---
title: "GDPR recitals 1 to 173"
canonical: "https://dposchool.com/gdpr/recitals"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
language: "en"
publisher: "DPO School"
---

# GDPR recitals

The recitals of Regulation (EU) 2016/679 set out the reasons for its articles. Text as of 28 October 2026.

- [Recital 1](https://dposchool.com/gdpr/recital/1): The protection of natural persons in relation to the processing of personal data is a fundamental right.
- [Recital 2](https://dposchool.com/gdpr/recital/2): The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental…
- [Recital 3](https://dposchool.com/gdpr/recital/3): Directive 95/46/EC of the European Parliament and of the Council (4) seeks to harmonise the protection of fundamental rights and freedoms of natural persons in respect of processing activities and…
- [Recital 4](https://dposchool.com/gdpr/recital/4): The processing of personal data should be designed to serve mankind.
- [Recital 5](https://dposchool.com/gdpr/recital/5): The economic and social integration resulting from the functioning of the internal market has led to a substantial increase in cross-border flows of personal data.
- [Recital 6](https://dposchool.com/gdpr/recital/6): Rapid technological developments and globalisation have brought new challenges for the protection of personal data.
- [Recital 7](https://dposchool.com/gdpr/recital/7): Those developments require a strong and more coherent data protection framework in the Union, backed by strong enforcement, given the importance of creating the trust that will allow the digital…
- [Recital 8](https://dposchool.com/gdpr/recital/8): Where this Regulation provides for specifications or restrictions of its rules by Member State law, Member States may, as far as necessary for coherence and for making the national provisions…
- [Recital 9](https://dposchool.com/gdpr/recital/9): The objectives and principles of Directive 95/46/EC remain sound, but it has not prevented fragmentation in the implementation of data protection across the Union, legal uncertainty or a widespread…
- [Recital 10](https://dposchool.com/gdpr/recital/10): In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and…
- [Recital 11](https://dposchool.com/gdpr/recital/11): Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine…
- [Recital 12](https://dposchool.com/gdpr/recital/12): Article 16(2) TFEU mandates the European Parliament and the Council to lay down the rules relating to the protection of natural persons with regard to the processing of personal data and the rules…
- [Recital 13](https://dposchool.com/gdpr/recital/13): In order to ensure a consistent level of protection for natural persons throughout the Union and to prevent divergences hampering the free movement of personal data within the internal market, a…
- [Recital 14](https://dposchool.com/gdpr/recital/14): The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data.
- [Recital 15](https://dposchool.com/gdpr/recital/15): In order to prevent creating a serious risk of circumvention, the protection of natural persons should be technologically neutral and should not depend on the techniques used.
- [Recital 16](https://dposchool.com/gdpr/recital/16): This Regulation does not apply to issues of protection of fundamental rights and freedoms or the free flow of personal data related to activities which fall outside the scope of Union law, such as…
- [Recital 17](https://dposchool.com/gdpr/recital/17): Regulation (EC) No 45/2001 of the European Parliament and of the Council (6) applies to the processing of personal data by the Union institutions, bodies, offices and agencies.
- [Recital 18](https://dposchool.com/gdpr/recital/18): This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or…
- [Recital 19](https://dposchool.com/gdpr/recital/19): The protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal…
- [Recital 20](https://dposchool.com/gdpr/recital/20): While this Regulation applies, inter alia, to the activities of courts and other judicial authorities, Union or Member State law could specify the processing operations and processing procedures in…
- [Recital 21](https://dposchool.com/gdpr/recital/21): This Regulation is without prejudice to the application of Directive 2000/31/EC of the European Parliament and of the Council (8), in particular of the liability rules of intermediary service…
- [Recital 22](https://dposchool.com/gdpr/recital/22): Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless…
- [Recital 23](https://dposchool.com/gdpr/recital/23): In order to ensure that natural persons are not deprived of the protection to which they are entitled under this Regulation, the processing of personal data of data subjects who are in the Union by…
- [Recital 24](https://dposchool.com/gdpr/recital/24): The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the…
- [Recital 25](https://dposchool.com/gdpr/recital/25): Where Member State law applies by virtue of public international law, this Regulation should also apply to a controller not established in the Union, such as in a Member State's diplomatic mission…
- [Recital 26](https://dposchool.com/gdpr/recital/26): The principles of data protection should apply to any information concerning an identified or identifiable natural person.
