European Privacy Laws: GDPR, ePrivacy, and the AI Act

European privacy law rests on three instruments working together: the General Data Protection Regulation (GDPR), the ePrivacy Directive, and, since 2025, the EU AI Act. The GDPR carries fines up to €20 million or 4 percent of a company’s global annual turnover and reaches any organization worldwide that handles the personal data of people in Europe.¹ These laws trace back to Article 8 of the European Convention on Human Rights, which frames privacy as a fundamental right tied to human dignity rather than something to be bargained away.²

Who Has to Comply

Regulation (EU) 2016/679, the GDPR, applies to every organization that processes the personal data of people located in the European Economic Area, no matter where the organization itself sits. A U.S. company with no European office still falls under the regulation if it offers goods or services to European residents or tracks their online behavior.³ “Offering goods or services” is read broadly and does not require that money change hands.

Personal data means any information that can identify a person directly or indirectly. Names and government ID numbers are the obvious cases, but the definition also covers location data, IP addresses, and factors tied to physical, genetic, economic, or cultural identity.⁴ If a piece of data could single out one human being, alone or combined with other information, the GDPR treats it as personal data.

The regulation splits responsibility between two roles. A data controller decides why and how personal data gets processed. A data processor handles data on behalf of a controller, following the controller’s written instructions. Both carry legal obligations, but the controller bears primary responsibility. An e-commerce platform deciding what customer data to collect is a controller; the cloud hosting company storing that data is a processor.

Non-EU organizations subject to the GDPR must appoint a representative physically located in a member state where the affected individuals are based.⁵ That representative acts as a local contact point for data protection authorities and individuals. The only exceptions are organizations whose processing is occasional, small-scale, and unlikely to pose a risk to people’s rights.

When Processing Is Lawful

You cannot collect or use someone’s personal data simply because you want to. The GDPR requires organizations to identify one of six specific legal bases before any processing begins.⁶

Consent, given as a clear, affirmative agreement to a specific use. Pre-checked boxes and buried fine print do not count, and withdrawing consent must be as easy as giving it.
Contract, when processing is necessary to fulfill an agreement with the individual, such as needing a shipping address to deliver a purchase.
Legal obligation, when another law compels the processing, such as tax reporting or anti-money laundering rules.
Vital interests, when processing is needed to protect someone’s life, typically in a medical emergency where the person cannot consent.
Public task, when a government body or authorized organization needs the data to carry out an official function.
Legitimate interests, when the organization has a genuine business reason that does not override the individual’s rights.

Legitimate interests is the most flexible basis, which makes it the most scrutinized. Organizations relying on it must conduct and document a balancing test that weighs their business purpose against the potential impact on the individual. Fraud prevention tends to pass. Selling user data to advertisers without telling anyone is the kind of reasoning that fails.

Sensitive Data Categories

Certain information carries a hard line. Processing data that reveals racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric identity, health conditions, or sexual orientation is prohibited by default.⁷ The ban lifts only when one of ten narrow exceptions applies, most commonly explicit consent (a higher bar than ordinary consent), employment or social security obligations authorized by law, protecting vital interests, or healthcare processing supervised by a professional bound by confidentiality. Member states can layer additional restrictions on top, particularly for genetic, biometric, and health data.

Rights People Can Exercise

The GDPR gives people enforceable rights over their own data. Organizations must respond free of charge and within one month.⁸ Complex or high-volume requests can extend that deadline by two additional months, but the organization must notify the individual within the original window and explain the delay.⁹

At collection, the controller must tell the individual who they are, why they need the data, how long they plan to keep it, who will receive it, and what rights the individual has. When data comes from a third-party source, this disclosure has to happen within one month.¹⁰

Anyone can ask an organization to confirm whether it holds their data and to provide a copy. The controller must describe the categories of data processed, who has received it, and how long it will be stored. The first copy is free; additional copies can carry a reasonable administrative fee.¹¹ If any data is wrong, the individual can demand correction, and the controller must notify anyone previously given the incorrect version.

The right to erasure, sometimes called the right to be forgotten, lets people request deletion when the data is no longer needed for its original purpose, when consent is withdrawn and no other basis exists, or when the data was collected unlawfully. Controllers must also erase data collected from children for online services. Exceptions cover legal compliance, public health, archiving in the public interest, and defending legal claims.¹²

Data portability allows an individual to receive their personal data in a structured, commonly used, machine-readable format and move it to a different provider. This right applies when processing is based on consent or a contract and carried out by automated means. Where technically feasible, direct controller-to-controller transfer can be requested.

People can object to processing for direct marketing at any time, and the controller must stop immediately with no exceptions.¹³ For other processing based on public interest or legitimate interests, objection is also available, but the controller may continue if it demonstrates compelling grounds that override the individual’s interests.

