Before you read

This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.

European Union and EEA

Open in Knowledge map

Sources last checked: 2026-11-09

The General Data Protection Regulation, or GDPR, is the European Union’s main privacy law. It has applied since 25 May 2018 and binds every member state directly, without needing national legislation to bring it into effect.¹

At a glance

Question	Answer
Main law	Regulation (EU) 2016/679, the GDPR²
Answer to a rights request	Within one month, extendable by two more if complex³
Report a breach to the regulator	Within 72 hours where feasible, unless it is unlikely to create a risk⁴
Age to consent online alone	16, which a country may lower to no less than 13⁵
Highest fine	€20 million or 4% of worldwide annual turnover, whichever is higher⁶

Iceland, Liechtenstein and Norway take part through the European Economic Area: their regulators sit on the European Data Protection Board.⁷

Who it protects and who must comply

It protects people, the law’s “data subjects”, and it does not depend on citizenship. It applies to an organisation established in the EU, wherever the processing happens. It also reaches an organisation outside the EU when that organisation offers goods or services to people in the EU, even for free, or monitors their behaviour in the EU.⁸

It does not apply to a person acting for purely personal or household reasons, such as keeping friends’ numbers.⁹

What counts as personal data

Personal data is any information about a person who is identified or can be identified. The law’s own examples include a name, an identification number, location data and an online identifier.¹⁰

Some categories are specially protected, and processing them is prohibited unless a listed exception applies: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, health data, and data about a person’s sex life or sexual orientation.¹¹

The basic rules

Personal data must be handled lawfully, fairly and transparently; collected for specific purposes; limited to what is necessary; accurate; kept no longer than needed; and kept secure. The organisation responsible must be able to prove it follows these rules.¹²

Every use of personal data needs one of six legal reasons:¹³

the person’s consent;
a contract with the person;
a legal obligation;
protecting someone’s vital interests;
a task in the public interest;
the organisation’s legitimate interests, unless the person’s rights override them.

Consent has to be freely given, specific, informed and unambiguous, shown by a clear action.¹⁴ It must be as easy to withdraw as to give.¹⁵

Your rights

Right	What it lets you do
Information¹⁶	Be told who holds your data, why, and for how long
Access¹⁷	Get a copy of your data
Rectification¹⁸	Have wrong data corrected
Erasure¹⁹	Have data deleted, in the situations the law lists
Restriction²⁰	Have use of your data paused in certain cases
Portability²¹	Receive data you provided in a machine-readable format
Objection²²	Object to some uses; for direct marketing, at any time
Human decision²³	Not be subject to a significant decision made solely by a machine, subject to exceptions

How to use them

Ask the organisation directly. It must act without undue delay and within one month, and may take two further months for a complex request if it tells you why within the first month. It is free, unless a request is manifestly unfounded or excessive.³

If you get nowhere

You can complain to a regulator, in particular where you live or work or where the problem happened.²⁴ Each country’s regulator is listed by the European Data Protection Board.⁷ You can also go to court,²⁵ have a non-profit act for you,²⁶ and claim compensation for material or non-material damage.²⁷

When data is breached

A personal data breach must be reported to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to create a risk to people.⁴ If the risk to people is high, they must be told too, without undue delay.²⁸

Sending data outside Europe

Data may leave only under the rules of the GDPR’s Chapter V.²⁹ Where the European Commission has found that a place protects data adequately, no further safeguard is needed.³⁰ The Commission’s list, checked on 9 November 2026, names Andorra, Argentina, Brazil, Canada (commercial organisations only), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States (only companies in the EU–US Data Privacy Framework), Uruguay and the European Patent Organisation.³¹ Elsewhere, an organisation needs appropriate safeguards,³² or one of a few narrow exceptions.³³

Fines

Fines reach €20 million or 4% of worldwide annual turnover, whichever is higher, for breaking the basic principles, people’s rights or the transfer rules. Lesser obligations carry up to €10 million or 2%.⁶

What may change

The law above is the law today. The EU is negotiating a package of amendments, the Digital Omnibus, which would change parts of the GDPR. The Council agreed its position on 21 October 2026. Among other things, it would give organisations 96 hours to report a breach, and require a report to the regulator only where a breach is likely to create a high risk.³⁴ Negotiations start only once the European Parliament has its own position,³⁵ and on 9 November 2026 Parliament’s file showed the proposal still awaiting a committee decision.³⁶

Cookies and similar technology are governed mainly by a separate law, the ePrivacy Directive.