Regulation (EU) 2016/679 General Data Protection Regulation

Publisher

Publications Office of the European Union (EUR-Lex)

URL

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

Published

2016-04-27

Updated

unknown

Accessed

2026-09-04

HTTP status

200

License

European Union, https://eur-lex.europa.eu, reuse authorised under Commission Decision 2011/833/EU; reuse permitted with source acknowledgement; excerpts and locators retained

Source notes citing this source

• Absent an adequacy decision, the General Data Protection Regulation permits a transfer where the controller or processor provides appropriate safeguards with enforceable data subject rights and effective legal remedies, which may take the form of binding corporate rules, standard contractual clauses, approved codes of conduct or approved certification mechanisms. in context
• The General Data Protection Regulation gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, and requires at minimum a right to human intervention, to express a view and to contest the decision where an exception applies. in context
• The General Data Protection Regulation allows a transfer of personal data to a third country or international organisation only where the conditions of Chapter V are met, including for onward transfers, so that the level of protection guaranteed by the Regulation is not undermined. in context
• The General Data Protection Regulation provides that a judgment of a third-country court or a decision of a third-country administrative authority requiring a controller or processor to transfer or disclose personal data is only recognisable or enforceable if it is based on an international agreement in force between that country and the European Union or a Member State. in context
• GDPR Article 28(3)(h) requires the processor to make available all information needed to demonstrate compliance with Article 28 and to allow for and contribute to audits, including inspections. in context
• GDPR Article 28(3)(g) requires the processor contract to oblige the processor to delete or return all personal data at the end of the services and delete existing copies unless EU or Member State law requires storage. in context
• GDPR Article 28(3)(a) requires the processor to process personal data only on documented instructions from the controller, including instructions on transfers to third countries. in context
• GDPR Article 28(2) bars a processor from engaging another processor without the controller's prior specific or general written authorisation; under general authorisation the processor must inform the controller of changes so the controller can object. in context

Cite this source record

APA

WarmTransfer. (2016, April 27). Regulation (EU) 2016/679 General Data Protection Regulation. WarmTransfer. https://warmtransfer.net/knowledge/sources/eu-gdpr-regulation-2016-679

BibTeX

@misc{warmtransfer-eu-gdpr-regulation-2016-679,
  title  = {Regulation (EU) 2016/679 General Data Protection Regulation},
  author = {{WarmTransfer}},
  year   = {2016},
  url    = {https://warmtransfer.net/knowledge/sources/eu-gdpr-regulation-2016-679},
  note   = {Publications Office of the European Union (EUR-Lex), accessed 2026-09-04}
}