European Union. Comprehensive data protection. Regulation (EU)
EUDPRRegulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies
In force
§1Summary
- Synopsis
Applies GDPR-equivalent rules to EU institutions, bodies, offices and agencies, under EDPS supervision. Chapter IX covers operational personal data in police and judicial cooperation bodies.
- Key themes
- Unique features
The EDPS can fine EU institutions directly. The EDPS investigated the European Commission's use of Microsoft 365 under this law.
- SaaS relevance
Applies when a SaaS provider is a processor for an EU institution or agency: Art 29 processor terms and transfer rules apply.
§2Obligations
- Extraterritorial
- No
- Breach notification
- EDPS 72h; individuals if high risk
- DPO
- Yes
- Cross-border transfers
- Adequacy/SCCs/derogations
- Maximum penalty
- €50,000 per infringement / €500,000 per year (fines on EU bodies)
§3Dates
- Key dates
- Adopted
- In force
- Applies from 2018-12-11 (operational personal data rules for Eurojust/EPPO etc. phased)
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- European Data Protection Supervisor (EDPS)
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.