to criminal convictions and offences](https://dposchool.com/gdpr/article/10.md)
- [Article 11: Processing which does not require identification](https://dposchool.com/gdpr/article/11.md)
- [Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject](https://dposchool.com/gdpr/article/12.md)
- [Article 13: Information to be provided where personal data are collected from the data subject](https://dposchool.com/gdpr/article/13.md)
- [Article 14: Information to be provided where personal data have not been obtained from the data subject](https://dposchool.com/gdpr/article/14.md)
- [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15.md)
- [Article 16: Right to rectification](https://dposchool.com/gdpr/article/16.md)
- [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17.md)
- [Article 18: Right to restriction of processing](https://dposchool.com/gdpr/article/18.md)
- [Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing](https://dposchool.com/gdpr/article/19.md)
- [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20.md)
- [Article 21: Right to object](https://dposchool.com/gdpr/article/21.md)
- [Article 22: Automated individual decision-making, including profiling](https://dposchool.com/gdpr/article/22.md)
- [Article 23: Restrictions](https://dposchool.com/gdpr/article/23.md)
- [Article 24: Responsibility of the controller](https://dposchool.com/gdpr/article/24.md)
- [Article 25: Data protection by design and by default](https://dposchool.com/gdpr/article/25.md)
- [Article 26: Joint controllers](https://dposchool.com/gdpr/article/26.md)
- [Article 27: Representatives of controllers or processors not established in the Union](https://dposchool.com/gdpr/article/27.md)
- [Article 28: Processor](https://dposchool.com/gdpr/article/28.md)
- [Article 29: Processing under the authority of the controller or processor](https://dposchool.com/gdpr/article/29.md)
- [Article 30: Records of processing activities](https://dposchool.com/gdpr/article/30.md)
- [Article 31: Cooperation with the supervisory authority](https://dposchool.com/gdpr/article/31.md)
- [Article 32: Security of processing](https://dposchool.com/gdpr/article/32.md)
- [Article 33: Notification of a personal data breach to the supervisory authority](https://dposchool.com/gdpr/article/33.md)
- [Article 34: Communication of a personal data breach to the data subject](https://dposchool.com/gdpr/article/34.md)
- [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35.md)
- [Article 36: Prior consultation](https://dposchool.com/gdpr/article/36.md)
- [Article 37: Designation of the data protection officer](https://dposchool.com/gdpr/article/37.md)
- [Article 38: Position of the data protection officer](https://dposchool.com/gdpr/article/38.md)
- [Article 39: Tasks of the data protection officer](https://dposchool.com/gdpr/article/39.md)
- [Article 40: Codes of conduct](https://dposchool.com/gdpr/article/40.md)
- [Article 41: Monitoring of approved codes of conduct](https://dposchool.com/gdpr/article/41.md)
- [Article 42: Certification](https://dposchool.com/gdpr/article/42.md)
- [Article 43: Certification bodies](https://dposchool.com/gdpr/article/43.md)
- [Article 44: General principle for transfers](https://dposchool.com/gdpr/article/44.md)
- [Article 45: Transfers on the basis of an adequacy decision](https://dposchool.com/gdpr/article/45.md)
- [Article 46: Transfers subject to appropriate safeguards](https://dposchool.com/gdpr/article/46.md)
- [Article 47: Binding corporate rules](https://dposchool.com/gdpr/article/47.md)
- [Article 48: Transfers or disclosures not authorised by Union law](https://dposchool.com/gdpr/article/48.md)
- [Article 49: Derogations for specific situations](https://dposchool.com/gdpr/article/49.md)
- [Article 50: International cooperation for the protection of personal data](https://dposchool.com/gdpr/article/50.md)
- [Article 51: Supervisory authority](https://dposchool.com/gdpr/article/51.md)
- [Article 52: Independence](https://dposchool.com/gdpr/article/52.md)
- [Article 53: General conditions for the members of the supervisory authority](https://dposchool.com/gdpr/article/53.md)
- [Article 54: Rules on the establishment of the supervisory authority](https://dposchool.com/gdpr/article/54.md)
- [Article 55: Competence](https://dposchool.com/gdpr/article/55.md)
- [Article 56: Competence of the lead supervisory authority](https://dposchool.com/gdpr/article/56.md)
- [Article 57: Tasks](https://dposchool.com/gdpr/article/57.md)
- [Article 58: Powers](https://dposchool.com/gdpr/article/58.md)
- [Article 59: Activity reports](https://dposchool.com/gdpr/article/59.md)
- [Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned](https://dposchool.com/gdpr/article/60.md)
- [Article 61: Mutual assistance](https://dposchool.com/gdpr/article/61.md)
- [Article 62: Joint operations of supervisory authorities](https://dposchool.com/gdpr/article/62.md)
- [Article 63: Consistency mechanism](https://dposchool.com/gdpr/article/63.md)
- [Article 64: Opinion of the Board](https://dposchool.com/gdpr/article/64.md)
- [Article 65: Dispute resolution by the Board](https://dposchool.com/gdpr/article/65.md)
- [Article 66: Urgency procedure](https://dposchool.com/gdpr/article/66.md)
