European Union. Surveillance / law enforcement access. Directive (EU)
LEDDirective (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for law enforcement purposes (Law Enforcement Directive)
In force
§1Summary
- Synopsis
The data protection rules for police, prosecutors and other competent authorities processing personal data to prevent, investigate, detect or prosecute crime or execute penalties. It mirrors GDPR principles with adjustments, such as distinguishing categories of data subjects, logging, and restricted transparency rights.
- Key themes
- Unique features
It requires processing operations to be logged and allows rights to be restricted to protect investigations.
- SaaS relevance
Applies to SaaS providers only indirectly, as processors for police or justice customers, which must meet the LED's contractual and security requirements.
§2Obligations
- Extraterritorial
- No
- Breach notification
- Authority 72h; individuals if high risk (with exceptions)
- DPO
- Yes
- Cross-border transfers
- Adequacy/appropriate safeguards/derogations (Ch V)
- Maximum penalty
- Set by national law
§3Dates
- Key dates
- Adopted
- In force
- Transposition deadline 2018-05-06
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- National supervisory authorities
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.