- [Recital 27](https://dposchool.com/gdpr/recital/27): This Regulation does not apply to the personal data of deceased persons.
- [Recital 28](https://dposchool.com/gdpr/recital/28): The application of pseudonymisation to personal data can reduce the risks to the data subjects concerned and help controllers and processors to meet their data-protection obligations.
- [Recital 29](https://dposchool.com/gdpr/recital/29): In order to create incentives to apply pseudonymisation when processing personal data, measures of pseudonymisation should, whilst allowing general analysis, be possible within the same controller…
- [Recital 30](https://dposchool.com/gdpr/recital/30): Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers…
- [Recital 31](https://dposchool.com/gdpr/recital/31): Public authorities to which personal data are disclosed in accordance with a legal obligation for the exercise of their official mission, such as tax and customs authorities, financial investigation…
- [Recital 32](https://dposchool.com/gdpr/recital/32): Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data…
- [Recital 33](https://dposchool.com/gdpr/recital/33): It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection.
- [Recital 34](https://dposchool.com/gdpr/recital/34): Genetic data should be defined as personal data relating to the inherited or acquired genetic characteristics of a natural person which result from the analysis of a biological sample from the…
- [Recital 35](https://dposchool.com/gdpr/recital/35): Personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health…
- [Recital 36](https://dposchool.com/gdpr/recital/36): The main establishment of a controller in the Union should be the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data…
- [Recital 37](https://dposchool.com/gdpr/recital/37): A group of undertakings should cover a controlling undertaking and its controlled undertakings, whereby the controlling undertaking should be the undertaking which can exert a dominant influence…
- [Recital 38](https://dposchool.com/gdpr/recital/38): Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of…
- [Recital 39](https://dposchool.com/gdpr/recital/39): Any processing of personal data should be lawful and fair.
- [Recital 40](https://dposchool.com/gdpr/recital/40): In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this…
- [Recital 41](https://dposchool.com/gdpr/recital/41): Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament, without prejudice to requirements pursuant to the…
- [Recital 42](https://dposchool.com/gdpr/recital/42): Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation.
- [Recital 43](https://dposchool.com/gdpr/recital/43): In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the…
- [Recital 44](https://dposchool.com/gdpr/recital/44): Processing should be lawful where it is necessary in the context of a contract or the intention to enter into a contract.
- [Recital 45](https://dposchool.com/gdpr/recital/45): Where processing is carried out in accordance with a legal obligation to which the controller is subject or where processing is necessary for the performance of a task carried out in the public…
- [Recital 46](https://dposchool.com/gdpr/recital/46): The processing of personal data should also be regarded to be lawful where it is necessary to protect an interest which is essential for the life of the data subject or that of another natural person.
- [Recital 47](https://dposchool.com/gdpr/recital/47): The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that…
- [Recital 48](https://dposchool.com/gdpr/recital/48): Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for…
- [Recital 49](https://dposchool.com/gdpr/recital/49): The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information…
- [Recital 50](https://dposchool.com/gdpr/recital/50): The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for…
- [Recital 51](https://dposchool.com/gdpr/recital/51): Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant…
- [Recital 52](https://dposchool.com/gdpr/recital/52): Derogating from the prohibition on processing special categories of personal data should also be allowed when provided for in Union or Member State law and subject to suitable safeguards, so as to…
- [Recital 53](https://dposchool.com/gdpr/recital/53): Special categories of personal data which merit higher protection should be processed for health-related purposes only where necessary to achieve those purposes for the benefit of natural persons…
- [Recital 54](https://dposchool.com/gdpr/recital/54): The processing of special categories of personal data may be necessary for reasons of public interest in the areas of public health without consent of the data subject.
