This chapter establishes the foundational framework of the GDPR, defining its scope, territorial applicability, and key definitions. It sets out the subject matter and objectives of the regulation, clarifies when and where it applies, and provides essential terminology that forms the basis for understanding the entire regulation.

Key Topics: Subject matter and objectives, Material scope, Territorial scope, Key definitions (personal data, processing, controller, processor, consent, etc.)

This chapter establishes the core principles that govern all personal data processing activities under the GDPR. These principles form the backbone of data protection compliance and must be adhered to in all processing operations. The chapter also introduces the fundamental principle of accountability and sets out the legal bases for lawful processing.

Key Topics: Principles relating to processing (lawfulness, fairness, transparency), Data minimization, Purpose limitation, Accuracy, Storage limitation, Integrity and confidentiality, Accountability, Lawfulness of processing, Conditions for consent, Processing special categories of data, Processing of criminal conviction data

This chapter establishes the individual rights that data subjects can exercise in relation to their personal data. It sets out the procedures for transparent communication with data subjects and defines their rights to access, rectification, erasure, restriction, data portability, objection, and protection against automated decision-making. These rights are fundamental to empowering individuals to control their personal information.

Key Topics: Transparent information and communication, Right to information (at collection), Right of access, Right to rectification, Right to erasure ('right to be forgotten'), Right to restriction of processing, Right to data portability, Right to object, Automated individual decision-making, including profiling, Restrictions on rights

This chapter establishes the obligations and responsibilities of data controllers and processors. It introduces key accountability measures including data protection by design and by default, records of processing activities, data protection impact assessments, security requirements, breach notification obligations, and the role of Data Protection Officers. This chapter forms the operational core of GDPR compliance for organizations.

Key Topics: Responsibility of the controller, Data protection by design and by default, Joint controllers, Representatives of controllers not established in the EU, Processor obligations, Processing under authority of controller or processor, Records of processing activities, Cooperation with supervisory authority, Data protection impact assessment (DPIA), Prior consultation with supervisory authority, Data Protection Officer (DPO), Security of processing, Personal data breach notification, Communication of breach to data subjects, Codes of conduct, Certification mechanisms

This chapter establishes the rules and safeguards for transferring personal data outside the European Economic Area (EEA). It ensures that the level of protection afforded by the GDPR is not undermined when personal data is transferred to third countries or international organizations. The chapter sets out various mechanisms for lawful transfers, including adequacy decisions, appropriate safeguards, and derogations for specific situations.

Key Topics: General principle for transfers, Adequacy decisions, Appropriate safeguards (Standard Contractual Clauses, Binding Corporate Rules), Derogations for specific situations, International cooperation for data protection, Transfers not based on adequacy decision or appropriate safeguards

This chapter establishes the framework for independent supervisory authorities (data protection authorities) in each EU Member State. It defines their independence, tasks, powers, and competences. The chapter ensures that supervisory authorities can effectively monitor and enforce GDPR compliance while maintaining their independence from government and other external influences.

Key Topics: Establishment of supervisory authorities, Independence of supervisory authorities, General conditions for members, Rules on establishment of supervisory authority, Competence of supervisory authorities, Tasks of supervisory authorities, Powers of supervisory authorities (investigative, corrective, authorization, advisory), Activity reports

This chapter establishes mechanisms for cooperation between supervisory authorities and ensures consistent application of the GDPR across the EU. It introduces the European Data Protection Board (EDPB), the one-stop-shop mechanism, mutual assistance procedures, joint operations, and the consistency mechanism. This chapter is crucial for managing cross-border data processing and ensuring uniform GDPR enforcement throughout the European Union.

Key Topics: Cooperation between lead supervisory authority and other concerned authorities, One-stop-shop mechanism, Mutual assistance and joint operations, European Data Protection Board (EDPB), Independence of the EDPB, Tasks and powers of the EDPB, Consistency mechanism, Dispute resolution, Binding decisions of the EDPB, Urgency procedure

This chapter establishes the enforcement framework of the GDPR, providing data subjects with effective remedies against supervisory authorities and controllers/processors. It sets out liability rules for damages, defines administrative fines and their calculation, and establishes penalties. This chapter ensures that GDPR rights are enforceable and that violations carry meaningful consequences.

Key Topics: Right to lodge a complaint with a supervisory authority, Right to an effective judicial remedy against a supervisory authority, Right to an effective judicial remedy against a controller or processor, Representation of data subjects, Suspension of proceedings, Right to compensation and liability, General conditions for imposing administrative fines, Penalties

This chapter addresses specific processing situations that require special consideration due to their unique nature or tension with other fundamental rights. It covers the relationship between data protection and freedom of expression, employment contexts, public access to documents, processing for archiving, research and statistical purposes, confidentiality obligations, and church and religious association data. These provisions balance data protection with other important societal interests and rights.

Key Topics: Processing and freedom of expression and information, Processing and public access to official documents, Processing of national identification numbers, Processing in the employment context, Safeguards for processing for archiving, research, and statistics, Obligations of secrecy and confidentiality, Existing data protection rules of churches and religious associations

This chapter empowers the European Commission to adopt delegated acts to supplement the GDPR and implementing acts to ensure uniform application. It establishes the procedures for these acts, including the exercise of delegation, the urgency procedure, and the committee procedure for implementing acts. These mechanisms allow the GDPR to adapt to technological developments and ensure consistent implementation across Member States.

Key Topics: Exercise of delegation by the Commission, Urgency procedure for delegated acts, Committee procedure for implementing acts, Criteria for certification mechanisms, Icons for data processing, International data transfers

This chapter contains the concluding administrative and transitional provisions of the GDPR. It addresses the repeal of the previous Data Protection Directive, relationship with existing directives, application to the European Data Protection Supervisor, delegated acts adopted under the previous directive, review clauses, and the dates of entry into force and application. These provisions manage the transition from the old data protection regime to the GDPR.

Key Topics: Repeal of Directive 95/46/EC, Relationship with Directive 2002/58/EC (ePrivacy Directive), Application to EU institutions and bodies, Transitional arrangements for authorizations and advisory opinions, Review of the regulation, Entry into force and application dates