- [Article 67: Exchange of information](https://dposchool.com/gdpr/article/67.md)
- [Article 68: European Data Protection Board](https://dposchool.com/gdpr/article/68.md)
- [Article 69: Independence](https://dposchool.com/gdpr/article/69.md)
- [Article 70: Tasks of the Board](https://dposchool.com/gdpr/article/70.md)
- [Article 71: Reports](https://dposchool.com/gdpr/article/71.md)
- [Article 72: Procedure](https://dposchool.com/gdpr/article/72.md)
- [Article 73: Chair](https://dposchool.com/gdpr/article/73.md)
- [Article 74: Tasks of the Chair](https://dposchool.com/gdpr/article/74.md)
- [Article 75: Secretariat](https://dposchool.com/gdpr/article/75.md)
- [Article 76: Confidentiality](https://dposchool.com/gdpr/article/76.md)
- [Article 77: Right to lodge a complaint with a supervisory authority](https://dposchool.com/gdpr/article/77.md)
- [Article 78: Right to an effective judicial remedy against a supervisory authority](https://dposchool.com/gdpr/article/78.md)
- [Article 79: Right to an effective judicial remedy against a controller or processor](https://dposchool.com/gdpr/article/79.md)
- [Article 80: Representation of data subjects](https://dposchool.com/gdpr/article/80.md)
- [Article 81: Suspension of proceedings](https://dposchool.com/gdpr/article/81.md)
- [Article 82: Right to compensation and liability](https://dposchool.com/gdpr/article/82.md)
- [Article 83: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83.md)
- [Article 84: Penalties](https://dposchool.com/gdpr/article/84.md)
- [Article 85: Processing and freedom of expression and information](https://dposchool.com/gdpr/article/85.md)
- [Article 86: Processing and public access to official documents](https://dposchool.com/gdpr/article/86.md)
- [Article 87: Processing of the national identification number](https://dposchool.com/gdpr/article/87.md)
- [Article 88: Processing in the context of employment](https://dposchool.com/gdpr/article/88.md)
- [Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes](https://dposchool.com/gdpr/article/89.md)
- [Article 90: Obligations of secrecy](https://dposchool.com/gdpr/article/90.md)
- [Article 91: Existing data protection rules of churches and religious associations](https://dposchool.com/gdpr/article/91.md)
- [Article 92: Exercise of the delegation](https://dposchool.com/gdpr/article/92.md)
- [Article 93: Committee procedure](https://dposchool.com/gdpr/article/93.md)
- [Article 94: Repeal of Directive 95/46/EC](https://dposchool.com/gdpr/article/94.md)
- [Article 95: Relationship with Directive 2002/58/EC](https://dposchool.com/gdpr/article/95.md)
- [Article 96: Relationship with previously concluded Agreements](https://dposchool.com/gdpr/article/96.md)
- [Article 97: Commission reports](https://dposchool.com/gdpr/article/97.md)
- [Article 98: Review of other Union legal acts on data protection](https://dposchool.com/gdpr/article/98.md)
- [Article 99: Entry into force and application](https://dposchool.com/gdpr/article/99.md)

## Markdown: recitals

- [Recital 1](https://dposchool.com/gdpr/recital/1.md)
- [Recital 2](https://dposchool.com/gdpr/recital/2.md)
- [Recital 3](https://dposchool.com/gdpr/recital/3.md)
- [Recital 4](https://dposchool.com/gdpr/recital/4.md)
- [Recital 5](https://dposchool.com/gdpr/recital/5.md)
- [Recital 6](https://dposchool.com/gdpr/recital/6.md)
- [Recital 7](https://dposchool.com/gdpr/recital/7.md)
- [Recital 8](https://dposchool.com/gdpr/recital/8.md)
- [Recital 9](https://dposchool.com/gdpr/recital/9.md)
- [Recital 10](https://dposchool.com/gdpr/recital/10.md)
- [Recital 11](https://dposchool.com/gdpr/recital/11.md)
- [Recital 12](https://dposchool.com/gdpr/recital/12.md)
- [Recital 13](https://dposchool.com/gdpr/recital/13.md)
- [Recital 14](https://dposchool.com/gdpr/recital/14.md)
- [Recital 15](https://dposchool.com/gdpr/recital/15.md)
- [Recital 16](https://dposchool.com/gdpr/recital/16.md)
- [Recital 17](https://dposchool.com/gdpr/recital/17.md)
- [Recital 18](https://dposchool.com/gdpr/recital/18.md)
- [Recital 19](https://dposchool.com/gdpr/recital/19.md)
- [Recital 20](https://dposchool.com/gdpr/recital/20.md)
- [Recital 21](https://dposchool.com/gdpr/recital/21.md)
- [Recital 22](https://dposchool.com/gdpr/recital/22.md)
- [Recital 23](https://dposchool.com/gdpr/recital/23.md)
- [Recital 24](https://dposchool.com/gdpr/recital/24.md)
- [Recital 25](https://dposchool.com/gdpr/recital/25.md)
- [Recital 26](https://dposchool.com/gdpr/recital/26.md)
- [Recital 27](https://dposchool.com/gdpr/recital/27.md)
- [Recital 28](https://dposchool.com/gdpr/recital/28.md)
- [Recital 29](https://dposchool.com/gdpr/recital/29.md)
- [Recital 30](https://dposchool.com/gdpr/recital/30.md)
- [Recital 31](https://dposchool.com/gdpr/recital/31.md)
- [Recital 32](https://dposchool.com/gdpr/recital/32.md)
- [Recital 33](https://dposchool.com/gdpr/recital/33.md)
- [Recital 34](https://dposchool.com/gdpr/recital/34.md)
- [Recital 35](https://dposchool.com/gdpr/recital/35.md)
- [Recital 36](https://dposchool.com/gdpr/recital/36.md)
- [Recital 37](https://dposchool.com/gdpr/recital/37.md)
- [Recital 38](https://dposchool.com/gdpr/recital/38.md)
- [Recital 39](https://dposchool.com/gdpr/recital/39.md)
- [Recital 40](https://dposchool.com/gdpr/recital/40.md)