- [Recital 55](https://dposchool.com/gdpr/recital/55): Moreover, the processing of personal data by official authorities for the purpose of achieving the aims, laid down by constitutional law or by international public law, of officially recognised…
- [Recital 56](https://dposchool.com/gdpr/recital/56): Where in the course of electoral activities, the operation of the democratic system in a Member State requires that political parties compile personal data on people's political opinions, the…
- [Recital 57](https://dposchool.com/gdpr/recital/57): If the personal data processed by a controller do not permit the controller to identify a natural person, the data controller should not be obliged to acquire additional information in order to…
- [Recital 58](https://dposchool.com/gdpr/recital/58): The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language…
- [Recital 59](https://dposchool.com/gdpr/recital/59): Modalities should be provided for facilitating the exercise of the data subject's rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in…
- [Recital 60](https://dposchool.com/gdpr/recital/60): The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes.
- [Recital 61](https://dposchool.com/gdpr/recital/61): The information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection from the data subject, or, where the personal data…
- [Recital 62](https://dposchool.com/gdpr/recital/62): However, it is not necessary to impose the obligation to provide information where the data subject already possesses the information, where the recording or disclosure of the personal data is…
- [Recital 63](https://dposchool.com/gdpr/recital/63): A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware…
- [Recital 64](https://dposchool.com/gdpr/recital/64): The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers.
- [Recital 65](https://dposchool.com/gdpr/recital/65): A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member…
- [Recital 66](https://dposchool.com/gdpr/recital/66): To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be…
- [Recital 67](https://dposchool.com/gdpr/recital/67): Methods by which to restrict the processing of personal data could include, inter alia, temporarily moving the selected data to another processing system, making the selected personal data…
- [Recital 68](https://dposchool.com/gdpr/recital/68): To further strengthen the control over his or her own data, where the processing of personal data is carried out by automated means, the data subject should also be allowed to receive personal data…
- [Recital 69](https://dposchool.com/gdpr/recital/69): Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in…
- [Recital 70](https://dposchool.com/gdpr/recital/70): Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to…
- [Recital 71](https://dposchool.com/gdpr/recital/71): The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing…
- [Recital 72](https://dposchool.com/gdpr/recital/72): Profiling is subject to the rules of this Regulation governing the processing of personal data, such as the legal grounds for processing or data protection principles.
- [Recital 73](https://dposchool.com/gdpr/recital/73): Restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal data, the right to data portability, the right to object, decisions…
- [Recital 74](https://dposchool.com/gdpr/recital/74): The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller's behalf should be established.
- [Recital 75](https://dposchool.com/gdpr/recital/75): The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in…
- [Recital 76](https://dposchool.com/gdpr/recital/76): The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope, context and purposes of the processing.
- [Recital 77](https://dposchool.com/gdpr/recital/77): Guidance on the implementation of appropriate measures and on the demonstration of compliance by the controller or the processor, especially as regards the identification of the risk related to the…
- [Recital 78](https://dposchool.com/gdpr/recital/78): The protection of the rights and freedoms of natural persons with regard to the processing of personal data require that appropriate technical and organisational measures be taken to ensure that the…
- [Recital 79](https://dposchool.com/gdpr/recital/79): The protection of the rights and freedoms of data subjects as well as the responsibility and liability of controllers and processors, also in relation to the monitoring by and measures of…
- [Recital 80](https://dposchool.com/gdpr/recital/80): Where a controller or a processor not established in the Union is processing personal data of data subjects who are in the Union whose processing activities are related to the offering of goods or…
- [Recital 81](https://dposchool.com/gdpr/recital/81): To ensure compliance with the requirements of this Regulation in respect of the processing to be carried out by the processor on behalf of the controller, when entrusting a processor with processing…
- [Recital 82](https://dposchool.com/gdpr/recital/82): In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility.