For online services that rely on consent, the default age of digital consent is 16, with parental authorization required below that threshold. Member states may lower it, but not below 13.¹⁴ Controllers must make reasonable efforts to verify that whoever is providing consent actually holds parental responsibility.

Sending Data Outside Europe

Transferring personal data outside the European Economic Area adds a layer of rules. The simplest route is transferring to a country the European Commission has formally recognized as providing adequate protection. As of early 2026, that list includes Andorra, Argentina, Brazil (added February 2026), Canada (for commercial organizations), the Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, the United States (for participants in the Data Privacy Framework), and Uruguay.¹⁵ Transfers to these destinations work essentially the same as flows within the EU.

The EU-U.S. Data Privacy Framework, adopted in July 2023, is the third attempt to build a legal bridge for transatlantic transfers after courts struck down its predecessors. U.S. companies self-certify through the Department of Commerce, and Executive Order 14086 introduced limits on intelligence agencies’ data access along with a new review court for EU complaints. A challenge was dismissed by the EU General Court in September 2024, but an appeal filed in October 2025 remains pending before the Court of Justice.¹⁶ Organizations relying on the framework should watch that case. If the court invalidates it, the fallbacks are standard contractual clauses or binding corporate rules, both of which cost more and require heavier compliance work.

The UK’s adequacy status was extended and amended in December 2025.¹⁵ Data flows freely between the EU and the UK for now, subject to periodic review that could revoke the decision if UK standards diverge too far from EU requirements.

Cookies and Electronic Marketing

Directive 2002/58/EC, the ePrivacy Directive, governs the confidentiality of electronic communications and is the law behind cookie consent pop-ups.¹⁷ Where the GDPR handles personal data generally, this directive focuses on how data travels through communication networks and what gets stored on a user’s device.

Websites must obtain consent before placing non-essential cookies or similar trackers. Strictly necessary cookies, such as those that keep a shopping cart working, do not require consent. Anything used for analytics, advertising, or behavioral tracking does, and users must be given a genuine choice before any non-essential collection begins.

Marketing by email, text, or automated calling also falls under this directive. Businesses generally need prior opt-in before sending promotional messages. A narrow exception exists for existing customers who purchased a similar product, and even then every message must include a clear way to opt out. A proposed replacement regulation was in the works for years, but the European Commission formally withdrew that proposal for lack of political consensus, so the current directive remains in force.

The AI Act Privacy Overlay

Regulation (EU) 2024/1689, the EU AI Act, is primarily an AI safety and transparency law, but several provisions directly restrict how artificial intelligence can interact with personal data. Eight categories of AI practices were banned outright starting in February 2025:¹⁸

Social scoring systems that evaluate people based on behavior or personal characteristics.
Untargeted scraping of the internet or surveillance camera footage to build facial recognition databases.
Emotion recognition in workplaces and schools.
Biometric categorization used to infer protected characteristics like race or religion.
Real-time remote biometric identification by law enforcement in public spaces, subject to narrow exceptions.

High-risk AI systems, including those used for biometric identification, law enforcement, and automated visa processing, face strict requirements around data quality, human oversight, and documentation. Transparency rules taking effect in August 2026 require AI-generated content to be identifiable and deep fakes to be clearly labeled. For organizations already navigating GDPR compliance, the AI Act adds another layer wherever automated decision-making touches personal data.

Breach Notification

When a personal data breach occurs, the controller must notify the relevant supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to anyone’s rights.¹⁹ If the 72-hour window is missed, the notification must include an explanation for the delay. Phased reporting is allowed when full details are not yet available.

The notification must describe the nature of the breach, the approximate number of people affected, the likely consequences, and the containment steps being taken.²⁰

Breaches that pose a high risk to individuals trigger a second obligation: the controller must notify the affected people directly, in clear and plain language. Individual notification can be skipped in three situations: the breached data was encrypted or otherwise unintelligible, the controller took immediate steps that eliminated the high risk, or contacting every person individually would require disproportionate effort (in which case a public announcement suffices).²¹ Even when a controller decides notification is not required, the supervisory authority can override that judgment.

Internal Compliance Duties

Beyond responding to individual rights requests, the GDPR imposes structural obligations that catch many organizations off guard. These apply regardless of company size when the processing is significant enough.

Data Protection Officers

Three categories of organizations must appoint a Data Protection Officer: public authorities, organizations whose core activity involves large-scale regular monitoring of individuals, and organizations that process sensitive data or criminal records on a large scale.²² Small businesses are not automatically exempt. A ten-person startup whose entire business model runs on behavioral tracking needs a DPO. Member states can expand these requirements, and the EDPB recommends appointing one as good practice even when not legally required.