- [Recital 41](https://dposchool.com/gdpr/recital/41.md)
- [Recital 42](https://dposchool.com/gdpr/recital/42.md)
- [Recital 43](https://dposchool.com/gdpr/recital/43.md)
- [Recital 44](https://dposchool.com/gdpr/recital/44.md)
- [Recital 45](https://dposchool.com/gdpr/recital/45.md)
- [Recital 46](https://dposchool.com/gdpr/recital/46.md)
- [Recital 47](https://dposchool.com/gdpr/recital/47.md)
- [Recital 48](https://dposchool.com/gdpr/recital/48.md)
- [Recital 49](https://dposchool.com/gdpr/recital/49.md)
- [Recital 50](https://dposchool.com/gdpr/recital/50.md)
- [Recital 51](https://dposchool.com/gdpr/recital/51.md)
- [Recital 52](https://dposchool.com/gdpr/recital/52.md)
- [Recital 53](https://dposchool.com/gdpr/recital/53.md)
- [Recital 54](https://dposchool.com/gdpr/recital/54.md)
- [Recital 55](https://dposchool.com/gdpr/recital/55.md)
- [Recital 56](https://dposchool.com/gdpr/recital/56.md)
- [Recital 57](https://dposchool.com/gdpr/recital/57.md)
- [Recital 58](https://dposchool.com/gdpr/recital/58.md)
- [Recital 59](https://dposchool.com/gdpr/recital/59.md)
- [Recital 60](https://dposchool.com/gdpr/recital/60.md)
- [Recital 61](https://dposchool.com/gdpr/recital/61.md)
- [Recital 62](https://dposchool.com/gdpr/recital/62.md)
- [Recital 63](https://dposchool.com/gdpr/recital/63.md)
- [Recital 64](https://dposchool.com/gdpr/recital/64.md)
- [Recital 65](https://dposchool.com/gdpr/recital/65.md)
- [Recital 66](https://dposchool.com/gdpr/recital/66.md)
- [Recital 67](https://dposchool.com/gdpr/recital/67.md)
- [Recital 68](https://dposchool.com/gdpr/recital/68.md)
- [Recital 69](https://dposchool.com/gdpr/recital/69.md)
- [Recital 70](https://dposchool.com/gdpr/recital/70.md)
- [Recital 71](https://dposchool.com/gdpr/recital/71.md)
- [Recital 72](https://dposchool.com/gdpr/recital/72.md)
- [Recital 73](https://dposchool.com/gdpr/recital/73.md)
- [Recital 74](https://dposchool.com/gdpr/recital/74.md)
- [Recital 75](https://dposchool.com/gdpr/recital/75.md)
- [Recital 76](https://dposchool.com/gdpr/recital/76.md)
- [Recital 77](https://dposchool.com/gdpr/recital/77.md)
- [Recital 78](https://dposchool.com/gdpr/recital/78.md)
- [Recital 79](https://dposchool.com/gdpr/recital/79.md)
- [Recital 80](https://dposchool.com/gdpr/recital/80.md)
- [Recital 81](https://dposchool.com/gdpr/recital/81.md)
- [Recital 82](https://dposchool.com/gdpr/recital/82.md)
- [Recital 83](https://dposchool.com/gdpr/recital/83.md)
- [Recital 84](https://dposchool.com/gdpr/recital/84.md)
- [Recital 85](https://dposchool.com/gdpr/recital/85.md)
- [Recital 86](https://dposchool.com/gdpr/recital/86.md)
- [Recital 87](https://dposchool.com/gdpr/recital/87.md)
- [Recital 88](https://dposchool.com/gdpr/recital/88.md)
- [Recital 89](https://dposchool.com/gdpr/recital/89.md)
- [Recital 90](https://dposchool.com/gdpr/recital/90.md)
- [Recital 91](https://dposchool.com/gdpr/recital/91.md)
- [Recital 92](https://dposchool.com/gdpr/recital/92.md)
- [Recital 93](https://dposchool.com/gdpr/recital/93.md)
- [Recital 94](https://dposchool.com/gdpr/recital/94.md)
- [Recital 95](https://dposchool.com/gdpr/recital/95.md)
- [Recital 96](https://dposchool.com/gdpr/recital/96.md)
- [Recital 97](https://dposchool.com/gdpr/recital/97.md)
- [Recital 98](https://dposchool.com/gdpr/recital/98.md)
- [Recital 99](https://dposchool.com/gdpr/recital/99.md)
- [Recital 100](https://dposchool.com/gdpr/recital/100.md)
- [Recital 101](https://dposchool.com/gdpr/recital/101.md)
- [Recital 102](https://dposchool.com/gdpr/recital/102.md)
- [Recital 103](https://dposchool.com/gdpr/recital/103.md)
- [Recital 104](https://dposchool.com/gdpr/recital/104.md)
- [Recital 105](https://dposchool.com/gdpr/recital/105.md)
- [Recital 106](https://dposchool.com/gdpr/recital/106.md)
- [Recital 107](https://dposchool.com/gdpr/recital/107.md)
- [Recital 108](https://dposchool.com/gdpr/recital/108.md)
- [Recital 109](https://dposchool.com/gdpr/recital/109.md)
- [Recital 110](https://dposchool.com/gdpr/recital/110.md)
- [Recital 111](https://dposchool.com/gdpr/recital/111.md)
- [Recital 112](https://dposchool.com/gdpr/recital/112.md)
- [Recital 113](https://dposchool.com/gdpr/recital/113.md)
- [Recital 114](https://dposchool.com/gdpr/recital/114.md)
- [Recital 115](https://dposchool.com/gdpr/recital/115.md)
- [Recital 116](https://dposchool.com/gdpr/recital/116.md)
- [Recital 117](https://dposchool.com/gdpr/recital/117.md)
- [Recital 118](https://dposchool.com/gdpr/recital/118.md)
- [Recital 119](https://dposchool.com/gdpr/recital/119.md)
- [Recital 120](https://dposchool.com/gdpr/recital/120.md)
- [Recital 121](https://dposchool.com/gdpr/recital/121.md)
- [Recital 122](https://dposchool.com/gdpr/recital/122.md)
- [Recital 123](https://dposchool.com/gdpr/recital/123.md)
- [Recital 124](https://dposchool.com/gdpr/recital/124.md)
- [Recital 125](https://dposchool.com/gdpr/recital/125.md)
- [Recital 126](https://dposchool.com/gdpr/recital/126.md)
- [Recital 127](https://dposchool.com/gdpr/recital/127.md)
- [Recital 128](https://dposchool.com/gdpr/recital/128.md)
- [Recital 129](https://dposchool.com/gdpr/recital/129.md)
- [Recital 130](https://dposchool.com/gdpr/recital/130.md)
- [Recital 131](https://dposchool.com/gdpr/recital/131.md)