- [Recital 83](https://dposchool.com/gdpr/recital/83): In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing and implement measures to…
- [Recital 84](https://dposchool.com/gdpr/recital/84): In order to enhance compliance with this Regulation where processing operations are likely to result in a high risk to the rights and freedoms of natural persons, the controller should be…
- [Recital 85](https://dposchool.com/gdpr/recital/85): A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal…
- [Recital 86](https://dposchool.com/gdpr/recital/86): The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of…
- [Recital 87](https://dposchool.com/gdpr/recital/87): It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately whether a personal data breach has taken place…
- [Recital 88](https://dposchool.com/gdpr/recital/88): In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach…
- [Recital 89](https://dposchool.com/gdpr/recital/89): Directive 95/46/EC provided for a general obligation to notify the processing of personal data to the supervisory authorities.
- [Recital 90](https://dposchool.com/gdpr/recital/90): In such cases, a data protection impact assessment should be carried out by the controller prior to the processing in order to assess the particular likelihood and severity of the high risk, taking…
- [Recital 91](https://dposchool.com/gdpr/recital/91): This should in particular apply to large-scale processing operations which aim to process a considerable amount of personal data at regional, national or supranational level and which could affect a…
- [Recital 92](https://dposchool.com/gdpr/recital/92): There are circumstances under which it may be reasonable and economical for the subject of a data protection impact assessment to be broader than a single project, for example where public…
- [Recital 93](https://dposchool.com/gdpr/recital/93): In the context of the adoption of the Member State law on which the performance of the tasks of the public authority or public body is based and which regulates the specific processing operation or…
- [Recital 94](https://dposchool.com/gdpr/recital/94): Where a data protection impact assessment indicates that the processing would, in the absence of safeguards, security measures and mechanisms to mitigate the risk, result in a high risk to the…
- [Recital 95](https://dposchool.com/gdpr/recital/95): The processor should assist the controller, where necessary and upon request, in ensuring compliance with the obligations deriving from the carrying out of data protection impact assessments and…
- [Recital 96](https://dposchool.com/gdpr/recital/96): A consultation of the supervisory authority should also take place in the course of the preparation of a legislative or regulatory measure which provides for the processing of personal data, in…
- [Recital 97](https://dposchool.com/gdpr/recital/97): Where the processing is carried out by a public authority, except for courts or independent judicial authorities when acting in their judicial capacity, where, in the private sector, processing is…
- [Recital 98](https://dposchool.com/gdpr/recital/98): Associations or other bodies representing categories of controllers or processors should be encouraged to draw up codes of conduct, within the limits of this Regulation, so as to facilitate the…
- [Recital 99](https://dposchool.com/gdpr/recital/99): When drawing up a code of conduct, or when amending or extending such a code, associations and other bodies representing categories of controllers or processors should consult relevant stakeholders…
- [Recital 100](https://dposchool.com/gdpr/recital/100): In order to enhance transparency and compliance with this Regulation, the establishment of certification mechanisms and data protection seals and marks should be encouraged, allowing data subjects…
- [Recital 101](https://dposchool.com/gdpr/recital/101): Flows of personal data to and from countries outside the Union and international organisations are necessary for the expansion of international trade and international cooperation.
- [Recital 102](https://dposchool.com/gdpr/recital/102): This Regulation is without prejudice to international agreements concluded between the Union and third countries regulating the transfer of personal data including appropriate safeguards for the…
- [Recital 103](https://dposchool.com/gdpr/recital/103): The Commission may decide with effect for the entire Union that a third country, a territory or specified sector within a third country, or an international organisation, offers an adequate level of…
- [Recital 104](https://dposchool.com/gdpr/recital/104): In line with the fundamental values on which the Union is founded, in particular the protection of human rights, the Commission should, in its assessment of the third country, or of a territory or…
- [Recital 105](https://dposchool.com/gdpr/recital/105): Apart from the international commitments the third country or international organisation has entered into, the Commission should take account of obligations arising from the third country's or…
- [Recital 106](https://dposchool.com/gdpr/recital/106): The Commission should monitor the functioning of decisions on the level of protection in a third country, a territory or specified sector within a third country, or an international organisation…
- [Recital 107](https://dposchool.com/gdpr/recital/107): The Commission may recognise that a third country, a territory or a specified sector within a third country, or an international organisation no longer ensures an adequate level of data protection.