Data Protection Impact Assessments

Before launching any processing activity likely to create high risks, the controller must complete a formal impact assessment. The GDPR always requires one for automated profiling that produces legal effects on individuals, large-scale processing of sensitive data, and systematic monitoring of publicly accessible areas on a large scale.²³ National supervisory authorities publish their own additional lists. If the assessment reveals high risks that cannot be mitigated, the controller must consult the supervisory authority before proceeding.

Records of Processing Activities

Every controller must maintain written records (electronic formats count) documenting the purposes of processing, categories of data and recipients, international transfers, planned retention periods, and a description of security measures.²⁴ Processors keep parallel records covering the controllers they work for and the categories of processing performed. Records must be available to the supervisory authority on request. Organizations with fewer than 250 employees are technically exempt, but only if their processing is occasional, does not include sensitive data, and is unlikely to pose risks. Most businesses that handle customer data regularly fall outside that exemption.

Enforcement and Fines

Each EU member state operates an independent Data Protection Authority that investigates complaints, conducts audits, and issues sanctions. When a company operates across multiple countries, the “One-Stop-Shop” mechanism channels enforcement primarily through the authority where the company’s main establishment is located. The European Data Protection Board coordinates the national authorities, issues binding guidelines, and resolves cross-border disputes.

The GDPR uses a two-tier fine structure. Violations of organizational obligations, such as failing to maintain processing records, appoint a DPO when required, or conduct impact assessments, carry fines up to €10 million or 2 percent of global annual turnover, whichever is higher. More fundamental violations, including processing without a legal basis, ignoring individual rights, or making unauthorized international transfers, carry fines up to €20 million or 4 percent of global annual turnover.¹ Authorities always apply whichever figure is larger, so major tech companies face fines calculated as a percentage of revenue rather than a fixed cap.

Fines are not the only tool. Authorities can ban specific processing activities, order deletion of unlawfully collected data, or suspend transfers to third countries. Individuals who suffer material or non-material damage from a violation can also seek compensation directly from the controller or processor responsible. A 2023 Court of Justice ruling confirmed that non-material harm, such as distress from a data breach, can support a compensation claim, adding a layer of civil liability on top of regulatory penalties.

1
GDPR-Text.com. Article 83 GDPR – General Conditions for Imposing Administrative Fines
2
European Union Agency for Fundamental Rights. European Convention on Human Rights – Article 8
3
European Data Protection Board. Guidelines 3/2018 on the Territorial Scope of the GDPR (Article 3)
4
Legislation.gov.uk. Regulation (EU) 2016/679 – Article 4
5
General Data Protection Regulation (GDPR). Art. 27 GDPR – Representatives of Controllers or Processors Not Established in the Union
6
GDPR-Text.com. Article 6 GDPR – Lawfulness of Processing
7
General Data Protection Regulation (GDPR). Art. 9 GDPR – Processing of Special Categories of Personal Data
8
General Data Protection Regulation (GDPR). Art. 12 GDPR – Transparent Information, Communication and Modalities
9
European Data Protection Board. Respect Individuals’ Rights
10
General Data Protection Regulation (GDPR). Art. 13 GDPR – Information to Be Provided Where Personal Data Are Collected from the Data Subject
11
General Data Protection Regulation (GDPR). Art. 15 GDPR – Right of Access by the Data Subject
12
General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure (Right to Be Forgotten)
13
General Data Protection Regulation (GDPR). Art. 21 GDPR – Right to Object
14
General Data Protection Regulation (GDPR). Art. 8 GDPR – Conditions Applicable to Child’s Consent in Relation to Information Society Services
15
European Commission. Adequacy Decisions
16
Berkeley Technology Law Journal. Third Time’s the Charm? The Fate of the EU-U.S. Data Privacy Framework
17
European Data Protection Supervisor. Directive 2002/58/EC of the European Parliament and of the Council
18
European Commission. AI Act – Shaping Europe’s Digital Future
19
General Data Protection Regulation (GDPR). Art. 33 GDPR – Notification of a Personal Data Breach to the Supervisory Authority
20
European Data Protection Board. Guidelines on Personal Data Breach Notification Under GDPR
21
General Data Protection Regulation (GDPR). Art. 34 GDPR – Communication of a Personal Data Breach to the Data Subject
22
GDPR-Text.com. Article 37 GDPR – Designation of the Data Protection Officer
23
General Data Protection Regulation (GDPR). Art. 35 GDPR – Data Protection Impact Assessment
24
General Data Protection Regulation (GDPR). Art. 30 GDPR – Records of Processing Activities