- [Recital 132](https://dposchool.com/gdpr/recital/132.md)
- [Recital 133](https://dposchool.com/gdpr/recital/133.md)
- [Recital 134](https://dposchool.com/gdpr/recital/134.md)
- [Recital 135](https://dposchool.com/gdpr/recital/135.md)
- [Recital 136](https://dposchool.com/gdpr/recital/136.md)
- [Recital 137](https://dposchool.com/gdpr/recital/137.md)
- [Recital 138](https://dposchool.com/gdpr/recital/138.md)
- [Recital 139](https://dposchool.com/gdpr/recital/139.md)
- [Recital 140](https://dposchool.com/gdpr/recital/140.md)
- [Recital 141](https://dposchool.com/gdpr/recital/141.md)
- [Recital 142](https://dposchool.com/gdpr/recital/142.md)
- [Recital 143](https://dposchool.com/gdpr/recital/143.md)
- [Recital 144](https://dposchool.com/gdpr/recital/144.md)
- [Recital 145](https://dposchool.com/gdpr/recital/145.md)
- [Recital 146](https://dposchool.com/gdpr/recital/146.md)
- [Recital 147](https://dposchool.com/gdpr/recital/147.md)
- [Recital 148](https://dposchool.com/gdpr/recital/148.md)
- [Recital 149](https://dposchool.com/gdpr/recital/149.md)
- [Recital 150](https://dposchool.com/gdpr/recital/150.md)
- [Recital 151](https://dposchool.com/gdpr/recital/151.md)
- [Recital 152](https://dposchool.com/gdpr/recital/152.md)
- [Recital 153](https://dposchool.com/gdpr/recital/153.md)
- [Recital 154](https://dposchool.com/gdpr/recital/154.md)
- [Recital 155](https://dposchool.com/gdpr/recital/155.md)
- [Recital 156](https://dposchool.com/gdpr/recital/156.md)
- [Recital 157](https://dposchool.com/gdpr/recital/157.md)
- [Recital 158](https://dposchool.com/gdpr/recital/158.md)
- [Recital 159](https://dposchool.com/gdpr/recital/159.md)
- [Recital 160](https://dposchool.com/gdpr/recital/160.md)
- [Recital 161](https://dposchool.com/gdpr/recital/161.md)
- [Recital 162](https://dposchool.com/gdpr/recital/162.md)
- [Recital 163](https://dposchool.com/gdpr/recital/163.md)
- [Recital 164](https://dposchool.com/gdpr/recital/164.md)
- [Recital 165](https://dposchool.com/gdpr/recital/165.md)
- [Recital 166](https://dposchool.com/gdpr/recital/166.md)
- [Recital 167](https://dposchool.com/gdpr/recital/167.md)
- [Recital 168](https://dposchool.com/gdpr/recital/168.md)
- [Recital 169](https://dposchool.com/gdpr/recital/169.md)
- [Recital 170](https://dposchool.com/gdpr/recital/170.md)
- [Recital 171](https://dposchool.com/gdpr/recital/171.md)
- [Recital 172](https://dposchool.com/gdpr/recital/172.md)
- [Recital 173](https://dposchool.com/gdpr/recital/173.md)

## Markdown: judgments, guidance and fines

- [Court of Justice judgments](https://dposchool.com/gdpr/cases.md)
- [EDPB guidance](https://dposchool.com/gdpr/guidance.md)
- [Fines](https://dposchool.com/gdpr/fines.md)
- [Case C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others](https://dposchool.com/gdpr/case/c-474-24.md)
- [Case C-199/24, ND v Legal Newsdesk Sweden AB, anciennement Garrapatica AB](https://dposchool.com/gdpr/case/c-199-24.md)
- [Case C-484/24, NTH Haustechnik GmbH v EM](https://dposchool.com/gdpr/case/c-484-24.md)
- [Case C-414/24, Datenschutzbehörde and Dr. G S v Bundesministerin für Justiz and D GmbH](https://dposchool.com/gdpr/case/c-414-24.md)
- [Case C-526/24, Brillen Rottler GmbH & Co. KG v TC](https://dposchool.com/gdpr/case/c-526-24.md)
- [Case C-97/23 P, WhatsApp Ireland Ltd v European Data Protection Board](https://dposchool.com/gdpr/case/c-97-23-p.md)
- [Case C-422/24, Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik](https://dposchool.com/gdpr/case/c-422-24.md)
- [Case C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL](https://dposchool.com/gdpr/case/c-492-23.md)
- [Case C-413/23 P, European Data Protection Supervisor v Single Resolution Board](https://dposchool.com/gdpr/case/c-413-23-p.md)
- [Case C-655/23, IP v Quirin Privatbank AG](https://dposchool.com/gdpr/case/c-655-23.md)
- [Case C-247/23, VP v Országos Idegenrendészeti Főigazgatóság](https://dposchool.com/gdpr/case/c-247-23.md)
- [Case C-638/23, Amt der Tiroler Landesregierung v Datenschutzbehörde](https://dposchool.com/gdpr/case/c-638-23.md)
- [Case C-203/22, CK v Magistrat der Stadt Wien](https://dposchool.com/gdpr/case/c-203-22.md)
- [Case C-383/23, Criminal proceedings against ILVA A/S](https://dposchool.com/gdpr/case/c-383-23.md)
- [Case C-394/23, Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect](https://dposchool.com/gdpr/case/c-394-23.md)
- [Case C-416/23, Österreichische Datenschutzbehörde v F R](https://dposchool.com/gdpr/case/c-416-23.md)
- [Case C-65/23, MK v K GmbH](https://dposchool.com/gdpr/case/c-65-23.md)
- [Case C-169/23, Nemzeti Adatvédelmi és Információszabadság Hatóság v UC](https://dposchool.com/gdpr/case/c-169-23.md)
- [Case C-621/22, Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens](https://dposchool.com/gdpr/case/c-621-22.md)
- [Case C-446/21, Maximilian Schrems v Meta Platforms Ireland Limited](https://dposchool.com/gdpr/case/c-446-21.md)
- [Case C-21/23, ND v DR](https://dposchool.com/gdpr/case/c-21-23.md)
- [Case C-200/23, Agentsia po vpisvaniyata v OL](https://dposchool.com/gdpr/case/c-200-23.md)
- [Case C-507/23, A v Patērētāju tiesību aizsardzības centrs](https://dposchool.com/gdpr/case/c-507-23.md)
- [Case C-768/21, TR v Land Hessen](https://dposchool.com/gdpr/case/c-768-21.md)
