GDPR Full Text: Principles, Rights, and Obligations

The full text of the GDPR is published as Regulation (EU) 2016/679 on EUR-Lex, the European Union’s official legal database, in all 24 official EU languages and in both HTML and PDF formats.¹ The regulation runs 173 recitals and 99 articles across 11 chapters, and it reaches any business worldwide that handles personal data of people in the EU.²

Where To Read the Official Version

EUR-Lex hosts the authoritative continuous text, starting with the recitals and ending with the final articles. That is the version courts and regulators treat as definitive, so it is the one to cite in a legal proceeding or compliance document.

For everyday reading, gdpr-info.eu presents the same text in an article-by-article format with cross-references and related recitals grouped alongside each article. The wording is identical; only the navigation differs.

How the Text Is Organized

The regulation has two layers. The 173 recitals at the front provide explanatory context. They are not binding on their own, but courts and regulators use them to interpret what the binding articles mean when the operative language is vague.

The 99 binding articles sit in 11 chapters:

Chapter I — general provisions, including definitions and territorial scope
Chapter II — core principles for processing personal data
Chapter III — rights of individuals whose data is collected
Chapter IV — obligations for controllers and processors
Chapter V — rules for transferring data outside the EU
Chapter VI — structure and powers of supervisory authorities
Chapter VII — cooperation between authorities across member states
Chapter VIII — remedies, liability, and penalties
Chapter IX — rules for specific processing situations such as journalism and employment
Chapter X — delegated and implementing acts
Chapter XI — final provisions, including the repeal of the old directive

What the Text Defines as Personal Data

Article 4 defines personal data as any information relating to an identified or identifiable person. The definition is deliberately broad. It covers names and ID numbers, location data, online identifiers such as IP addresses and cookie IDs, and factors tied to a person’s physical, genetic, mental, economic, or cultural identity.² If data can be linked back to a specific person, even indirectly, the regulation treats it as personal data.

Article 9 sets aside a stricter category called special categories of personal data. Processing this information is generally prohibited unless a specific exception applies. The category covers data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic and biometric data used for identification, health information, and data about a person’s sex life or sexual orientation.³ Exceptions include explicit consent, employment law obligations, protecting someone’s vital interests when they cannot consent, and public health purposes.

The Seven Principles in Article 5

Article 5 sets out seven principles that govern every processing activity, and supervisory authorities cite them regularly in enforcement actions:⁴

Lawfulness, fairness, and transparency: process only with a legal basis, in ways people would reasonably expect, and with accessible information about the practices used.
Purpose limitation: collect data for specific, stated purposes and do not repurpose it in ways that conflict with those goals.
Data minimization: collect only what you actually need.
Accuracy: keep data correct and up to date; erase or fix inaccurate records without delay.
Storage limitation: do not keep personal data longer than necessary for the stated purpose.
Integrity and confidentiality: protect data against unauthorized access, accidental loss, and destruction through appropriate security measures.
Accountability: the organization must be able to prove it complies with the other six principles.

The accountability principle is where most organizations stumble. Following the rules is not enough; compliance has to be demonstrable through documentation, internal policies, and technical safeguards.

The Six Lawful Bases in Article 6

Article 6 lists six lawful grounds for processing personal data, and at least one must apply before any collection or use begins:⁵

Consent given clearly for one or more specific purposes.
Contract performance, where processing is necessary to fulfill a contract with the individual or to take steps they requested before entering one.
Legal obligation the controller is subject to.
Vital interests, where processing is necessary to protect someone’s life.
Public interest or the exercise of official authority.
Legitimate interests of the controller or a third party, unless overridden by the individual’s rights, particularly when the individual is a child.

Consent gets the most attention, but in practice many businesses rely on contract performance and legitimate interests. The basis needs to be chosen and documented before processing begins; switching bases after the fact is something regulators look at skeptically.

Consent for Children

Article 8 adds rules when online services are offered directly to children. The default age at which a child can provide their own consent is 16, and member states can lower the threshold to as young as 13.⁶ Below the applicable age, a parent or guardian must authorize the processing, and the controller must make reasonable efforts to verify that the person consenting actually holds parental responsibility.

