Chapter I — General provisions

• 1Subject-matter and objectives
• 2Scope
• 3Definitions

Chapter II — Principles

• 4Principles relating to processing of personal data
• 5Time-limits for storage and review
• 6Distinction between different categories of data subject
• 7Distinction between personal data and verification of quality of personal data
• 8Lawfulness of processing
• 9Specific processing conditions
• 10Processing of special categories of personal data
• 11Automated individual decision-making

Chapter III — Rights of the data subject

• 12Communication and modalities for exercising the rights of the data subject
• 13Information to be made available or given to the data subject
• 14Right of access by the data subject
• 15Limitations to the right of access
• 16Right to rectification or erasure of personal data and restriction of processing
• 17Exercise of rights by the data subject and verification by the supervisory authority
• 18Rights of the data subject in criminal investigations and proceedings

Chapter IV — Controller and processor

• 19Obligations of the controller
• 20Data protection by design and by default
• 21Joint controllers
• 22Processor
• 23Processing under the authority of the controller or processor
• 24Records of processing activities
• 25Logging
• 26Cooperation with the supervisory authority
• 27Data protection impact assessment
• 28Prior consultation of the supervisory authority
• 29Security of processing
• 30Notification of a personal data breach to the supervisory authority
• 31Communication of a personal data breach to the data subject
• 32Designation of the data protection officer
• 33Position of the data protection officer
• 34Tasks of the data protection officer

Chapter V — Transfers of personal data to third countries or international organisations

• 35General principles for transfers of personal data
• 36Transfers on the basis of an adequacy decision
• 37Transfers subject to appropriate safeguards
• 38Derogations for specific situations
• 39Transfers of personal data to recipients established in third countries
• 40International cooperation for the protection of personal data

Chapter VI — Independent supervisory authorities

• 41Supervisory authority
• 42Independence
• 43General conditions for the members of the supervisory authority
• 44Rules on the establishment of the supervisory authority
• 45Competence
• 46Tasks
• 47Powers
• 48Reporting of infringements
• 49Activity reports

Chapter VII — Cooperation

• 50Mutual assistance
• 51Tasks of the Board

Chapter VIII — Remedies, liability and penalties

• 52Right to lodge a complaint with a supervisory authority
• 53Right to an effective judicial remedy against a supervisory authority
• 54Right to an effective judicial remedy against a controller or processor
• 55Representation of data subjects
• 56Right to compensation
• 57Penalties

Chapter IX — Implementing acts

• 58Committee procedure

Chapter X — Final provisions

• 59Repeal of Framework Decision 2008/977/JHA
• 60Union legal acts already in force
• 61Relationship with previously concluded international agreements in the field of judicial cooperation in criminal matters and police cooperation
• 62Commission reports
• 63Transposition
• 64Entry into force
• 65Addressees