- [Case C-17/22, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV](https://dposchool.com/gdpr/case/c-17-22.md)
- [Case C-757/22, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V](https://dposchool.com/gdpr/case/c-757-22.md)
- [Case C-590/22, AT and BT v PS GbR and Others](https://dposchool.com/gdpr/case/c-590-22.md)
- [Case C-182/22, JU and SO v Scalable Capital GmbH](https://dposchool.com/gdpr/case/c-182-22.md)
- [Case C-741/21, GP v juris GmbH](https://dposchool.com/gdpr/case/c-741-21.md)
- [Case C-604/22, IAB Europe v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-604-22.md)
- [Case C-687/21, BL v MediaMarktSaturn Hagen-Iserlohn GmbH](https://dposchool.com/gdpr/case/c-687-21.md)
- [Case C-33/22, Österreichische Datenschutzbehörde v WK](https://dposchool.com/gdpr/case/c-33-22.md)
- [Case C-231/22, État belge v Autorité de protection des données](https://dposchool.com/gdpr/case/c-231-22.md)
- [Case C-667/21, ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts](https://dposchool.com/gdpr/case/c-667-21.md)
- [Case C-340/21, VB v Natsionalna agentsia za prihodite](https://dposchool.com/gdpr/case/c-340-21.md)
- [Case C-456/22, VX and AT v Gemeinde Ummendorf](https://dposchool.com/gdpr/case/c-456-22.md)
- [Case C-26/22, UF and AB v Land Hessen](https://dposchool.com/gdpr/case/c-26-22.md)
- [Case C-634/21, OQ v Land Hessen](https://dposchool.com/gdpr/case/c-634-21.md)
- [Case C-683/21, Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija](https://dposchool.com/gdpr/case/c-683-21.md)
- [Case C-807/21, Deutsche Wohnen SE v Staatsanwaltschaft Berlin](https://dposchool.com/gdpr/case/c-807-21.md)
- [Case C-319/22, Gesamtverband Autoteile-Handel e.V. v Scania CV AB](https://dposchool.com/gdpr/case/c-319-22.md)
- [Case C-307/22, FT v DW](https://dposchool.com/gdpr/case/c-307-22.md)
- [Case C-659/22, RK v Ministerstvo zdravotnictví](https://dposchool.com/gdpr/case/c-659-22.md)
- [Case C-252/21, Meta Platforms Inc and Others v Bundeskartellamt](https://dposchool.com/gdpr/case/c-252-21.md)
- [Case C-579/21, Proceedings brought by J.M](https://dposchool.com/gdpr/case/c-579-21.md)
- [Case C-487/21, F.F. v Österreichische Datenschutzbehörde and CRIF GmbH](https://dposchool.com/gdpr/case/c-487-21.md)
- [Case C-60/22, UZ v Bundesrepublik Deutschland](https://dposchool.com/gdpr/case/c-60-22.md)
- [Case C-300/21, UI v Österreichische Post AG](https://dposchool.com/gdpr/case/c-300-21.md)
- [Case C-34/21, Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums](https://dposchool.com/gdpr/case/c-34-21.md)
- [Case C-268/21, Norra Stockholm Bygg AB v Per Nycander AB](https://dposchool.com/gdpr/case/c-268-21.md)
- [Case C-453/21, X-FAB Dresden GmbH & Co. KG v FC](https://dposchool.com/gdpr/case/c-453-21.md)
- [Case C-154/21, RW v Österreichische Post AG](https://dposchool.com/gdpr/case/c-154-21.md)
- [Case C-132/21, BE v Nemzeti Adatvédelmi és Információszabadság Hatóság](https://dposchool.com/gdpr/case/c-132-21.md)
- [Case C-460/20, TU and RE v Google LLC](https://dposchool.com/gdpr/case/c-460-20.md)
- [Case C-129/21, Proximus NV v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-129-21.md)
- [Case C-77/21, Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság](https://dposchool.com/gdpr/case/c-77-21.md)
- [Case C-184/20, OT v Vyriausioji tarnybinės etikos komisija](https://dposchool.com/gdpr/case/c-184-20.md)
- [Case C-534/20, Leistritz AG v LH](https://dposchool.com/gdpr/case/c-534-20.md)
- [Case C-319/20, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV](https://dposchool.com/gdpr/case/c-319-20.md)
- [Case C-245/20, X and Z v Autoriteit Persoonsgegevens](https://dposchool.com/gdpr/case/c-245-20.md)
- [Case C-175/20, SIA 'SS' v Valsts ieņēmumu dienests](https://dposchool.com/gdpr/case/c-175-20.md)
- [Case C-439/19, Proceedings brought by B](https://dposchool.com/gdpr/case/c-439-19.md)
- [Case C-597/19, Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA](https://dposchool.com/gdpr/case/c-597-19.md)
- [Case C-645/19, Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-645-19.md)
- [Case C-61/19, Orange Romania SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)](https://dposchool.com/gdpr/case/c-61-19.md)
- [Case C-511/18, La Quadrature du Net and Others v Premier ministre and Others (joined cases C-511/18, C-512/18 and C-520/18)](https://dposchool.com/gdpr/case/c-511-18.md)
- [Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems](https://dposchool.com/gdpr/case/c-311-18.md)
- [Case C-673/17, Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH](https://dposchool.com/gdpr/case/c-673-17.md)
- [Case C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)](https://dposchool.com/gdpr/case/c-136-17.md)
- [Case C-507/17, Google LLC, successor in law to Google Inc. v Commission nationale de l'informatique et des libertés (CNIL)](https://dposchool.com/gdpr/case/c-507-17.md)
- [Case C-40/17, Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV](https://dposchool.com/gdpr/case/c-40-17.md)
- [Case C-25/17, Proceedings brought by Tietosuojavaltuutettu](https://dposchool.com/gdpr/case/c-25-17.md)
- [Case C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH](https://dposchool.com/gdpr/case/c-210-16.md)
