Chapter I — General provisions

• 1Subject-matter and objectives
• 2Material scope
• 3Territorial scope
• 4Definitions

Chapter II — Principles

• 5Principles relating to processing of personal data
• 6Lawfulness of processing
• 7Conditions for consent
• 8Conditions applicable to child's consent in relation to information society services
• 9Processing of special categories of personal data
• 10Processing of personal data relating to criminal convictions and offences
• 11Processing which does not require identification

Chapter III — Rights of the data subject

• 12Transparent information, communication and modalities for the exercise of the rights of the data subject
• 13Information to be provided where personal data are collected from the data subject
• 14Information to be provided where personal data have not been obtained from the data subject
• 15Right of access by the data subject
• 16Right to rectification
• 17Right to erasure (‘ right to be forgotten ’)
• 18Right to restriction of processing
• 19Notification obligation regarding rectification or erasure of personal data or restriction of processing
• 20Right to data portability
• 21Right to object
• 22Automated individual decision-making, including profiling
• 23Restrictions

Chapter IV — Controller and processor

• 24Responsibility of the controller
• 25Data protection by design and by default
• 26Joint controllers
• 27Representatives of controllers or processors not established in the Union
• 28Processor
• 29Processing under the authority of the controller or processor
• 30Records of processing activities
• 31Cooperation with the supervisory authority
• 32Security of processing
• 33Notification of a personal data breach to the supervisory authority
• 34Communication of a personal data breach to the data subject
• 35Data protection impact assessment
• 36Prior consultation
• 37Designation of the data protection officer
• 38Position of the data protection officer
• 39Tasks of the data protection officer
• 40Codes of conduct
• 41Monitoring of approved codes of conduct
• 42Certification
• 43Certification bodies

Chapter V — Transfers of personal data to third countries or international organisations

• 44General principle for transfers
• 45Transfers on the basis of an adequacy decision
• 46Transfers subject to appropriate safeguards
• 47Binding corporate rules
• 48Transfers or disclosures not authorised by Union law
• 49Derogations for specific situations
• 50International cooperation for the protection of personal data

Chapter VI — Independent supervisory authorities

• 51Supervisory authority
• 52Independence
• 53General conditions for the members of the supervisory authority
• 54Rules on the establishment of the supervisory authority
• 55Competence
• 56Competence of the lead supervisory authority
• 57Tasks
• 58Powers
• 59Activity reports

Chapter VII — Cooperation and consistency

• 60Cooperation between the lead supervisory authority and the other supervisory authorities concerned
• 61Mutual assistance
• 62Joint operations of supervisory authorities
• 63Consistency mechanism
• 64Opinion of the Board
• 65Dispute resolution by the Board
• 66Urgency procedure
• 67Exchange of information
• 68European Data Protection Board
• 69Independence
• 70Tasks of the Board
• 71Reports
• 72Procedure
• 73Chair
• 74Tasks of the Chair
• 75Secretariat
• 76Confidentiality

Chapter VIII — Remedies, liability and penalties

• 77Right to lodge a complaint with a supervisory authority
• 78Right to an effective judicial remedy against a supervisory authority
• 79Right to an effective judicial remedy against a controller or processor
• 80Representation of data subjects
• 81Suspension of proceedings
• 82Right to compensation and liability
• 83General conditions for imposing administrative fines
• 84Penalties

Chapter IX — Provisions relating to specific processing situations

• 85Processing and freedom of expression and information
• 86Processing and public access to official documents
• 87Processing of the national identification number
• 88Processing in the context of employment
• 89Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
• 90Obligations of secrecy
• 91Existing data protection rules of churches and religious associations

Chapter X — Delegated acts and implementing acts

• 92Exercise of the delegation
• 93Committee procedure

Chapter XI — Final provisions

• 94Repeal of Directive 95/46/EC
• 95Relationship with Directive 2002/58/EC
• 96Relationship with previously concluded Agreements
• 97Commission reports
• 98Review of other Union legal acts on data protection
• 99Entry into force and application