Rights the Text Grants Individuals

Chapter III, covering Articles 12 through 23, gives individuals a set of enforceable rights over their personal data. Organizations must respond to requests exercising these rights within one month.⁷

Access, Correction, and Erasure

Article 15 gives you the right to ask any organization whether it holds your personal data and, if so, to receive a copy along with details about the purpose of the processing, the categories of data involved, who has received it, and how long it will be stored. Article 16 lets you correct inaccurate information or fill in incomplete records. Article 17, often called the right to be forgotten, allows you to request deletion when the data is no longer necessary for its original purpose, when you withdraw consent, or when the data was processed unlawfully.

Portability and Objection

Article 20 gives you the right to receive your personal data in a commonly used, machine-readable format and to transfer it to another service. Article 21 provides the right to object to processing based on legitimate interests or public interest grounds; the organization must stop unless it can demonstrate compelling reasons that override your interests. For direct marketing, the right to object is absolute. Once you object, the organization must stop.

Response Deadlines

Article 12 requires organizations to respond without undue delay and no later than one month from receipt. That deadline can be extended by two additional months for complex or high-volume requests, but the organization must notify you of the extension and the reason within the original one-month window. Responses must be free of charge, though a reasonable fee can be charged for manifestly unfounded or excessive requests.

Duties the Text Places on Organizations

Chapter IV translates the principles into operational requirements. A controller decides why and how personal data is processed. A processor handles data on the controller’s behalf. Under Article 24, controllers must demonstrate full compliance with every principle and remain responsible for the actions of any processors they engage. Processors have their own direct obligations and can face enforcement independently.

Data Protection by Design and by Default

Article 25 requires privacy protections to be built into systems from the start, not added after launch. Measures such as pseudonymization and data minimization belong in the design phase. By default, only the data strictly necessary for each specific purpose should be processed, and personal data should not be made accessible to an unlimited number of people without the individual actively choosing to share it.⁸

Records of Processing

Article 30 requires controllers to maintain written records of every processing activity, covering purposes, categories of data and recipients, international transfers, retention periods, and security measures. Organizations with fewer than 250 employees are exempt unless their processing is likely to pose a risk to individuals’ rights, is not occasional, or involves special categories of data.⁹ Most organizations handling customer data on a regular basis will not qualify.

Impact Assessments

Article 35 requires a Data Protection Impact Assessment before processing that is likely to create a high risk to individuals’ rights. Three situations specifically trigger the requirement: automated decision-making with legal effects on people, large-scale processing of special categories of data, and systematic monitoring of publicly accessible areas on a large scale.¹⁰ The assessment must describe the processing, evaluate whether it is necessary and proportionate, assess the risks, and identify safeguards.

Data Protection Officers

Article 37 requires a Data Protection Officer in three situations: when processing is carried out by a public authority, when core activities require regular and systematic large-scale monitoring of individuals, or when core activities involve large-scale processing of special categories of data or criminal conviction records.¹¹ The officer serves as the contact point for the supervisory authority and for the individuals whose data is processed, and monitors internal compliance.

Breach Notification

Articles 33 and 34 set strict timelines when a breach occurs. A controller must notify its supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to pose a risk to individuals’ rights.¹² Becoming aware means having a reasonable degree of certainty that a security incident has compromised personal data. If the 72-hour deadline is missed, the notification must include an explanation for the delay.

When a breach is likely to create a high risk to affected individuals, Article 34 requires the controller to notify those individuals directly, in clear and plain language, describing the nature of the breach and the steps being taken. Direct notification is not required if encryption or other protections rendered the data unintelligible, if subsequent measures have eliminated the high risk, or if individual notification would require disproportionate effort, in which case a public communication must be made instead.

International Data Transfers

Chapter V controls the movement of personal data from the EU to countries outside the European Economic Area. The concern is that data should not lose its protections simply by crossing a border.