- [Case C-582/14, Patrick Breyer v Bundesrepublik Deutschland](https://dposchool.com/gdpr/case/c-582-14.md)
- [Case C-362/14, Maximillian Schrems v Data Protection Commissioner](https://dposchool.com/gdpr/case/c-362-14.md)
- [Case C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González](https://dposchool.com/gdpr/case/c-131-12.md)
- [EDPB 04/2026: Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR](https://dposchool.com/gdpr/guidance/edpb-04-2026.md)
- [EDPB 03/2025: Guidelines 3/2025 on the interplay between the DSA and the GDPR](https://dposchool.com/gdpr/guidance/edpb-03-2025.md)
- [EDPB 03/2026: Guidelines 03/2026 on web scraping in the context of generative AI](https://dposchool.com/gdpr/guidance/edpb-03-2026.md)
- [EDPB 02/2026: Guidelines 02/2026 on anonymisation](https://dposchool.com/gdpr/guidance/edpb-02-2026.md)
- [EDPB 02/2025: Guidelines 02/2025 on processing of personal data through blockchain technologies](https://dposchool.com/gdpr/guidance/edpb-02-2025.md)
- [EDPB 01/2026: Guidelines 1/2026 on processing of personal data for scientific research purposes](https://dposchool.com/gdpr/guidance/edpb-01-2026.md)
- [EDPB Rec 01/2026: Recommendations 1/2026 on the application for approval and on the elements and principles to be found in Processor Binding Corporate Rules](https://dposchool.com/gdpr/guidance/edpb-rec-01-2026.md)
- [EDPB Rec 02/2025: Recommendations 2/2025 on the legal basis for requiring the creation of user accounts on e-commerce websites](https://dposchool.com/gdpr/guidance/edpb-rec-02-2025.md)
- [EDPB-COM DMA/GDPR: Joint Guidelines (European Commission and EDPB) on the interplay between the Digital Markets Act and the GDPR](https://dposchool.com/gdpr/guidance/edpb-com-dma-gdpr.md)
- [EDPB 02/2024: Guidelines 02/2024 on Article 48 GDPR](https://dposchool.com/gdpr/guidance/edpb-02-2024.md)
- [EDPB 01/2025: Guidelines 01/2025 on pseudonymisation](https://dposchool.com/gdpr/guidance/edpb-01-2025.md)
- [EDPB Opinion 28/2024: Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models](https://dposchool.com/gdpr/guidance/edpb-opinion-28-2024.md)
- [EDPB 02/2023: Guidelines 2/2023 on technical scope of Art. 5(3) of the ePrivacy Directive](https://dposchool.com/gdpr/guidance/edpb-02-2023.md)
- [EDPB 01/2024: Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR](https://dposchool.com/gdpr/guidance/edpb-01-2024.md)
- [EDPB Opinion 22/2024: Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)](https://dposchool.com/gdpr/guidance/edpb-opinion-22-2024.md)
- [EDPB 01/2023 (LED): Guidelines 01/2023 on Article 37 Law Enforcement Directive](https://dposchool.com/gdpr/guidance/edpb-01-2023-led.md)
- [EDPB Opinion 08/2024: Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms](https://dposchool.com/gdpr/guidance/edpb-opinion-08-2024.md)
- [EDPB Rec 01/2022: Recommendations 1/2022 on the application for approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)](https://dposchool.com/gdpr/guidance/edpb-rec-01-2022.md)
- [EDPB 04/2022: Guidelines 04/2022 on the calculation of administrative fines under the GDPR](https://dposchool.com/gdpr/guidance/edpb-04-2022.md)
- [EDPB 03/2021: Guidelines 03/2021 on the application of Article 65(1)(a) GDPR](https://dposchool.com/gdpr/guidance/edpb-03-2021.md)
- [EDPB 05/2022: Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement](https://dposchool.com/gdpr/guidance/edpb-05-2022.md)
- [EDPB 01/2022: Guidelines 01/2022 on data subject rights - Right of access](https://dposchool.com/gdpr/guidance/edpb-01-2022.md)
- [EDPB 08/2022: Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority](https://dposchool.com/gdpr/guidance/edpb-08-2022.md)
- [EDPB 09/2022: Guidelines 9/2022 on personal data breach notification under GDPR](https://dposchool.com/gdpr/guidance/edpb-09-2022.md)
- [EDPB 03/2022: Guidelines 03/2022 on deceptive design patterns in social media platform interfaces](https://dposchool.com/gdpr/guidance/edpb-03-2022.md)
- [EDPB 05/2021: Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR](https://dposchool.com/gdpr/guidance/edpb-05-2021.md)
- [EDPB 07/2022: Guidelines 07/2022 on certification as a tool for transfers](https://dposchool.com/gdpr/guidance/edpb-07-2022.md)
- [EDPB 06/2022: Guidelines 06/2022 on the practical implementation of amicable settlements](https://dposchool.com/gdpr/guidance/edpb-06-2022.md)
- [EDPB 02/2022: Guidelines 02/2022 on the application of Article 60 GDPR](https://dposchool.com/gdpr/guidance/edpb-02-2022.md)
- [EDPB 04/2021: Guidelines 04/2021 on codes of conduct as tools for transfers](https://dposchool.com/gdpr/guidance/edpb-04-2021.md)
- [EDPB 01/2021: Guidelines 01/2021 on examples regarding personal data breach notification](https://dposchool.com/gdpr/guidance/edpb-01-2021.md)
- [EDPB 10/2020: Guidelines 10/2020 on restrictions under Article 23 GDPR](https://dposchool.com/gdpr/guidance/edpb-10-2020.md)
- [EDPB 07/2020: Guidelines 07/2020 on the concepts of controller and processor in the GDPR](https://dposchool.com/gdpr/guidance/edpb-07-2020.md)
- [EDPB 02/2021: Guidelines 02/2021 on virtual voice assistants](https://dposchool.com/gdpr/guidance/edpb-02-2021.md)
- [EDPB Rec 01/2020: Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data](https://dposchool.com/gdpr/guidance/edpb-rec-01-2020.md)
