European Union. Comprehensive data protection. Regulation (EU)
GDPRRegulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)
§1Summary
- Synopsis
The EU's comprehensive data protection law. It sets principles, lawful bases, transparency and data subject rights, controller and processor duties (records, DPIAs, security, breach notification, DPOs) and rules on international transfers. Independent national authorities enforce it, with consistency handled by the EDPB through the one-stop-shop.
- Key themes
- Unique features
Global benchmark with broad extraterritorial reach (Art 3(2)), turnover-based fines and the one-stop-shop enforcement model.
- SaaS relevance
Applies to any SaaS provider established in the EU or offering services to, or monitoring, people in the EU, whether as controller or as processor under Art 28.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Authority within 72h; individuals without undue delay if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy/SCCs/BCRs/derogations
- Maximum penalty
- €20m or 4% worldwide annual turnover
§3Dates
- Key dates
- Adopted
- In force
- Applies from 2018-05-25. Supplemented by the GDPR Procedural Regulation (EU) 2025/2518 (applies 2027-04-02). Targeted amendments are proposed in the Digital Omnibus COM(2025) 837 (pending as of Oct 2026). Incorporated into the EEA from 2018-07-20.
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- European Data Protection Board (EDPB) / national supervisory authorities
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.
The Digital Omnibus may change the definition of personal data, breach notification (high-risk only, 96h, single entry point) and AI-related legitimate interest. It was not adopted as of Oct 2026; see the separate row.