EU GDPR (2016)

Process personal data lawfully, fairly, and in a way that is transparent to the people it concerns. Every processing activity needs an identifiable legal basis (see Art. 6) and must not mislead or surprise the person it's about.

Collect personal data only for specified, explicit, legitimate purposes, and don't process it further for a new purpose that's incompatible with the original one. If you want to reuse data for something new, check compatibility first or get a fresh legal basis.

Collect and retain only the personal data that is adequate, relevant, and necessary for the purpose at hand. Don't gather 'nice to have' data on the chance it becomes useful later.

Keep personal data accurate and up to date, and take reasonable steps to correct or erase inaccurate data without delay. Give people a working way to flag inaccuracies.

Keep personal data in identifiable form only for as long as necessary for the purpose it was collected for. Define retention periods and actually enforce deletion or anonymisation when they expire.

Process personal data with appropriate security against unauthorised or unlawful processing, accidental loss, destruction, or damage. This principle is made concrete by the security-of-processing duty in Art. 32.

Every processing activity must rest on one of the six lawful bases: consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests. Identify and record which basis applies to each processing activity before you start.

When you collect personal data — whether directly from the person (Art. 13) or from another source (Art. 14) — tell them who you are, why you're processing their data, on what legal basis, how long you'll keep it, who it goes to, and what rights they have. Deliver this before or at the point of collection (Art. 13), or within a reasonable time when collected elsewhere (Art. 14).

When consent is your lawful basis, it must be freely given, specific, informed, and unambiguous, requested in clear plain language separate from other matters, and as easy to withdraw as to give. Consent for an information-society service offered directly to a child needs parental authorisation below the applicable age of digital consent (13-16 depending on member state). Decide this in only if consent is a lawful basis you actually rely on.

Provide privacy information and respond to data-subject-rights requests in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Respond to a rights request within one month (extendable by two further months for complex requests, with the person told why), and normally free of charge.

On request, confirm whether you're processing someone's personal data and, if so, give them a copy of it plus supporting details: purposes, categories of data, recipients, retention period, and their other rights.

Correct inaccurate personal data about a person without undue delay, and let them complete incomplete data, including by means of a supplementary statement.

Erase a person's personal data without undue delay when one of the Art. 17 grounds applies — e.g. it's no longer necessary for its original purpose, consent is withdrawn, or the person objects and you have no overriding ground to continue. Some exemptions apply (e.g. legal obligations, freedom of expression).

Restrict processing (mark data as 'do not use' rather than deleting it) when a person contests its accuracy, contests an objection, needs it preserved for a legal claim, or processing is otherwise unlawful but they'd rather restrict than erase.

When you rectify, erase, or restrict personal data, tell everyone you previously shared it with, unless that's impossible or disproportionately difficult. Tell the data subject who those recipients are if they ask.

Where processing is based on consent or contract and carried out by automated means, give the person their data in a structured, commonly used, machine-readable format, and transmit it directly to another controller where technically feasible.

Let a person object to processing based on legitimate interests or public task at any time on grounds relating to their situation, and stop unless you demonstrate compelling overriding grounds. Direct-marketing objections must always be honoured immediately, with no override.

People have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significantly affects them, unless it's necessary for a contract, authorised by law, or based on explicit consent — in which case you must still offer safeguards: human intervention, the right to contest the decision, and the right to express their view. Decide this in only if you run this kind of solely-automated decision-making.

Implement technical and organisational measures proportionate to the risk to ensure and be able to demonstrate that processing complies with the Regulation, and review and update those measures as processing changes.

Build data protection into processing systems and business practices from the outset (by design) and configure defaults so only necessary personal data is processed for each specific purpose (by default) — not bolted on afterwards.

Use only processors that provide sufficient guarantees, and govern the relationship with a written contract (or other legal act) covering the subject matter, duration, nature and purpose of processing, the processor's obligations (confidentiality, sub-processor authorisation, assistance with rights requests and security, deletion/return of data on termination, and audit cooperation).

Maintain a written record of your processing activities — purposes, categories of data subjects and data, recipients, transfer safeguards, retention periods, and a general description of security measures. Keep it current and available to the supervisory authority on request.

Implement technical and organisational measures appropriate to the risk — e.g. encryption and pseudonymisation, ensuring ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore data after an incident, and a process to regularly test and evaluate the effectiveness of those measures.

Notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. Document the facts, effects, and remedial action taken, even for breaches you decide not to report.

When a breach is likely to result in a high risk to people's rights and freedoms, tell the affected individuals directly, in clear and plain language, without undue delay — unless an Art. 34(3) exception applies (e.g. the data was encrypted, or you've since mitigated the high risk).

Processing special-category data (health, biometric, genetic, racial/ethnic origin, political/religious/philosophical beliefs, trade union membership, sex life or orientation) is prohibited by default and needs one of the Art. 9(2) conditions (e.g. explicit consent, employment law, vital interests, substantial public interest). Criminal-offence data (Art. 10) needs official authority or specific member-state law. Decide this in only if you actually process such data.

Before starting processing likely to result in a high risk to people's rights and freedoms (e.g. large-scale systematic monitoring, large-scale special-category processing, or use required by a supervisory authority's Art. 35(4) list), carry out a DPIA describing the processing, assessing necessity and proportionality, and identifying risks and mitigations. Decide this in only if you run processing that meets the high-risk threshold.

If a DPIA indicates a high risk that you can't sufficiently mitigate, consult the supervisory authority before starting the processing. Decide this in only if you actually reach that residual-high-risk conclusion in a DPIA.

Appoint a DPO if you're a public authority, your core activities involve large-scale regular and systematic monitoring, or large-scale special-category/criminal-offence data processing. The DPO must be given the resources and independence to advise on and monitor compliance, be a contact point for people and the supervisory authority, and report to the highest level of management. Decide this in only if one of the appointment triggers applies to you.

If you're established outside the EU but process personal data of people in the EU under Art. 3(2) (offering goods/services to them, or monitoring their behaviour), designate a representative established in a relevant member state, in writing, to act as your contact point. Decide this in only if you have no EU establishment and Art. 3(2) applies to you.

Transferring personal data outside the EEA needs a valid transfer mechanism: an adequacy decision for the destination country, appropriate safeguards (e.g. Standard Contractual Clauses, Binding Corporate Rules), or — only for occasional, non-repetitive transfers — one of the Art. 49 derogations (e.g. explicit consent, contract necessity). Decide this in only if your processing actually involves transferring personal data outside the EEA.