- [EDPB Rec 02/2021: Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions](https://dposchool.com/gdpr/guidance/edpb-rec-02-2021.md)
- [EDPB 08/2020: Guidelines 8/2020 on the targeting of social media users](https://dposchool.com/gdpr/guidance/edpb-08-2020.md)
- [EDPB 09/2020: Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-09-2020.md)
- [EDPB 01/2020: Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications](https://dposchool.com/gdpr/guidance/edpb-01-2020.md)
- [EDPB 06/2020: Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR](https://dposchool.com/gdpr/guidance/edpb-06-2020.md)
- [EDPB 02/2020: Guidelines 2/2020 on articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies](https://dposchool.com/gdpr/guidance/edpb-02-2020.md)
- [EDPB Rec 02/2020: Recommendations 02/2020 on the European Essential Guarantees for surveillance measures](https://dposchool.com/gdpr/guidance/edpb-rec-02-2020.md)
- [EDPB 04/2019: Guidelines 4/2019 on Article 25 Data Protection by Design and by Default](https://dposchool.com/gdpr/guidance/edpb-04-2019.md)
- [EDPB 05/2019: Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)](https://dposchool.com/gdpr/guidance/edpb-05-2019.md)
- [EDPB 05/2020: Guidelines 05/2020 on consent under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-05-2020.md)
- [EDPB 03/2020: Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak](https://dposchool.com/gdpr/guidance/edpb-03-2020.md)
- [EDPB 04/2020: Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak](https://dposchool.com/gdpr/guidance/edpb-04-2020.md)
- [EDPB 03/2019: Guidelines 3/2019 on processing of personal data through video devices](https://dposchool.com/gdpr/guidance/edpb-03-2019.md)
- [EDPB 03/2018: Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)](https://dposchool.com/gdpr/guidance/edpb-03-2018.md)
- [EDPB 02/2019: Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects](https://dposchool.com/gdpr/guidance/edpb-02-2019.md)
- [EDPB 01/2018: Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43](https://dposchool.com/gdpr/guidance/edpb-01-2018.md)
- [EDPB 01/2019: Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-01-2019.md)
- [EDPB 04/2018: Guidelines 4/2018 on the accreditation of certification bodies under Article 43](https://dposchool.com/gdpr/guidance/edpb-04-2018.md)
- [EDPB 02/2018: Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-02-2018.md)
- [WP251 rev.01: Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp251-rev-01.md)
- [WP242 rev.01: Guidelines on the right to data portability](https://dposchool.com/gdpr/guidance/wp242-rev-01.md)
- [WP248 rev.01: Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is 'likely to result in a high risk'](https://dposchool.com/gdpr/guidance/wp248-rev-01.md)
- [WP243 rev.01: Guidelines on Data Protection Officers ('DPO')](https://dposchool.com/gdpr/guidance/wp243-rev-01.md)
- [WP253: Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp253.md)
- [WP254 rev.01: Adequacy Referential](https://dposchool.com/gdpr/guidance/wp254-rev-01.md)
- [WP257 rev.01: Working document setting up a table with the elements and principles to be found in Processor Binding Corporate Rules](https://dposchool.com/gdpr/guidance/wp257-rev-01.md)
- [WP265: Recommendation on the standard application form for approval of Processor Binding Corporate Rules](https://dposchool.com/gdpr/guidance/wp265.md)
- [WP29 Art. 30(5) position paper: Position paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR](https://dposchool.com/gdpr/guidance/wp29-art-30-5-position-paper.md)
- [WP259 rev.01: Guidelines on consent under Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp259-rev-01.md)
- [WP250 rev.01: Guidelines on personal data breach notification under Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp250-rev-01.md)
- [WP244 rev.01: Guidelines for identifying a controller or processor's lead supervisory authority](https://dposchool.com/gdpr/guidance/wp244-rev-01.md)
- [WP256 rev.01: Working document setting up a table with the elements and principles to be found in Binding Corporate Rules](https://dposchool.com/gdpr/guidance/wp256-rev-01.md)
- [WP264: Recommendation on the standard application for approval of Controller Binding Corporate Rules](https://dposchool.com/gdpr/guidance/wp264.md)
- [WP263 rev.01: Working document setting forth a co-operation procedure for the approval of BCRs](https://dposchool.com/gdpr/guidance/wp263-rev-01.md)
- [WP260 rev.01: Guidelines on transparency under Regulation 2016/679](https://dposchool.com/gdpr/guidance/wp260-rev-01.md)
- [Xandr Inc.: NOK 92,000,000](https://dposchool.com/gdpr/fine/dt-xandr-2026-10.md)
- [IQVIA Solutions Italy S.r.l: EUR 7,000,000](https://dposchool.com/gdpr/fine/garante-iqvia-2026-09.md)
- [Google Ireland Limited: EUR 403,000,000](https://dposchool.com/gdpr/fine/dpc-google-2026-09.md)
- [Uber: EUR 824,990,000](https://dposchool.com/gdpr/fine/ap-uber-2026-08.md)
- [FRANCE TRAVAIL: EUR 5,000,000](https://dposchool.com/gdpr/fine/cnil-france-travail-2026-01.md)
- [FREE MOBILE: EUR 27,000,000](https://dposchool.com/gdpr/fine/cnil-free-mobile-2026-01.md)
- [Experian Nederland B.V.: EUR 2,700,000](https://dposchool.com/gdpr/fine/ap-experian-2025-10.md)