- [Recital 108](https://dposchool.com/gdpr/recital/108): In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the…
- [Recital 109](https://dposchool.com/gdpr/recital/109): The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by a supervisory authority should prevent controllers or processors neither from…
- [Recital 110](https://dposchool.com/gdpr/recital/110): A group of undertakings, or a group of enterprises engaged in a joint economic activity, should be able to make use of approved binding corporate rules for its international transfers from the Union…
- [Recital 111](https://dposchool.com/gdpr/recital/111): Provisions should be made for the possibility for transfers in certain circumstances where the data subject has given his or her explicit consent, where the transfer is occasional and necessary in…
- [Recital 112](https://dposchool.com/gdpr/recital/112): Those derogations should in particular apply to data transfers required and necessary for important reasons of public interest, for example in cases of international data exchange between…
- [Recital 113](https://dposchool.com/gdpr/recital/113): Transfers which can be qualified as not repetitive and that only concern a limited number of data subjects, could also be possible for the purposes of the compelling legitimate interests pursued by…
- [Recital 114](https://dposchool.com/gdpr/recital/114): In any case, where the Commission has taken no decision on the adequate level of data protection in a third country, the controller or processor should make use of solutions that provide data…
- [Recital 115](https://dposchool.com/gdpr/recital/115): Some third countries adopt laws, regulations and other legal acts which purport to directly regulate the processing activities of natural and legal persons under the jurisdiction of the Member States.
- [Recital 116](https://dposchool.com/gdpr/recital/116): When personal data moves across borders outside the Union it may put at increased risk the ability of natural persons to exercise data protection rights in particular to protect themselves from the…
- [Recital 117](https://dposchool.com/gdpr/recital/117): The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of…
- [Recital 118](https://dposchool.com/gdpr/recital/118): The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to…
- [Recital 119](https://dposchool.com/gdpr/recital/119): Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency…
- [Recital 120](https://dposchool.com/gdpr/recital/120): Each supervisory authority should be provided with the financial and human resources, premises and infrastructure necessary for the effective performance of their tasks, including those related to…
- [Recital 121](https://dposchool.com/gdpr/recital/121): The general conditions for the member or members of the supervisory authority should be laid down by law in each Member State and should in particular provide that those members are to be appointed…
- [Recital 122](https://dposchool.com/gdpr/recital/122): Each supervisory authority should be competent on the territory of its own Member State to exercise the powers and to perform the tasks conferred on it in accordance with this Regulation.
- [Recital 123](https://dposchool.com/gdpr/recital/123): The supervisory authorities should monitor the application of the provisions pursuant to this Regulation and contribute to its consistent application throughout the Union, in order to protect…
- [Recital 124](https://dposchool.com/gdpr/recital/124): Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union and the controller or processor is established in…
- [Recital 125](https://dposchool.com/gdpr/recital/125): The lead authority should be competent to adopt binding decisions regarding measures applying the powers conferred on it in accordance with this Regulation.
- [Recital 126](https://dposchool.com/gdpr/recital/126): The decision should be agreed jointly by the lead supervisory authority and the supervisory authorities concerned and should be directed towards the main or single establishment of the controller or…
- [Recital 127](https://dposchool.com/gdpr/recital/127): Each supervisory authority not acting as the lead supervisory authority should be competent to handle local cases where the controller or processor is established in more than one Member State, but…
- [Recital 128](https://dposchool.com/gdpr/recital/128): The rules on the lead supervisory authority and the one-stop-shop mechanism should not apply where the processing is carried out by public authorities or private bodies in the public interest.
