The GDPR sets rules for how personal data of people in the European Union is collected, used, shared and protected. It applies by place of the individual as well as by place of the organisation. This list gathers the obligations a controller or processor most often has to show, by article.
Free account needed to download. You come straight back to the file.
Who it is for. Organisations in the EU, and organisations elsewhere, including Indian exporters and service providers, that offer goods or services to people in the EU or monitor their behaviour.
What this list covers. Regulation (EU) 2016/679, the main controller and processor obligations by article: 27 obligations. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it asks for |
|---|---|---|
| Art. 5 | Principles | Use personal data lawfully, fairly and transparently, for stated purposes, in the least amount needed, accurately, for no longer than necessary and securely. |
| Art. 6 | Lawful basis | Have and record one of the six lawful bases before you process personal data. |
| Art. 7 | Conditions for consent | Where you rely on consent, make it freely given, specific, informed, unambiguous and easy to withdraw, and be able to prove it. |
| Art. 8 | Children's consent | Get parental authorisation for online services offered directly to children below the applicable age. |
| Art. 9 | Special category data | Do not process health, biometric, political, religious or similar data unless a specific condition applies. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 12 | Transparent communication | Answer requests in plain language, free of charge in most cases, within one month. |
| Art. 13-14 | Privacy information | Tell people who you are, why you use their data, on what basis, who gets it and how long you keep it. |
| Art. 15 | Right of access | Give people a copy of their data and information about how it is used. |
| Art. 16 | Right to rectification | Correct inaccurate data and complete incomplete data on request. |
| Art. 17 | Right to erasure | Delete data when the person asks and one of the listed grounds applies. |
| Art. 18 | Right to restriction | Pause use of data while accuracy or an objection is being resolved, or when use is unlawful. |
| Art. 20 | Right to data portability | Provide data in a structured, common, machine-readable format when processing is by consent or contract and automated. |
| Art. 21 | Right to object | Stop processing based on legitimate interests or public interest, and stop direct marketing at once, when asked. |
| Art. 22 | Automated decisions | Do not take solely automated decisions with legal or similar effect unless allowed, and give a route to human review. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 24 | Responsibility of the controller | Put in place technical and organisational measures, and be able to show that processing meets the law. |
| Art. 25 | Data protection by design and by default | Build privacy into systems and processes, and set defaults to the least data and the narrowest sharing. |
| Art. 26 | Joint controllers | Agree in a transparent way who does what when you decide purposes and means together. |
| Art. 28 | Processors | Use only processors that give guarantees, and bind them with a written contract on the matters the article lists. |
| Art. 30 | Records of processing | Keep a written record of processing activities and make it available to the authority on request. |
| Art. 32 | Security of processing | Apply measures appropriate to the risk, such as encryption, resilience, recovery and regular testing. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 33 | Breach notification to the authority | Notify the supervisory authority within 72 hours of becoming aware of a reportable breach. |
| Art. 34 | Breach communication to individuals | Tell affected people without undue delay when a breach is likely to put them at high risk. |
| Art. 35 | Data protection impact assessment | Assess risks to individuals before high-risk processing, and record how you will reduce them. |
| Art. 36 | Prior consultation | Consult the authority when an impact assessment shows high risk you cannot mitigate. |
| Art. 37-39 | Data protection officer | Appoint a DPO where required, give them independence and resources, and publish their contact details. |
| Ref | Control | What it asks for |
|---|---|---|
| Art. 44-46 | Transfers outside the EEA | Transfer personal data to another country only on an adequacy decision or with safeguards, such as standard contractual clauses. |
| Art. 49 | Derogations | Rely on the narrow exceptions for specific situations only when no other transfer route is available. |
It can. If you offer goods or services to people in the EU, or monitor their behaviour there, the GDPR applies even though you are not established in the EU. Many Indian IT and BPO providers are processors under it.
72 hours from becoming aware, to the supervisory authority, unless the breach is unlikely to result in a risk to individuals. Affected people must be told without undue delay if the risk is high.
No. It lists the main duties by article so you can plan and track. The regulation and guidance from the European Data Protection Board are the authority.
No. ISO 27001 helps with the security article, but the GDPR also covers lawful basis, rights, transfers and records. ISO 27701 extends ISO 27001 for privacy.