The simplest path is an adequacy decision under Article 45, where the European Commission determines that a non-EU country’s legal framework provides a level of protection essentially equivalent to the EU’s. Data can flow freely to countries with adequacy status without additional safeguards.¹³

Without adequacy, Article 46 allows transfers through approved mechanisms. The two most commonly used are standard contractual clauses, which are pre-approved legal templates binding the data importer to specific privacy commitments, and binding corporate rules, which are internal policies allowing multinationals to transfer data within their own corporate group across borders subject to supervisory authority approval.¹⁴

Article 49 permits transfers outside adequacy and safeguard mechanisms in narrow circumstances, such as explicit consent after the individual is informed of the risks, contract necessity with the individual, or important public interest reasons. These derogations are intended for occasional transfers, not routine data flows.

Reach Beyond the EU

Article 3 makes the regulation applicable to any organization, regardless of location, that offers goods or services to people in the EU or monitors their behavior within the EU.² A U.S.-based e-commerce site shipping to European customers, or an app that tracks the location of users in the EU, falls within scope even without any physical presence in Europe.

Article 27 requires non-EU controllers and processors to appoint a written representative in the EU. The representative must be located in a member state where the affected individuals are, and serves as the point of contact for supervisory authorities and individuals on compliance matters.¹⁵ An exemption exists for organizations whose processing is occasional, does not involve special categories of data on a large scale, and is unlikely to pose a risk. Public authorities are also exempt.

Fines and Individual Remedies

Independent supervisory authorities in each member state enforce the regulation. They investigate complaints, conduct audits, issue warnings, and impose fines. Article 83 sets a two-tier structure, and whichever amount is higher, the fixed euro figure or the turnover percentage, is the cap that applies:¹⁶

Lower tier, up to €10 million or 2% of global annual turnover, for violations of controller and processor obligations such as failing to maintain processing records, neglecting to conduct impact assessments, or not appointing a required Data Protection Officer.
Upper tier, up to €20 million or 4% of global annual turnover, for violations of the core principles, lawful processing conditions, data subject rights, and international transfer rules.

Individuals have several routes. Article 77 grants the right to lodge a complaint with a supervisory authority, particularly in the member state where they live, work, or where the alleged violation occurred.¹⁷ Article 79 grants the right to sue a controller or processor directly in the courts of the member state where the organization is established or where the individual lives.¹⁸ Article 82 establishes the right to compensation for material and non-material damage caused by a violation.

For organizations operating across multiple EU countries, Article 56 designates a lead supervisory authority based on where the organization’s main establishment sits. That lead authority is the single point of contact for cross-border issues, so a company does not have to deal with every national regulator at once.¹⁹ A local authority can still handle a case independently if it relates only to an establishment in its own member state or affects only local individuals.

1
EUR-Lex. Regulation 2016/679 of the European Parliament and of the Council
2
General Data Protection Regulation. Art 3 GDPR Territorial Scope
3
General Data Protection Regulation. Art 9 GDPR Processing of Special Categories of Personal Data
4
General Data Protection Regulation. Art 5 GDPR Principles Relating to Processing of Personal Data
5
General Data Protection Regulation. Art 6 GDPR Lawfulness of Processing
6
General Data Protection Regulation. Art 8 GDPR Conditions Applicable to Childs Consent in Relation to Information Society Services
7
General Data Protection Regulation. Chapter 3 Rights of the Data Subject
8
General Data Protection Regulation. Art 25 GDPR Data Protection by Design and by Default
9
General Data Protection Regulation. Art 30 GDPR Records of Processing Activities
10
General Data Protection Regulation. Art 35 GDPR Data Protection Impact Assessment
11
UK Legislation. Regulation EU 2016/679 Article 37
12
General Data Protection Regulation. Art 33 GDPR Notification of a Personal Data Breach to the Supervisory Authority
13
General Data Protection Regulation. Chapter 5 Transfers of Personal Data to Third Countries or International Organisations
14
European Data Protection Board. International Data Transfers
15
General Data Protection Regulation. Art 27 GDPR Representatives of Controllers or Processors Not Established in the Union
16
General Data Protection Regulation. Art 83 GDPR General Conditions for Imposing Administrative Fines
17
General Data Protection Regulation. Art 77 GDPR Right to Lodge a Complaint With a Supervisory Authority
18
General Data Protection Regulation. Art 79 GDPR Right to an Effective Judicial Remedy Against a Controller or Processor
19
General Data Protection Regulation. Art 56 GDPR Competence of the Lead Supervisory Authority