- [Recital 129](https://dposchool.com/gdpr/recital/129): In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the supervisory authorities should have in each Member State the same tasks and effective powers…
- [Recital 130](https://dposchool.com/gdpr/recital/130): Where the supervisory authority with which the complaint has been lodged is not the lead supervisory authority, the lead supervisory authority should closely cooperate with the supervisory authority…
- [Recital 131](https://dposchool.com/gdpr/recital/131): Where another supervisory authority should act as a lead supervisory authority for the processing activities of the controller or processor but the concrete subject matter of a complaint or the…
- [Recital 132](https://dposchool.com/gdpr/recital/132): Awareness-raising activities by supervisory authorities addressed to the public should include specific measures directed at controllers and processors, including micro, small and medium-sized…
- [Recital 133](https://dposchool.com/gdpr/recital/133): The supervisory authorities should assist each other in performing their tasks and provide mutual assistance, so as to ensure the consistent application and enforcement of this Regulation in the…
- [Recital 134](https://dposchool.com/gdpr/recital/134): Each supervisory authority should, where appropriate, participate in joint operations with other supervisory authorities.
- [Recital 135](https://dposchool.com/gdpr/recital/135): In order to ensure the consistent application of this Regulation throughout the Union, a consistency mechanism for cooperation between the supervisory authorities should be established.
- [Recital 136](https://dposchool.com/gdpr/recital/136): In applying the consistency mechanism, the Board should, within a determined period of time, issue an opinion, if a majority of its members so decides or if so requested by any supervisory authority…
- [Recital 137](https://dposchool.com/gdpr/recital/137): There may be an urgent need to act in order to protect the rights and freedoms of data subjects, in particular when the danger exists that the enforcement of a right of a data subject could be…
- [Recital 138](https://dposchool.com/gdpr/recital/138): The application of such mechanism should be a condition for the lawfulness of a measure intended to produce legal effects by a supervisory authority in those cases where its application is mandatory.
- [Recital 139](https://dposchool.com/gdpr/recital/139): In order to promote the consistent application of this Regulation, the Board should be set up as an independent body of the Union.
- [Recital 140](https://dposchool.com/gdpr/recital/140): The Board should be assisted by a secretariat provided by the European Data Protection Supervisor.
- [Recital 141](https://dposchool.com/gdpr/recital/141): Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective…
- [Recital 142](https://dposchool.com/gdpr/recital/142): Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is…
- [Recital 143](https://dposchool.com/gdpr/recital/143): Any natural or legal person has the right to bring an action for annulment of decisions of the Board before the Court of Justice under the conditions provided for in Article 263 TFEU.
- [Recital 144](https://dposchool.com/gdpr/recital/144): Where a court seized of proceedings against a decision by a supervisory authority has reason to believe that proceedings concerning the same processing, such as the same subject matter as regards…
- [Recital 145](https://dposchool.com/gdpr/recital/145): For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an…
- [Recital 146](https://dposchool.com/gdpr/recital/146): The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation.
- [Recital 147](https://dposchool.com/gdpr/recital/147): Where specific rules on jurisdiction are contained in this Regulation, in particular as regards proceedings seeking a judicial remedy including compensation, against a controller or processor…
- [Recital 148](https://dposchool.com/gdpr/recital/148): In order to strengthen the enforcement of the rules of this Regulation, penalties including administrative fines should be imposed for any infringement of this Regulation, in addition to, or instead…
- [Recital 149](https://dposchool.com/gdpr/recital/149): Member States should be able to lay down the rules on criminal penalties for infringements of this Regulation, including for infringements of national rules adopted pursuant to and within the limits…
- [Recital 150](https://dposchool.com/gdpr/recital/150): In order to strengthen and harmonise administrative penalties for infringements of this Regulation, each supervisory authority should have the power to impose administrative fines.
