The EU General Data Protection Regulation (GDPR)

List of abbreviations 9
List of Recitals of the General Data Protection Regulation 11
Introduction to the General Data Protection Regulation 13

1. Introduction 13
2. The most important compliance steps to be implemented 13
3. Basic terms of the GDPR 14
4. The scope of the GDPR 15
5. The relationship with national data protection laws 16
6. The principles relating to the processing of personal data 18
7. Legal basis requirement for any data processing activity 19
8. Information obligations and privacy notices 22
9. Rights of the data subject 24
10. Profiling and automated individual decision- making 25
11. Data protection compliance programme 26
12. Maintaining a record of processing activities 27
13. Data protection impact assessment and consultation obligation with supervisory authority 28
14. Data protection officer 29
15. Data security 30
16. Mandatory arrangements between joint controllers 33
17. Obligations in case of outsourcing 33
18. International data transfers 34
19. International jurisdiction of supervisory authorities 37
20. Administrative fines and other sanctions 38
21. Civil liability and private enforcement 40

Text of the General Data Protection Regulation and commentary 41
Chapter I – General provisions 43
Chapter II – Principles 75
Chapter III – Rights of the data subject 105
Chapter IV – Controller and processor 145
Chapter V – Transfers of personal data to third countries or international organisations 209
Chapter VI – Independent supervisory authorities 231
Chapter VII – Cooperation and consistency 253
Chapter VIII – Remedies, liability and penalties 283
Chapter IX – Provisions relating to specific processing situations 305
Chapter X – Delegated acts and implementing acts 319
Chapter XI – Final provisions 325

Keyword index 333
About the authors 341