- [McDonald’s Polska Sp. z o.o.: PLN 16,932,657](https://dposchool.com/gdpr/fine/uodo-mcdonalds-2025-07.md)
- [TikTok Technology Limited: EUR 530,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2025-04.md)
- [Luka Inc.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-luka-replika-2025-04.md)
- [Vodafone GmbH: EUR 45,000,000](https://dposchool.com/gdpr/fine/bfdi-vodafone-2025-03.md)
- [Meta Platforms Ireland Limited: EUR 251,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2024-12.md)
- [Netflix International B.V.: EUR 4,750,000](https://dposchool.com/gdpr/fine/ap-netflix-2024-11.md)
- [Posti: EUR 2,400,000](https://dposchool.com/gdpr/fine/fi-posti-2024-11.md)
- [Foodinho s.r.l.: EUR 5,000,000](https://dposchool.com/gdpr/fine/garante-foodinho-2024-11.md)
- [OpenAI: EUR 15,000,000](https://dposchool.com/gdpr/fine/garante-openai-2024-11.md)
- [LinkedIn Ireland Unlimited Company: EUR 310,000,000](https://dposchool.com/gdpr/fine/dpc-linkedin-2024-10.md)
- [Meta Platforms Ireland Limited: EUR 91,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2024-09.md)
- [Apoteket AB: SEK 37,000,000](https://dposchool.com/gdpr/fine/imy-apoteket-2024-08.md)
- [Uber Technologies Inc. en Uber B.V.: EUR 290,000,000](https://dposchool.com/gdpr/fine/ap-uber-2024-07.md)
- [Clearview AI Inc.: EUR 30,500,000](https://dposchool.com/gdpr/fine/ap-clearview-2024-05.md)
- [Avast Software s.r.o.: CZK 351,000,000](https://dposchool.com/gdpr/fine/uoou-avast-2024-04.md)
- [Enel Energia S.p.A.: EUR 79,107,101](https://dposchool.com/gdpr/fine/garante-enel-energia-2024-02.md)
- [Amazon France Logistique: EUR 32,000,000](https://dposchool.com/gdpr/fine/cnil-amazon-france-logistique-2023-12.md)
- [Uber Technologies Inc. en Uber B.V.: EUR 10,000,000](https://dposchool.com/gdpr/fine/ap-uber-2023-12.md)
- [EOS Matrix d.o.o.: EUR 5,470,000](https://dposchool.com/gdpr/fine/azop-eos-matrix-2023-10.md)
- [TikTok Technology Limited: EUR 345,000,000](https://dposchool.com/gdpr/fine/dpc-tiktok-2023-09.md)
- [CRITEO: EUR 40,000,000](https://dposchool.com/gdpr/fine/cnil-criteo-2023-06.md)
- [Spotify AB: SEK 58,000,000](https://dposchool.com/gdpr/fine/imy-spotify-2023-06.md)
- [Meta Platforms Ireland Limited: EUR 1,200,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2023-05.md)
- [Meta Platforms Ireland Limited: EUR 210,000,000](https://dposchool.com/gdpr/fine/dpc-meta-facebook-2022-12.md)
- [Meta Platforms Ireland Limited: EUR 180,000,000](https://dposchool.com/gdpr/fine/dpc-meta-instagram-2022-12.md)
- [Meta Platforms Ireland Limited: EUR 265,000,000](https://dposchool.com/gdpr/fine/dpc-meta-2022-11.md)
- [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/cnil-clearview-2022-10.md)
- [Meta Platforms Ireland Limited: EUR 405,000,000](https://dposchool.com/gdpr/fine/dpc-instagram-2022-09.md)
- [Clearview AI, Inc: EUR 20,000,000](https://dposchool.com/gdpr/fine/hdpa-clearview-2022-07.md)
- [Google LLC: EUR 10,000,000](https://dposchool.com/gdpr/fine/aepd-google-2022-05.md)
- [Minister van Financiën (controller for the Belastingdienst, Dutch Tax Administration): EUR 3,700,000](https://dposchool.com/gdpr/fine/ap-belastingdienst-2022-04.md)
- [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/garante-clearview-2022-02.md)
- [IAB Europe: EUR 250,000](https://dposchool.com/gdpr/fine/apd-iab-europe-2022-02.md)
- [Grindr LLC: NOK 65,000,000](https://dposchool.com/gdpr/fine/dt-grindr-2021-12.md)
- [WhatsApp Ireland Ltd: EUR 225,000,000](https://dposchool.com/gdpr/fine/dpc-whatsapp-2021-08.md)
- [Deliveroo Italy s.r.l.: EUR 2,500,000](https://dposchool.com/gdpr/fine/garante-deliveroo-2021-07.md)
- [Amazon Europe Core S.à r.l.: EUR 746,000,000](https://dposchool.com/gdpr/fine/cnpd-amazon-2021-07.md)
- [VODAFONE ESPAÑA, S.A.U.: EUR 6,000,000](https://dposchool.com/gdpr/fine/aepd-vodafone-espana-2021-02.md)
- [notebooksbilliger.de AG: EUR 10,400,000](https://dposchool.com/gdpr/fine/lfd-ni-notebooksbilliger-2021-01.md)
- [CAIXABANK, S.A.: EUR 6,000,000](https://dposchool.com/gdpr/fine/aepd-caixabank-2021-01.md)
- [Booking.com B.V.: EUR 475,000](https://dposchool.com/gdpr/fine/ap-booking-2020-12.md)
- [Twitter International Company: USD 500,000](https://dposchool.com/gdpr/fine/dpc-twitter-2020-12.md)
- [Carrefour France: EUR 2,250,000](https://dposchool.com/gdpr/fine/cnil-carrefour-france-2020-11.md)
- [Marriott International Inc: GBP 18,400,000](https://dposchool.com/gdpr/fine/ico-marriott-2020-10.md)
- [British Airways plc: GBP 20,000,000](https://dposchool.com/gdpr/fine/ico-ba-2020-10.md)
- [H&M Hennes & Mauritz Online Shop A.B. & Co. KG: EUR 35,258,707.95](https://dposchool.com/gdpr/fine/hmbbfdi-hm-2020-10.md)
- [Google LLC: SEK 75,000,000](https://dposchool.com/gdpr/fine/imy-google-2020-03.md)
- [TIM S.p.A.: EUR 27,802,946](https://dposchool.com/gdpr/fine/garante-tim-2020-01.md)
- [1&1 Telecom GmbH: EUR 9,550,000](https://dposchool.com/gdpr/fine/bfdi-1und1-2019-12.md)
- [Deutsche Wohnen SE: EUR 14,500,000](https://dposchool.com/gdpr/fine/blnbdi-deutsche-wohnen-2019-10.md)
- [Post AG: EUR 18,000,000](https://dposchool.com/gdpr/fine/dsb-post-2019-10.md)
- [Google LLC: EUR 50,000,000](https://dposchool.com/gdpr/fine/cnil-google-2019-01.md)
- [Knuddels: EUR 20,000](https://dposchool.com/gdpr/fine/lfdi-bw-knuddels-2018-11.md)