General Data Protection Regulation (GDPR) (EU) 2016/679

Abstract

The General Data Protection Regulation (GDPR) allows for coordination of data protection standards across Europe, addressing sensitive personal data. GDPR establishes a network of national Data Protection Authorities (DPAs) to ensure consistent enforcement and coordination across member states. DPAs provide guidance, monitor compliance, and collaborate through mechanisms like the European Data Protection Board (EDPB) to resolve cross-border issues.

The GDPR sets minimum relevant standards for data protection and requires collaboration for coordinated procedures. The general data protection regulation (GDPR) protects individuals when their data is being processed by the private sector and most of the public sector. It applies to any organization processing the personal data of EU citizens, regardless of where the organization is based.

The GDPR creates a level playing field for all companies operating in the EU internal market, adopts a technology-neutral approach and stimulates innovation. Article 9 of the GDPR defines special categories of personal data, also referred to as "sensitive data" and outlines specific conditions under which processing sensitive data is permitted. Sensitive data processing requires explicit and informed consent, which must be documented as proof of compliance. For sensitive data, organizations are often required to conduct a Data Protection Impact Assessment (DPIA) (Article 35), which identifies and mitigates risks associated with processing.

GDPR provides specific provisions for scientific research, allowing for sensitive data processing under strict safeguards (Recital 159, Article 89).

GDPR regulates the transfer of sensitive data outside the EU, ensuring equivalent levels of protection in the recipient country (Articles 44-50).

Overview

Country	European Union
Start date	2016
Annual Budget	n/a
Responsible organisation(s)	European Commission
Target group(s)	EU citizens, businesses, and public bodies.
Policy instrument type	EU Regulation

Background

The GDPR replaced the Data Protection Directive 95/46/EC and aims to harmonize data privacy laws across Europe. The GDPR has applied since 25 May 2018. The Commission submitted a report on the evaluation and review of the regulation in June 2020. The next evaluation is due in 2024.

Following the COVID-19 outbreak and the introduction of measures to cope with the impact of the crisis, the Commission adopted Commission Recommendation (EU) 2020/518 of 8 April 2020 on a common Union toolbox for the use of technology and data to combat and exit from the COVID-19 crisis, in particular concerning mobile applications and the use of anonymised mobility data.

Objective(s)

To protect personal data and ensure consistent data protection standards across the EU.

Public access URL

http://data.europa.eu/eli/reg/2016/679/oj

All tags

• International Co-operation
• European Union
• 2016
• European Commission
• Higher education institutes
• Public research institutes
• Research support staff
• Civil society
• Firms
• National government
• Strategies, agendas and plans
• Coordinated procedures for sensitive data

This work is published under the responsibility of the Secretary-General of the OECD. The opinions expressed and arguments employed herein do not necessarily reflect the official views of the Member countries of the OECD.

This document, as well as any data and map included herein, are without prejudice to the status of or sovereignty over any territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area.

© OECD 2025

   Attribution 4.0 International (CC BY 4.0)

This work is made available under the Creative Commons Attribution 4.0 International licence. By using this work, you accept to be bound by the terms of this licence (https://creativecommons.org/licenses/by/4.0/).

Attribution – you must cite the work.

Translations – you must cite the original work, identify changes to the original and add the following text: In the event of any discrepancy between the original work and the translation, only the text of original work should be considered valid.

Adaptations – you must cite the original work and add the following text: This is an adaptation of an original work by the OECD. The opinions expressed and arguments employed in this adaptation should not be reported as representing the official views of the OECD or of its Member countries.

Third-party material – the licence does not apply to third-party material in the work. If using such material, you are responsible for obtaining permission from the third party and for any claims of infringement.

You must not use the OECD logo, visual identity or cover image without express permission or suggest the OECD endorses your use of the work.

Any dispute arising under this licence shall be settled by arbitration in accordance with the Permanent Court of Arbitration (PCA) Arbitration Rules 2012. The seat of arbitration shall be Paris (France). The number of arbitrators shall be one.