- [Recital 151](https://dposchool.com/gdpr/recital/151): The legal systems of Denmark and Estonia do not allow for administrative fines as set out in this Regulation.
- [Recital 152](https://dposchool.com/gdpr/recital/152): Where this Regulation does not harmonise administrative penalties or where necessary in other cases, for example in cases of serious infringements of this Regulation, Member States should implement…
- [Recital 153](https://dposchool.com/gdpr/recital/153): Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection…
- [Recital 154](https://dposchool.com/gdpr/recital/154): This Regulation allows the principle of public access to official documents to be taken into account when applying this Regulation.
- [Recital 155](https://dposchool.com/gdpr/recital/155): Member State law or collective agreements, including ‘works agreements’, may provide for specific rules on the processing of employees' personal data in the employment context, in particular for the…
- [Recital 156](https://dposchool.com/gdpr/recital/156): The processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be subject to appropriate safeguards for the…
- [Recital 157](https://dposchool.com/gdpr/recital/157): By coupling information from registries, researchers can obtain new knowledge of great value with regard to widespread medical conditions such as cardiovascular disease, cancer and depression.
- [Recital 158](https://dposchool.com/gdpr/recital/158): Where personal data are processed for archiving purposes, this Regulation should also apply to that processing, bearing in mind that this Regulation should not apply to deceased persons.
- [Recital 159](https://dposchool.com/gdpr/recital/159): Where personal data are processed for scientific research purposes, this Regulation should also apply to that processing.
- [Recital 160](https://dposchool.com/gdpr/recital/160): Where personal data are processed for historical research purposes, this Regulation should also apply to that processing.
- [Recital 161](https://dposchool.com/gdpr/recital/161): For the purpose of consenting to the participation in scientific research activities in clinical trials, the relevant provisions of Regulation (EU) No 536/2014 of the European Parliament and of the…
- [Recital 162](https://dposchool.com/gdpr/recital/162): Where personal data are processed for statistical purposes, this Regulation should apply to that processing.
- [Recital 163](https://dposchool.com/gdpr/recital/163): The confidential information which the Union and national statistical authorities collect for the production of official European and official national statistics should be protected.
- [Recital 164](https://dposchool.com/gdpr/recital/164): As regards the powers of the supervisory authorities to obtain from the controller or processor access to personal data and access to their premises, Member States may adopt by law, within the…
- [Recital 165](https://dposchool.com/gdpr/recital/165): This Regulation respects and does not prejudice the status under existing constitutional law of churches and religious associations or communities in the Member States, as recognised in Article 17…
- [Recital 166](https://dposchool.com/gdpr/recital/166): In order to fulfil the objectives of this Regulation, namely to protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data and to…
- [Recital 167](https://dposchool.com/gdpr/recital/167): In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission when provided for by this Regulation.
- [Recital 168](https://dposchool.com/gdpr/recital/168): The examination procedure should be used for the adoption of implementing acts on standard contractual clauses between controllers and processors and between processors; codes of conduct; technical…
- [Recital 169](https://dposchool.com/gdpr/recital/169): The Commission should adopt immediately applicable implementing acts where available evidence reveals that a third country, a territory or a specified sector within that third country, or an…
- [Recital 170](https://dposchool.com/gdpr/recital/170): Since the objective of this Regulation, namely to ensure an equivalent level of protection of natural persons and the free flow of personal data throughout the Union, cannot be sufficiently achieved…
- [Recital 171](https://dposchool.com/gdpr/recital/171): Directive 95/46/EC should be repealed by this Regulation.
- [Recital 172](https://dposchool.com/gdpr/recital/172): The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 and delivered an opinion on 7 March 2012 (17).
- [Recital 173](https://dposchool.com/gdpr/recital/173): This Regulation should apply to all matters concerning the protection of fundamental rights and freedoms vis-à-vis the processing of personal data which are not subject to specific obligations with…

This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / Recitals

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents